CVE-2015-4221

Cisco IM and Presence Service (Cisco Unified Communications Manager) 9.1(1) is affected by CVE-2015-4221 due to improper restriction of access to encrypted passwords. A remote, authenticated attacker could leverage a decryption attack to obtain cleartext passwords and, as a result, execute arbitr...

CVE-2015-4221

Cisco Unified Communications Manager IM and Presence Service 9.11 does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext passwords, and consequently execute arbitrary commands, by visiting an unspecified web page and then conducting a...

Cisco SSH Key Flaw Has Echoes of Earlier Vulnerabilities

When Cisco released a patch for several of its security appliances Thursday that eliminated the presence of hard-coded SSH host and private keys, the advisory had a distinct air of familiarity about it. That’s because the company released a patch for the same problem in one of its other major...

[SECURITY] Fedora 21 Update: openssl-1.0.1k-10.fc21

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

[SECURITY] Fedora 22 Update: openssl-1.0.1k-10.fc22

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

The vulnerability of the microprogramming software of the Cisco Unified Communications Manager allows a remote attacker to bypass the device protection mechanisms.

The vulnerability in the key generator implementation util/keygen.c allows a malicious individual to discover the key through brute-force attacks...

The vulnerability of the microprogramming software of the Cisco Unified Communications Manager allows a remote attacker to gain unauthorized access to the device.

The function for receiving messages in the ntpproto.c file continues to operate even after an error message is displayed. This allows a remote attacker to gain unauthorized access to the device using specially crafted packets...

CVE-2015-0751

Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.31 is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800...

Command injection

Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.31 is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800...

CVE-2015-0751

Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.31 is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800...

Multiple Vulnerabilities in Cisco Unified Communications Manager

Cisco Unified Communications Manager is a call processing component of a Cisco IP telephony solution. A cross-site scripting and cross-site request forgery vulnerability exists in Cisco Unified Communications Manager. An unauthenticated, remote attacker could use this vulnerability to execute...

Cisco Unified Communications Manager Multiple Vulnerabilities

Multiple vulnerabilities in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS, cross-site request forgery XSRF, and phishing attacks on the affected software. The vulnerabilities are due to improper input validation of certain...

Charter Communications Fixes Data Leaking Vulnerability

Internet-cable-television provider Charter Communications recently fixed an issue with its website that was inadvertently leaking the information of tens of thousands of customers. Customers’ payment details, modem serial numbers, device names, account numbers, home addresses, were being spilled...

TLS and SSL Diffie-Hellman Key Downgrade Weakness (CVE-2015-1716; CVE-2015-4000)

A vulnerability has been detected in the way TLS protocol handles weak, legacy cipher suites. An attacker might leverage this vulnerability to intercept secure communications...

CVE-2015-0717

Cisco Unified Communications Manager 10.01.10000.12 allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546...

CVE-2015-0717

Cisco Unified Communications Manager 10.0(1.10000.12) contains a local privilege-escalation vulnerability (CVE-2015-0717) where an authenticated, local attacker can gain root privileges by injecting shell commands via an unsafely handled parameter. Root cause: failure to sanitize user input, enab...

CVE-2015-0717

Cisco Unified Communications Manager 10.01.10000.12 allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546...

Cisco Unified Communications Manager SQL Injection (CSCut33447 / CSCut33608)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by multiple SQL injection vulnerabilities due to improper validation of user-supplied input. An authenticated, remote attacker can exploit these issues to inject or modify SQL queries,...

[SECURITY] Fedora 22 Update: gnutls-3.3.15-1.fc22

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

Ed Felten Joins White house as Deputy CTO

Ed Felten, a professor at Princeton University and a well-respected voice on security and privacy issues, is joining the White House as the deputy CTO. In his new role, Felten will be working under Megan Smith, the CTO of the United States and a former Google vice president. Felten has been at...