CVE-2006-3109

Cisco CallManager suffers a cross-site scripting (XSS) vulnerability in the Administration and User Options web interfaces. Affected versions are 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1). The issue stems from improper input sanitization in ccmadmin/phon...

EUVD-2006-3106

Cross-site scripting XSS vulnerability in Cisco CallManager 3.3 before 3.35SR3, 4.1 before 4.13SR4, 4.2 before 4.23, and 4.3 before 4.31, allows remote attackers to inject arbitrary web script or HTML via the 1 pattern parameter in ccmadmin/phonelist.asp and 2 arbitrary parameters in...

CVE-2006-3109

Cross-site scripting XSS vulnerability in Cisco CallManager 3.3 before 3.35SR3, 4.1 before 4.13SR4, 4.2 before 4.23, and 4.3 before 4.31, allows remote attackers to inject arbitrary web script or HTML via the 1 pattern parameter in ccmadmin/phonelist.asp and 2 arbitrary parameters in...

Cisco CallManager 3.x4.x - Web Interface ccmuserlogon.asp Cross-Site Scripting

Cisco CallManager 3.x4.x - Web Interface ccmuserlogon.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/18504/info Cisco CallManager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the web-interface to properly sanitize user-supplied input. An...

Cisco CallManager 3.x4.x - Web Interface ccmadminphonelist.asp?Pattern Cross-Site Scripting

Cisco CallManager 3.x4.x - Web Interface ccmadminphonelist.asp?Pattern Cross-Site Scripting source: https://www.securityfocus.com/bid/18504/info Cisco CallManager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the web-interface to properly sanitize user-suppli...

Cisco CallManager 3.x/4.x - 'Web Interface 'ccmuser/logon.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18504/info Cisco CallManager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the web-interface to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the...

CVE-2006-2369

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server,...

PT-2006-3333 · Realvnc +2 · Realvnc +2

Name of the Vulnerable Software and Affected Versions: RealVNC version 4.1.1 AdderLink IP affected versions not specified Cisco CallManager affected versions not specified Description: The issue allows remote attackers to bypass authentication by specifying an insecure security type, such as Type...

TFTP File Detection (Cisco CallManager) - Active Check

The remote host has a TFTP server installed that is serving one or more Cisco CallManager files. SPDX-FileCopyrightText: 2005 Corsaire Limited Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Memory corruption

Cisco CallManager 3.2 and earlier, 3.3 before 3.35SR1, 4.0 before 4.02aSR2c, and 4.1 before 4.13SR2 allow remote attackers to 1 cause a denial of service CPU and memory consumption via a large number of open TCP connections to port 2000 and 2 cause a denial of service fill the Windows Service...

CVE-2006-0367

Unspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.35SR1, 4.0 before 4.02aSR2c, and 4.1 before 4.13SR2 allows remote authenticated users with read-only administrative privileges to obtain full administrative privileges via a "crafted URL on the CCMAdmin web page."...

CVE-2006-0368

Cisco CallManager 3.2 and earlier, 3.3 before 3.35SR1, 4.0 before 4.02aSR2c, and 4.1 before 4.13SR2 allow remote attackers to 1 cause a denial of service CPU and memory consumption via a large number of open TCP connections to port 2000 and 2 cause a denial of service fill the Windows Service...

CVE-2006-0368

CVE-2006-0368 affects Cisco CallManager versions 3.2 and earlier; 3.3 before 3.3(5)SR1; 4.0 before 4.0(2a)SR2c; and 4.1 before 4.1(3)SR2. It enables remote attackers to cause denial of service by opening a large number of TCP connections to port 2000 (CPU/memory consumption) and to ports 2001, 20...

CVE-2006-0367

Unspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.35SR1, 4.0 before 4.02aSR2c, and 4.1 before 4.13SR2 allows remote authenticated users with read-only administrative privileges to obtain full administrative privileges via a "crafted URL on the CCMAdmin web page."...

Cisco CallManager TFTP File Detection

The remote host has a TFTP server installed that is serving one or more Cisco CallManager files. These files do not themselves include any sensitive information, but do identify the TFTP server as being part of a Cisco CallManager environment. The CCM TFTP server is an essential part of providing...

[Full-disclosure] PatchAdvisor Vulnerability Alert - Cisco CallManager Remote Denial of Service Vulnerability

PatchAdvisor, Inc. www.patchadvisor.com ============================================================================ = PATCHADVISOR VULNERABILITY ALERT = = Cisco CallManager CTI Manager Remote Denial Of Service Vulnerability =...

Cisco CallManager Memory Handling Vulnerabilities

...

CVE-2005-2243

Memory leak in inetinfo.exe in Cisco CallManager CCM 3.2 and earlier, 3.3 before 3.35, 4.0 before 4.02aSR2b, and 4.1 4.1 before 4.13SR1, when Multi Level Admin MLA is enabled, allows remote attackers to cause a denial of service memory consumption via a large number of Admin Service Tool AST logi...

CVE-2005-2242

Cisco CallManager CCM 3.2 and earlier, 3.3 before 3.35, 4.0 before 4.02aSR2b, and 4.1 4.1 before 4.13SR1 allows remote attackers to cause a denial of service memory consumption and restart via crafted packets to 1 the CTI Manager ctimgr.exe or 2 the CallManager ccm.exe...

CVE-2005-2244

The aupair service aupair.exe in Cisco CallManager CCM 3.2 and earlier, 3.3 before 3.35, 4.0 before 4.02aSR2b, and 4.1 4.1 before 4.13SR1 allows remote attackers to execute arbitrary code or corrupt memory via crafted packets that trigger a memory allocation failure and lead to a buffer overflow...