CVE-2018-0204

CVE-2018-0204 affects the Cisco Prime Collaboration Provisioning Tool web portal. The root cause is weak login controls, enabling an unauthenticated, remote attacker to perform brute-force login attempts that can restrict user access and cause a DoS condition for individual users. The impact is r...

CVE-2018-0203

A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability. The vulnerability is due to improper handling of domain information in the affected software. An unauthenticated, remote...

CVE-2018-0200

A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based interface of an affected product. The vulnerability is due to insufficient validation of...

CVE-2018-0124

A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker...

CVE-2018-0203

A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability. The vulnerability is due to improper handling of domain information in the affected software. An unauthenticated, remote...

CVE-2018-0205

A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by...

CVE-2018-0139

The CVE-2018-0139 issue affects Cisco Unified Customer Voice Portal (CVP) IVR management connection interface. An unauthenticated remote attacker can cause the IVR-CVP connection to disconnect, resulting in a system-wide DoS by disrupting new call handling. Root cause: improper handling of TCP co...

CVE-2018-0148

A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller IMC Supervisor Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected...

CVE-2018-0148

CVE-2018-0148 affects Cisco UCS Director Software and Cisco IMC Supervisor Software, where the web-based management interface is vulnerable to cross-site request forgery (CSRF). An unauthenticated, remote attacker can induce an authenticated user to click a malicious link, enabling arbitrary acti...

CVE-2018-0200

A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based interface of an affected product. The vulnerability is due to insufficient validation of...

CVE-2018-0199

A vulnerability in Cisco Jabber Client Framework JCF could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could...

CVE-2018-0199

CVE-2018-0199 affects Cisco Jabber Client Framework (JCF) for Windows and Mac. The issue is improper neutralization of scripts in attributes in a web page, enabling an unauthenticated, remote attacker to execute arbitrary JavaScript in the Jabber client and potentially achieve remote code executi...

CVE-2018-0205

The CVE-2018-0205 issue affects Cisco Prime Collaboration Provisioning Tool, specifically the User Provisioning tab. It arises from improper input validation, allowing an unauthenticated, remote attacker to inject crafted data into the provisioning database and trigger a cross-site scripting (XSS...

CVE-2018-0206

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due...

CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

CVE-2018-0139

A vulnerability in the Interactive Voice Response IVR management connection interface for Cisco Unified Customer Voice Portal CVP could allow an unauthenticated, remote attacker to cause the IVR connection to disconnect, creating a system-wide denial of service DoS condition. The vulnerability is...

Input validation

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is du...

CVE-2018-0129

A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is du...

CVE-2018-0128

A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due t...