CVE-2015-4315

Cisco TelePresence Video Communication Server Expressway CVE-2015-4315 vulnerability: Call Policy Configuration page improperly validates external DTDs, enabling an authenticated, remote attacker to read arbitrary files or cause a DoS via a crafted XML document. Affected product: VCS Expressway (...

CVE-2015-4328

Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 is affected by CVE-2015-4328 due to improper authorization of a read-only user attribute, enabling remote authenticated attackers to execute arbitrary OS commands via crafted HTTP requests on the Unified Communications lookup p...

Cisco TelePresence Video Communication Server Expressway Password Change Vulnerability

The Cisco TelePresence Video Communication Server VCS Expressway is a telepresence video communication server. The Password Change feature in the Web management interface of the Cisco TelePresence VCS Expressway fails to properly perform authentication operations, allowing remote attackers to...

Cisco TelePresence Video Communication Server Expressway Remote Command Injection Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

CVE-2015-4317

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469...

CVE-2015-4327

The CLI in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542...

CVE-2015-4328

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-4315

The Call Policy Configuration page in Cisco TelePresence Video Communication Server VCS Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853...

Cisco TelePresence Video Communication Server Expressway Arbitrary Command Execution Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

CVE-2015-4317

Cisco TelePresence Video Communication Server Expressway X8.5.2 is affected by CVE-2015-4317, a denial-of-service vulnerability caused by improper handling of malformed authentication messages. An unauthenticated, remote attacker can send a crafted authentication packet with invalid variables to ...

CVE-2015-4320

The CVE-2015-4320 entry affects Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2, specifically the Configuration Log File component. Root cause: sensitive information is written into certain log files, enabling an authenticated, remote attacker to read logs and obtain sensiti...

Cisco TelePresence Video Communication Server Expressway Privilege Gain Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

CVE-2015-4320

The Configuration Log File component in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340...

Cisco TelePresence Video Communication Server Expressway HTTP GET Request Denial of Service Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows remote users to send special HTTP GET requests for denial of service attacks...

Cisco TelePresence Video Communication Server Expressway Logging Error Message Acquisition Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway, where the system records a password hash in the configuration log file when a user changes the...

Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows authenticated users to send special authentication messages for denial of service...

Cisco TelePresence Video Communication Server Expressway Password Hash Acquisition Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows an authenticated user to download a snapshot of the system and obtain password hash...

Cisco TelePresence Video Communication Server Expressway User Forgery Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows remotely authenticated users to send special SIP messages to register for phone cal...

Cisco TelePresence Video Communication Server Expressway External DTD File Read Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows a remote authenticated user to send a special XML file containing external DTD...

Cisco TelePresence Video Communication Server Expressway Arbitrary File Injection Vulnerability

A vulnerability in the command-line interface CLI of the Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, local attacker to inject arbitrary arguments to a script on an affected system. The vulnerability is due to insufficient input validation of content ...