CVE-2015-4262

The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.55 MR3 and 8.6 before 8.62 does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839...

Command injection

The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.55 MR3 and 8.6 before 8.62 does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839...

CVE-2015-4262

CVE-2015-4262 affects Cisco Unified MeetingPlace Web Conferencing. The password-change function does not verify the session ID or require the current password, enabling a remote attacker to reset arbitrary user passwords through a crafted HTTP request. Affected versions include 8.5(5) MR3 and 8.6...

Cisco Unified MeetingPlace Unauthorized Password Change Vulnerability

The password change functionality in the Cisco Unified MeetingPlace Web Conferencing application could allow an unauthenticated remote, attacker to change the passwords of arbitrary users. The vulnerability is due to the following: Users are not required to enter the previous password during a...

Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability (CNVD-2015-04963)

Cisco Unified Intelligence Center is a unified intelligence management center. A cross-site request forgery vulnerability exists in the Cisco Unified Intelligence Center WEB interface, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform...

CVE-2015-4274

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Unified Intelligence Center 10.01 and 10.61 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Unified Intelligence Center 10.01 and 10.61 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936...

CVE-2015-4274

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Unified Intelligence Center 10.01 and 10.61 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936...

CVE-2015-4274

Cisco Unified Intelligence Center (UC) web framework versions 10.0(1)–10.6(1) are affected by a Cross-Site Request Forgery (CSRF) vulnerability that can let remote attackers hijack user sessions and perform arbitrary actions within the context of an authenticated user. The root cause is insuffici...

Multiple Cross-Site Scripting Vulnerabilities in Cisco Unified Communications Manager (CNVD-2015-04702)

Cisco Unified Communications Manager is a call processing component of a Cisco IP telephony solution. A cross-site scripting vulnerability exists in Cisco Unified Communications Manager, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can ...

PT-2015-6493 · Cisco · Cisco Unified Intelligence Center

Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center versions 10.01 through 10.61 Description: A cross-site request forgery CSRF issue in the web framework allows remote attackers to hijack the authentication of arbitrary users. Recommendations: For versions...

Cisco Unified Communications Manager Denial of Service Vulnerability (CNVD-2015-04698)

Cisco Unified Communications Manager is a call processing component of a Cisco IP telephony solution. A security vulnerability exists in Cisco Unified Communications Manager that allows authenticated users to submit AVVID XML LAYER session requests at a special high rate, making the target...

Arcserve Unified Data Protection Management getBackupPolicies Information Disclosure (CVE-2015-4069)

An information disclosure vulnerability exists in Arcserve Unified Data Protection UDP. This vulnerability exists in EdgeServiceImpl and is due to insufficient input validation of certain SOAP requests using the getBackupPolicies method. A remote unauthenticated attacker can exploit this...

CVE-2015-4272

Multiple cross-site scripting XSS vulnerabilities in the ccmivr page in Cisco Unified Communications Manager formerly CallManager 10.52.10000.5 allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCut19580...

CVE-2015-4269

The Tomcat throttling feature in Cisco Unified Communications Manager 10.51.99995.9 allows remote authenticated users to cause a denial of service management outage by sending many requests, aka Bug ID CSCuu99709...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the ccmivr page in Cisco Unified Communications Manager formerly CallManager 10.52.10000.5 allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCut19580...

Code injection

The Tomcat throttling feature in Cisco Unified Communications Manager 10.51.99995.9 allows remote authenticated users to cause a denial of service management outage by sending many requests, aka Bug ID CSCuu99709...

CVE-2015-4269

The Tomcat throttling feature in Cisco Unified Communications Manager 10.51.99995.9 allows remote authenticated users to cause a denial of service management outage by sending many requests, aka Bug ID CSCuu99709...

CVE-2015-4272

Multiple cross-site scripting XSS vulnerabilities in the ccmivr page in Cisco Unified Communications Manager formerly CallManager 10.52.10000.5 allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCut19580...

CVE-2015-4272

Cisco Unified Communications Manager (CallManager) 10.5(2.10000.5) ccmivr page contains cross-site scripting (XSS) vulnerabilities due to insufficient input validation in several parameters. An unauthenticated, remote attacker could entice a user to follow a crafted link to inject arbitrary scrip...