CVE-2013-3404

Cisco CUCM (7.1.x–9.1(1a)) is affected by a remote SQL injection vulnerability that allows an unauthenticated attacker to run arbitrary SQL via unspecified vectors and, via metadata, potentially reconstruct encrypted credentials. Exploitation can enable credential discovery and, in combination wi...

CVE-2013-4869

Cisco Unified Communications Manager CUCM 7.1x through 9.12 and the IM & Presence Service in Cisco Unified Presence Server through 9.12 use the same CTI and database-encryption key across different customers' installations, which makes it easier for context-dependent attackers to defeat...

CVE-2013-3397

Cisco CUCM Unified Serviceability CSRF vulnerability (CVE-2013-3397) arises from insufficient CSRF protections in the Unified Serviceability component. Remote attackers could hijack the authentication of arbitrary users to perform actions in the Unified Serviceability pages, potentially with the ...

CVE-2013-1188

Cisco Unified Communications Manager CUCM does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service application slowdown via a series of requests, aka Bug ID CSCud39515...

CVE-2013-1188

Cisco Unified Communications Manager CUCM does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service application slowdown via a series of requests, aka Bug ID CSCud39515...

CVE-2013-1188

Cisco Unified Communications Manager (CUCM) is affected by CVE-2013-1188 due to incomplete throttling of authentication requests. The vulnerability allows remote attackers to degrade the CUCM application’s performance (denial of service) by sending a flood of authentication attempts. Affected beh...

CVE-2013-1188: Improper Authentication

Cisco Unified Communications Manager CUCM does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service application slowdown via a series of requests, aka Bug ID CSCud39515...

CVE-2013-1240

The Cisco Unified Communications Manager (CUCM) CLI vulnerability arises from incomplete input validation in the command-line interface. It enables a local, authenticated attacker to read arbitrary files on the device by issuing a crafted command. The exploit requires local access; no public expl...

CVE-2013-1134

The Location Bandwidth Manager LBM Intracluster-communication feature in Cisco Unified Communications Manager CUCM 9.x before 9.11 does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against transaction records, and cause ...

CVE-2013-1133

CVE-2013-1133 affects Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2, 8.6 BE3k before 8.6(4) BE3k, and 9.x before 9.0(1). The vulnerability enables remote, unauthenticated attackers to cause a denial of service (CPU consumption, GUI and voice outages) by sending malformed packe...

CVE-2013-1134

CVE-2013-1134 affects Cisco Unified Communications Manager (CUCM) 9.x prior to 9.1(1) where the Location Bandwidth Manager (LBM) intracluster communication does not require authentication from the remote LBM Hub node. This allows remote, unauthenticated attackers to poison LBM transaction records...

CVE-2012-1361

Cisco IOS versions 15.1 and 15.2 are affected when the Multicast Music-on-Hold (MMoH) feature in CUCM is enabled. The vulnerability permits remote attackers to disclose sensitive crosstalk information by listening in on PSTN calls, due to insecure handling of multicast traffic. Cisco Security Adv...

CVE-2012-0376

CVE-2012-0376 affects Cisco Unified Communications Manager (CUCM) 8.5, specifically the voice-sipstack component. The issue allows remote attackers to trigger a denial of service (core dump) through SIP message vectors that arrive after an upgrade (Bug ID CSCtj87367). Connected documents confirm ...

Memory corruption

Memory leak in Cisco IOS 12.4 and 15.0 through 15.2, and Cisco Unified Communications Manager CUCM 7.x, allows remote attackers to cause a denial of service memory consumption via a crafted response to a SIP SUBSCRIBE message, aka Bug IDs CSCto93837 and CSCtj61883...

CVE-2011-4019

CVE-2011-4019 affects Cisco IOS 12.4 and 15.0–15.2, and Cisco Unified Communications Manager (CUCM) 7.x. The issue is a memory leak that allows remote attackers to cause denial of service by sending a crafted SIP SUBSCRIBE response. Root cause is a vulnerability in handling SIP SUBSCRIBE messages...

CVE-2012-0361

CVE-2012-0361 affects the sccp-protocol component in Cisco IP Communicator (CIPC) versions 7.0–8.6. The issue is that it does not limit the rate of SCCP messages to Cisco Unified Communications Manager (CUCM), which allows remote attackers to cause a denial of service via vectors that trigger (1)...

CVE-2012-0361: Undefined Security Weakness

The sccp-protocol component in Cisco IP Communicator CIPC 7.0 through 8.6 does not limit the rate of SCCP messages to Cisco Unified Communications Manager CUCM, which allows remote attackers to cause a denial of service via vectors that trigger 1 on hook and 2 off hook messages, as demonstrated b...

Code injection

Cisco Unified Communications Manager CUCM with software 6.x and 7.x before 7.15bsu5, 8.0 before 8.03asu3, and 8.5 and 8.6 before 8.62asu1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.62asu1 allow remote attackers to cause a denial of service...

CVE-2011-4486

Cisco CUCM/Skinny (SCCP) vulnerabilities (CVE-2011-4486) allow remote, unauthenticated attackers to cause a device reload via crafted SCCP registrations. Affected software versions include CUCM 6.x and 7.x prior to 7.1(5b)su5, CUCM 8.0 prior to 8.0(3a)su3, and CUCM 8.5/8.6 prior to 8.6(2a)su1, pl...

CVE-2011-4487

CVE-2011-4487 affects Cisco Unified Communications Manager (CUCM) and Cisco BE6000/BE5000/BE3000 with various 6.x–8.x releases. The issue is a SQL injection in the SCCP registration handling, allowing remote, unauthenticated attackers to execute arbitrary SQL commands against the CUCM database, p...