CVE-2015-4318

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528...

CVE-2015-4318

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528...

CVE-2015-4318

CVE-2015-4318 affects Cisco TelePresence Video Communication Server Expressway (X8.5.2). The root cause is improper handling of malformed GET requests, allowing an unauthenticated, remote attacker to cause a denial of service, potentially affecting availability. Multiple sources (NVD entry and Ci...

CVE-2015-4319

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

CVE-2015-4316

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

Design/Logic Flaw

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

Input validation

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

CVE-2015-4319

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

CVE-2015-4316

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

CVE-2015-4316

CVE-2015-4316 affects Cisco TelePresence Video Communication Server Expressway X8.5.2, specifically the Mobile and Remote Access (MRA) endpoint-validation feature. The issue is improper validation of the registering phone line, enabling an authenticated remote attacker to impersonate legitimate u...

CVE-2015-4319

CVE-2015-4319 affects Cisco TelePresence Video Communication Server (VCS) Expressway; the Password Change function in the Administrative Web Interface fails to properly enforce authorization, enabling an authenticated, remote attacker to reset arbitrary active-user passwords via crafted packets. ...

CVE-2015-4328

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-4327

The CLI in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542...

CVE-2015-4320

The Configuration Log File component in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340...

CVE-2015-4317

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469...

CVE-2015-4315

The Call Policy Configuration page in Cisco TelePresence Video Communication Server VCS Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853...

Input validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

Authentication flaw

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469...

Code injection

The System Snapshot feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422...

CVE-2015-4327

The CVE-2015-4327 issue affects Cisco TelePresence Video Communication Server Expressway X8.5.2 CLI. The root cause is insufficient input validation when writing script arguments to a local file, enabling an authenticated, local attacker to gain root privileges by injecting/overwriting script par...