CVE-2014-8018

Cisco SA-20150106-CVE-2014-8018 describes a reflected XSS vulnerability in the web framework of Cisco Unified Communications Domain Manager (BVSM pages) allowing unauthenticated remote attackers to inject arbitrary script via a crafted link. Root cause: improper validation of user-supplied input....

Cisco Unified Communications Domain Manager Blind Command Injection Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager Application Software version 8 could allow an authenticated, remote attacker to inject commands that can be executed by the underlying operating system with the privileges of the web server process. The...

CVE-2014-8010

The web framework in Cisco Unified Communications Domain Manager 8 allows remote authenticated administrators to execute arbitrary OS commands via crafted values, aka Bug ID CSCuq50205...

CVE-2014-8010

The Cisco Unified Communications Domain Manager web framework (Application Software, version 8) is affected by CVE-2014-8010. The root cause is insufficient input validation when the user sets certain values in the UI, allowing an authenticated, remote attacker to inject and execute OS commands w...

CVE-2014-3380

Cisco Unified Communications Domain Manager Platform Software 4.4(.3) and earlier are affected by CVE-2014-3380, where unauthenticated remote attackers can cause high CPU utilization by sending crafted TCP packets at a high rate, leading to denial of service. The issue arises from improper handli...

Cisco Unified Communications Domain Manager multiple security vulnerabilities

Default ssh-key, privilege escalation, SSRF...

CVE-2014-3320

Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager CDM 8.1.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for unspecified scripts, aka Bu...

CVE-2014-3320

Cisco Unified Communications Domain Manager (CDM) admin HTTP redirect vulnerability (CVE-2014-3320) affects CDM 8.1(.4) and earlier. The issue stems from insufficient validation of input when invoking scripts via the admin web interface, allowing unauthenticated, remote attackers to redirect user...

Open redirect

Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager CDM 8.1.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for unspecified scripts, aka Bu...

Cisco Unified Communications Domain Manager Admin HTTP Redirect Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager Cisco Unified CDM Application Software could allow an unauthenticated, remote attacker to redirect a user to a possible malicious website. The vulnerability is due to insufficient validation of user input when...

CVE-2014-3300

The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041...

CVE-2014-2197

The Administration GUI in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID...

Improper access control

The Administration GUI in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID...

Improper access control

The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041...

CVE-2014-2197

CVE-2014-2197 affects Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software prior to 8.1.4. The Admin GUI did not properly implement access control, allowing remote authenticated users to modify administrative credentials via a crafted URL (Privilege Escalation typ...

CVE-2014-3300

The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041...

CVE-2014-3300

CVE-2014-3300 affects Cisco Unified Communications Domain Manager (CDM) BVSMWeb portal in Unified CDM Application Software prior to 10, where insufficient access control allows remote attackers to modify BVSMWeb user information via a crafted URL. Related materials show Metasploit/Viproy modules ...

Cisco Patches Hardcoded SSH Key Vulnerability in UCM

The Cisco Unified Communications Domain Manager contains a default private SSH key that could allow an attacker to run arbitrary code on vulnerable installations. The bug is about as serious as they come, giving remote, unauthenticated attackers access to affected machines with the rights of a ro...

Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

Cisco Unified Communications Domain Manager Cisco Unified CDM is affected by the following vulnerabilities: Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability Cisco Unified Communications Domain Manager Default SSH Key Vulnerability Cisco Unified Communications Domain...

Cisco Releases Security Advisory for Unified Communications Domain Manager

Cisco has released a security advisory to address multiple vulnerabilities in Cisco Unified Communications Domain Manager, some of which may allow an attacker to execute arbitrary commands or obtain privileged access to the affected system. The following updates are available: Cisco Unified CDM...