CVE-2013-3433

Untrusted search path vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02276...

CVE-2013-3404

SQL injection vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows remote attackers to execute arbitrary SQL commands via unspecified vectors, leading to discovery of encrypted credentials by leveraging metadata, aka Bug ID CSCuh01051...

CVE-2013-3402

An unspecified function in Cisco Unified Communications Manager CUCM 7.1x through 9.12 allows remote authenticated users to execute arbitrary commands via unknown vectors, aka Bug ID CSCuh73440...

CVE-2013-3403

CVE-2013-3403 corresponds to multiple untrusted search path vulnerabilities in Cisco Unified Communications Manager (CUCM) versions 7.1.x–9.1(1a) that allow a local user to gain privileges by exploiting unspecified file-permission and environment-variable issues in privileged programs (Bug ID CSC...

CVE-2013-3434

CVE-2013-3434 affects Cisco Unified Communications Manager (CUCM) versions 7.1.x through 9.1(1a). The root cause is an untrusted search path due to unspecified file-permission and environment-variable issues on privileged programs (Bug CSCui02242). This enables local privilege escalation for auth...

CVE-2013-3434

Untrusted search path vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02242...

Cisco Releases Multiple Security Advisories

Cisco has released two security advisories to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code on a vulnerable system or cause a denial-of-service condition. US-CERT encourages users and administrators to review the following Cisco...

CVE-2013-3433

CVE-2013-3433 concerns Cisco Unified Communications Manager (CUCM) 7.1.x–9.1(1a). The root cause is improper file permissions on a privileged system binary, leading to an untrusted search path that enables a local, authenticated attacker to escalate privileges. Public PoC code exists. Impact is l...

CVE-2013-4869

Cisco Unified Communications Manager (CUCM) versions 7.1.x–9.1(2) and the IM & Presence Service in Cisco Unified Presence Server up to 9.1(2) share the same CTI and database-encryption key across different customer installations. This creates a cryptographic risk where context-dependent attackers...

CVE-2013-3403

Multiple untrusted search path vulnerabilities in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allow local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCuh73454...

CVE-2013-3402

CVE-2013-3402 affects Cisco Unified Communications Manager (CUCM) 7.1.x through 9.1(2). The root cause is improper validation in an unspecified function that allows a remote, authenticated attacker to execute arbitrary commands via unknown vectors, effectively a command-injection bug (Bug ID CSCu...

CVE-2013-3404

Cisco CUCM (7.1.x–9.1(1a)) is affected by a remote SQL injection vulnerability that allows an unauthenticated attacker to run arbitrary SQL via unspecified vectors and, via metadata, potentially reconstruct encrypted credentials. Exploitation can enable credential discovery and, in combination wi...

CVE-2013-3412

Cisco Unified Communications Manager (CUCM) is affected by a blind SQL injection vulnerability (CVE-2013-3412) in versions 7.1(x) through 9.1(2). The issue allows an authenticated, remote attacker to execute arbitrary SQL commands via unspecified vectors, potentially impacting confidentiality, in...

Cisco Unified Communications Manager Command Injection Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM could allow an authenticated, remote attacker to execute commands on the underlying operating system with the privileges of the database user. The vulnerability is due to improper validation of user-supplied input. An attacker cou...

Cisco Unified Communications Manager Blind SQL Injection Vulnerability

A vulnerability in Cisco Unified Communication Manager Unified CM could allow an authenticated, remote attacker to execute a blind Structured Query Language SQL injection. The vulnerability is due to improper validation of user-supplied requests by the Cisco Unified CM. An attacker could exploit...

Cisco Unified Communications Manager Privilege Escalation Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM could allow an authenticated, local attacker to elevate privileges on the system. The vulnerability is due to improper file permissions, environment variables, and relative paths in a privileged system script. An attacker could...

Cisco Unified Communications Manager Privilege Escalation Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM could allow an authenticated, local attacker to escalate privileges on the system. The vulnerability is due to improper file permissions on a privileged system binary. An attacker could exploit this vulnerability by modifying a...

Cisco Unified Communications Manager Privilege Escalation Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM could allow an authenticated, local attacker to escalate privileges on the system. The vulnerability is due to improper file permissions on a privileged system binary. An attacker could exploit this vulnerability by modifying a...

Cisco Unified Communications Manager Remote Blind SQL Injection Vulnerability

Cisco Unified Communication Manager Unified CM contains a vulnerability that could allow an unauthenticated, remote attacker to execute a blind Structured Query Language SQL injection. The vulnerability is due to improper validation of user-supplied requests by the Cisco Unified CM. An attacker...

Multiple Vulnerabilities in Cisco Unified Communications Manager

Cisco Unified Communications Manager Unified CM contains multiple vulnerabilities that could be used together to allow an unauthenticated, remote attacker to gather user credentials, escalate privileges, and execute commands to gain full control of the vulnerable system. A successful attack could...