CVE-2011-2545: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the SIP implementation on the Cisco SPA8000 and SPA8800 before 6.1.11, SPA2102 and SPA3102 before 5.2.13, and SPA 500 series IP phones before 7.4.9 allows remote attackers to inject arbitrary web script or HTML via the FROM field of an INVITE message, aka...

PT-2012-1562

Name of the Vulnerable Software and Affected Versions Cisco SPA8000 and SPA8800 versions prior to 6.1.11 Cisco SPA2102 and SPA3102 versions prior to 5.2.13 Cisco SPA 500 series IP phones versions prior to 7.4.9 Description A cross-site scripting XSS issue exists in the SIP implementation, allowin...

Authentication flaw

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768...

CVE-2012-0333

Cisco Small Business IP phones (SPA 500 series) with firmware 7.4.9 and earlier are affected by CVE-2012-0333 because Push XML requests do not require authentication, enabling remote attackers to initiate calls via crafted XML (Bug CSCts08768). Affected product: SPA 500 series; root cause: unauth...

CVE-2012-0333: Improper Authentication

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768...