CVE-2015-4330: Improper Neutralization of Special Elements used in an OS Command

A local file script in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556...

PT-2015-6519

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.2 Description A local file script issue allows local users to gain privileges for OS command execution via invalid parameters. Recommendations For Cisco TelePresence Vid...

CVE-2015-6261: Exposure of Sensitive Information to an Unauthorized Actor

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to bypass intended access restrictions and read configuration files by leveraging the Mobile and Remote Access MRA role and establishing a TFTP session, aka Bug ID CSCuv78531...

PT-2015-1976

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.5.2 Description The issue is related to a lack of protection for service data in the Cisco TelePresence Video Communication Server software. It allows a remote, authenticated attacker t...

CVE-2015-4329

The administrator web interface in Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796...

Input validation

The administrator web interface in Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796...

CVE-2015-4303

CVE-2015-4303 affects Cisco TelePresence Video Communication Server (VCS) with version X8.5.2 (Expressway/VCs family). The root cause is insufficient input validation in a web framework component, allowing an authenticated, remote attacker to execute arbitrary commands at the nobody user privileg...

Information disclosure

The Configuration Log File component in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340...

PT-2015-1963

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.5.2 Description The issue exists due to insufficient input validation in the software. It allows a remote attacker to execute arbitrary OS commands using a specially crafted HTTP reques...

PT-2015-1956

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions prior to a fixed version Description The issue exists due to insufficient input validation on the Call Policy Configuration page of the Cisco TelePresence Video Communication Server. This...

CVE-2015-4315

Cisco TelePresence Video Communication Server Expressway CVE-2015-4315 vulnerability: Call Policy Configuration page improperly validates external DTDs, enabling an authenticated, remote attacker to read arbitrary files or cause a DoS via a crafted XML document. Affected product: VCS Expressway (...

CVE-2015-4314

The System Snapshot feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422...

Cisco TelePresence Video Communication Server Expressway Arbitrary Command Execution Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

PT-2015-1954

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server version X8.5.2 Description The issue is related to insufficient access control for certain features in the Cisco TelePresence Video Communication Server, which can be exploited by a remote attacker...

Cisco TelePresence Video Communication Server Expressway Privilege Gain Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

PT-2015-1961

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.2 Description The issue concerns the Configuration Log File component, which lacks protection of sensitive data. This allows a remote authenticated user to obtain...

PT-2015-1964

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server version X8.5.2 Description The issue allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests. This is due to insufficient input validation in the device's...

CVE-2015-4320: Exposure of Sensitive Information to an Unauthorized Actor

The Configuration Log File component in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340...

CVE-2015-4314: Exposure of Sensitive Information to an Unauthorized Actor

The System Snapshot feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422...

CVE-2015-4317: Undefined Security Weakness

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469...