Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool

The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager CDM, before version 10, doesn't implement access control properly, which allows remote attackers to modify user information. This module exploits the vulnerability to make unauthorized speed dial entity...

OpenSSL Ephemeral ECDH Cipher Suite Handshake Downgrade (CVE-2014-3572)

A vulnerability has been detected in the way OpenSSL handles TLS handshakes involving certain cipher suites. An attacker might leverage this vulnerability to impersonate a server and intercept secure communications...

Cisco Unified Communications Domain Manager XSS Vulnerability

A vulnerability in the web framework of the Cisco Unified Communications Domain Manager application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface on an affected system. The vulnerability is due to imprope...

Cisco Unified Communications Manager (CUCM) Detection

Binary data ciscoucmdetect.nbin...

Cisco Unified Communications Manager TLS SAN Field MitM (CSCuq86376)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by a security bypass vulnerability due to improper validation of the SAN field in TLS certificates. A remote attacker can impersonate a Cisco TelePresense Video Communication Server VCS...

CVE-2014-8018

Multiple cross-site scripting XSS vulnerabilities in Business Voice Services Manager BVSM pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Business Voice Services Manager BVSM pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555,...

CVE-2014-8018

Cisco SA-20150106-CVE-2014-8018 describes a reflected XSS vulnerability in the web framework of Cisco Unified Communications Domain Manager (BVSM pages) allowing unauthenticated remote attackers to inject arbitrary script via a crafted link. Root cause: improper validation of user-supplied input....

DEBIAN-CVE-2014-9358

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a 1 "docker load" operation or 2 "registry communications."...

Path traversal

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a 1 "docker load" operation or 2 "registry communications."...

UBUNTU-CVE-2014-9358

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a 1 "docker load" operation or 2 "registry communications."...

CVE-2014-9358

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a 1 "docker load" operation or 2 "registry communications."...

Amazon Linux AMI : docker (ALAS-2014-461)

Path traversal attacks are possible in the processing of absolute symlinks. In checking symlinks for traversals, only relative links were considered. This allowed path traversals to exist where they should have otherwise been prevented. This was exploitable via both archive extraction and through...

Cisco Unified Communications Domain Manager Blind Command Injection Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager Application Software version 8 could allow an authenticated, remote attacker to inject commands that can be executed by the underlying operating system with the privileges of the web server process. The...

CVE-2014-8010

The web framework in Cisco Unified Communications Domain Manager 8 allows remote authenticated administrators to execute arbitrary OS commands via crafted values, aka Bug ID CSCuq50205...

Design/Logic Flaw

The web framework in Cisco Unified Communications Domain Manager 8 allows remote authenticated administrators to execute arbitrary OS commands via crafted values, aka Bug ID CSCuq50205...

CVE-2014-8010

The Cisco Unified Communications Domain Manager web framework (Application Software, version 8) is affected by CVE-2014-8010. The root cause is insufficient input validation when the user sets certain values in the UI, allowing an authenticated, remote attacker to inject and execute OS commands w...

CVE-2014-8010

The web framework in Cisco Unified Communications Domain Manager 8 allows remote authenticated administrators to execute arbitrary OS commands via crafted values, aka Bug ID CSCuq50205...

EC3 Head Paints Bleak Cybercrime Picture

WASHINGTON D.C. – Everyone has the right to privacy, said Troels Oerting, head of the Europol’s European Cybercrime Center EC3, at Georgetown Law’s Cybercrime2020 conference yesterday. However, he went on, if you break your contract with society, that right can be taken away. Oerting noted that i...

Cisco Unified Communications Manager Unspecified SQL Injection (CSCup88089)

The version of Cisco Unified Communications Manager installed on the remote host is affected by an unspecified SQL injection vulnerability due to a failure to properly sanitize user-supplied input in the administrative web interface. This allows an authenticated, remote attacker to obtain...