CVE-2014-9212

Multiple cross-site scripting XSS vulnerabilities in Altitude uAgent in Altitude uCI Unified Customer Interaction 7.5 allow remote attackers to inject arbitrary web script or HTML via 1 an email hyperlink or the 2 style parameter in the image attribute section...

CVE-2014-9212

CVE-2014-9212 affects Altitude uAgent/uCI 7.5 with multiple XSS vulnerabilities. An attacker can inject arbitrary script via (1) an email hyperlink or (2) the style parameter in the image attribute section. Affected product: Altitude uAgent Web within Altitude uCI 7.5. CVSS v2 base score 4.3 (Med...

Cisco Unified Communications Manager Unspecified SQL Injection (CSCup88089)

The version of Cisco Unified Communications Manager installed on the remote host is affected by an unspecified SQL injection vulnerability due to a failure to properly sanitize user-supplied input in the administrative web interface. This allows an authenticated, remote attacker to obtain...

Code injection

Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...

CVE-2014-8000

Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...

CVE-2014-8000

CVE-2014-8000 affects Cisco Unified Communications Manager IM and Presence Service 9.1(1). The vulnerability arises from improper sanitization of returned messages, causing different URL responses depending on whether a username exists, enabling remote attackers to enumerate valid user accounts v...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Integrated Management Controller in Cisco Unified Computing System allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuq45477...

CVE-2014-7996

Cisco UCS Integrated Management Controller CIMC is affected by a CSRF vulnerability (CVE-2014-7996) in its web framework. An unauthenticated, remote attacker can perform a CSRF attack and hijack user sessions. The issue stems from insufficient CSRF protections in CIMC’s web interface. Impact as d...

CVE-2014-7991

The Remote Mobile Access Subsystem in Cisco Unified Communications Manager CM 10.01 and earlier does not properly validate the Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a...

CVE-2014-7991

The CVE-2014-7991 issue affects Cisco Unified Communications Manager (CM) Remote Mobile Access Subsystem for CM 10.0(1) and earlier. It stems from improper validation of the SAN field in TLS certificates, enabling a remote attacker to impersonate a VCS core device and perform MITM attacks when a ...

Threat Outbreak Alert RuleID12408: Email Messages Distributing Malicious Software on November 13, 2014

Medium Alert ID: 36412 First Published: 2014 November 13 16:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12408 may contain the following files: Name |...

Cisco Unified Communications Manager SSLv3 Information Disclosure (cisco-sa-20141015-poodle) (POODLE)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted...

Cisco Unified Communications Manager Remote Mobile Access Subsystem Vulnerability

A vulnerability in the Remote Mobile Access Subsystem in Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to supply a crafted Transport Layer Security TLS certificate that may be accepted by the affected device. The vulnerability is due to...

CUCM IM and Presence Service GNU Bash Environment Variable Handling Command Injection (CSCur05454) (Shellshock)

According to its self-reported version, the CUCM IM and Presence Service installed on the remote host contains a version of GNU Bash that is affected by a command injection vulnerability known as Shellshock, which is due to the processing of trailing strings after function definitions in the valu...

[SECURITY] Fedora 21 Update: python-rhsm-1.13.6-1.fc21

A small library for communicating with the REST interface of a Red Hat Unif ied Entitlement Platform. This interface is used for the management of system entitlements, certificates, and access to content...

Command injection

Cisco Unified Computing System on B-Series blade servers allows local users to gain shell privileges via a crafted 1 ping6 or 2 traceroute6 command, aka Bug ID CSCuq38176...

CVE-2014-7988

The Unified Messaging Service UMS in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCur06493...

CVE-2014-7989

CVE-2014-7989 affects Cisco Unified Computing System B-Series Blade Servers. It arises from improper input validation in the ping6 and traceroute6 commands, allowing an authenticated local attacker to escalate to shell-level access—potentially via local-mgmt context. Cisco released a security not...

[SECURITY] Fedora 19 Update: python-rhsm-1.13.6-1.fc19

A small library for communicating with the REST interface of a Red Hat Unif ied Entitlement Platform. This interface is used for the management of system entitlements, certificates, and access to content...

Cisco Unified Communications Manager Multiple Reflected XSS

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by multiple reflected cross-site scripting vulnerabilities due to insufficient input validation of certain parameters passed via HTTP GET or POST methods. %NASLMINLEVEL 70300 C Tenable...