Design/Logic Flaw

The Java Servlet framework on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 and Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x does not require administrative authentication for unspecified actions, which allows remote...

Code injection

Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x allow remote attackers to cause a denial of service process crash via a crafted Real-Time Transport Control Protocol RTCP UDP packet, aka Bug ID CSCth60993...

Command injection

The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCth24671...

CVE-2011-0376

The TFTP implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x, 1.6.0, and 1.6.1 allows remote attackers to obtain sensitive information via a GET request, aka Bug ID CSCte43876...

CVE-2011-0378

Summary: CVE-2011-0378 affects Cisco TelePresence endpoint devices running 1.2.x–1.5.x. The vulnerability is an XML-RPC Command Injection that could allow an unauthenticated attacker within the broadcast domain to execute arbitrary commands with elevated privileges. Exploitation would involve sen...

CVE-2011-0391

Cisco TelePresence Recording Server devices with software 1.6.x allow remote attackers to cause a denial of service thread consumption and device outage via a malformed request, related to an "ad hoc recording" issue, aka Bug ID CSCtf97205...

CVE-2011-0384

The Java Servlet framework on Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x does not require administrative authentication for unspecified actions, which allows remote attackers to execute arbitrary code via a crafted request, aka Bug ID CSCtf01253...

CVE-2011-0372

Cisco TelePresence endpoint devices running software 1.2.x–1.5.x are affected by CVE-2011-0372 due to an unauthenticated CGI access vulnerability that enables remote command execution via malformed CGI requests (command injection). The issue stems from the CGI implementation on affected Cisco Tel...

CVE-2011-0373

Cisco TelePresence endpoint devices running 1.2.x–1.5.x are affected by CVE-2011-0373 (CGI Command Injection) due to a malformed CGI request over HTTPS (port 443). An authenticated remote attacker could execute arbitrary commands with elevated privileges on vulnerable endpoints. The Cisco advisor...

CVE-2011-0374

The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31659...

CVE-2011-0379

Buffer overflow on Cisco Adaptive Security Appliances ASA 5500 series devices with software 1.6.x; Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x; Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x; and Cisco TelePresence Manager...

CVE-2011-0379

CVE-2011-0379 is a buffer overflow in Cisco TelePresence components triggered by crafted Cisco Discovery Protocol packets. Affected products include Cisco ASA 5500 series with software 1.6.x, Cisco TelePresence Multipoint Switch (CTMS) with 1.0.x–1.6.x, Cisco TelePresence endpoints (1.2.x–1.6.x),...

CVE-2011-0383

CVE-2011-0383 describes unauthenticated remote code execution via crafted requests in the Java Servlet framework of Cisco TelePresence Recording Server (software 1.6.x before 1.6.2) and Cisco TelePresence Multipoint Switch (CTMS) devices (software 1.0.x, 1.1.x, 1.5.x, 1.6.x). The root cause is in...

CVE-2011-0384

CVE-2011-0384 impacts Cisco TelePresence Multipoint Switch (CTMS) software 1.0.x, 1.1.x, 1.5.x, 1.6.x. The vulnerability arises from the Java Servlet framework not requiring administrative authentication for certain actions, enabling a remote attacker to execute arbitrary code via a crafted reque...

CVE-2011-0387

Cisco TelePresence Multipoint Switch (CTMS) is affected by CVE-2011-0387, tied to Unauthenticated Servlet Access in the administrative web interface. Cisco’s advisory indicates CTMS releases prior to 1.7.1 (covering 1.0.x, 1.1.x, 1.5.x, 1.6.x) are vulnerable. The issue allows a remote, authentica...

CVE-2011-0382

CVE-2011-0382 is a CGI Command Injection vulnerability in Cisco TelePresence Recording Server 1.6.x prior to 1.6.2. An unauthenticated attacker can trigger remote command execution via a crafted request to port 443. The Cisco advisory maps this to bug CSCtf97221 and lists the affected versions; f...

CVE-2011-0391

CVE-2011-0391 affects Cisco TelePresence Recording Server devices running software 1.6.x. The issue is a denial-of-service condition caused by a malformed request related to the ad hoc recording feature, enabling an unauthenticated remote attacker to exhaust threads and cause device outage. Cisco...

CVE-2011-0382

The CGI subsystem on Cisco TelePresence Recording Server devices with software 1.6.x before 1.6.2 allows remote attackers to execute arbitrary commands via a request to TCP port 443, related to a "command injection vulnerability," aka Bug ID CSCtf97221...

CVE-2011-0373

The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31685...

CVE-2011-0388

CVE-2011-0388 affects Cisco TelePresence Recording Server (software 1.6.x) and Cisco TelePresence Multipoint Switch (CTMS) (software 1.0.x, 1.1.x, 1.5.x, 1.6.x). The issue is that remote access to the Java servlet RMI interface is not properly restricted, enabling unauthenticated remote attackers...