CVE-2019-12711

The CVE-2019-12711 issue affects Cisco Unified Communications Manager (CUCM) and CUCM Session Management Edition (SME) Web UI. Root cause: improper restrictions on XML entities leading to XML External Entity (XXE) processing. Impact: unauthenticated remote attacker can read local files or trigger...

CVE-2019-12707 Multiple Cisco Unified Communications Products Cross-Site Scripting Vulnerability

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient...

CVE-2019-12707

CVE-2019-12707 describes an XSS vulnerability in the web-based interfaces of multiple Cisco Unified Communications products due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can entice a user to click a crafted link, potentially executing arbitrary script ...

CVE-2019-12707 Multiple Cisco Unified Communications Products Cross-Site Scripting Vulnerability

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient...

CVE-2019-12711 Cisco Unified Communications Manager XML External Expansion Vulnerability

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service DoS condition. The vulnerability ...

CVE-2019-12710

CVE-2019-12710 is a SQL injection flaw in Cisco Unified Communications Manager (and Session Management Edition). An authenticated, remote attacker can exploit improper validation of input in SQL queries by sending crafted requests to the web-based interface, potentially revealing data from the da...

CVE-2019-12710 Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries. The...

Cisco Unified Communications Manager XML External Expansion Vulnerability

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service DoS condition. The vulnerability ...

Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition SME, Cisco Unified Communications Manager IM and Presence Unified CM IM&P Service, and Cisco Unity Connection could allow an unauthenticated, remote...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of the...

Multiple Cisco Unified Communications Products Cross-Site Scripting Vulnerability

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient...

Cisco Unified Communications Manager Security Bypass Vulnerability

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to bypass security restrictions. The vulnerability is due to improper handling of malformed HT...

Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries. The...

[SECURITY] Fedora 29 Update: openssl-1.1.1d-1.fc29

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

Cisco Unified Communications Manager CVE-2019-15272 Security Bypass Vulnerability

Description Cisco Unified Communications Manager is prone to a security-bypass vulnerability. Successful exploits may allow an attacker to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. This issue is tracked by Cisco Bug ID CSCvp14434...

Multiple Cisco Unified Communications Products Cross Site Request Forgery Vulnerability

Description Multiple Cisco Unified Communications Products are prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the...

Multiple Cisco Unified Communications Products CVE-2019-12707 Cross Site Scripting Vulnerability

Description Multiple Cisco Unified Communications Products are prone to a cross-site scripting vulnerability because they fail to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affecte...

PT-2019-3811 · Cisco · Cisco Unified Communications Manager Session Management Edition +1

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME affected versions not specified Description: A vulnerability in the web-based interface could allow an unauthenticated, remote attack...

Cisco Unified Communications Manager CVE-2019-12715 Cross Site Scripting Vulnerability

Description Cisco Unified Communications Manager is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Cisco Unified CM CVE-2019-12711 XML Entity Expansion Multiple Security Vulnerabilities

Description Cisco Unified Communications Manager is prone to multiple security vulnerabilities. An attacker can exploit these issues to gain access to sensitive information or cause denial-of-service conditions. These issues are being tracked by Cisco Bug ID CSCvp46079. Technologies Affected Cisc...