CVE-2014-3300

CVE-2014-3300 affects Cisco Unified Communications Domain Manager (CDM) BVSMWeb portal in Unified CDM Application Software prior to 10, where insufficient access control allows remote attackers to modify BVSMWeb user information via a crafted URL. Related materials show Metasploit/Viproy modules ...

CVE-2014-2197

The Administration GUI in the web framework in Cisco Unified Communications Domain Manager CDM in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a crafted URL, aka Bug ID...

Cisco Patches Hardcoded SSH Key Vulnerability in UCM

The Cisco Unified Communications Domain Manager contains a default private SSH key that could allow an attacker to run arbitrary code on vulnerable installations. The bug is about as serious as they come, giving remote, unauthenticated attackers access to affected machines with the rights of a ro...

Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

Cisco Unified Communications Domain Manager Cisco Unified CDM is affected by the following vulnerabilities: Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability Cisco Unified Communications Domain Manager Default SSH Key Vulnerability Cisco Unified Communications Domain...

Cisco Releases Security Advisory for Unified Communications Domain Manager

Cisco has released a security advisory to address multiple vulnerabilities in Cisco Unified Communications Domain Manager, some of which may allow an attacker to execute arbitrary commands or obtain privileged access to the affected system. The following updates are available: Cisco Unified CDM...

GeoCore MAX DB Ver. 7.3.3 - Time-Based Blind Injection

No description provided by source. Exploit Title: GeoCore MAX DB Ver. 7.3.3 - Time-Based Blind Injection Official site: http://geodesicsolutions.com Risk Level: High Vendor : http://geodesicsolutions.com Exploit Author: Esac Homepage author : www.iss4m.ma Last Checked: 25/04/2014 +----------+ |...

Cisco Unified Communications Manager <= 6.1 'key' Parameter SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27775/info Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

Sun ONE Unified Development Server 5.0 Recursive Document Type Definition Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6626/info It has been reported that problems with the handling of recursive document type definitions DTDs occur in Sun ONE Unified Development Server UDS. When a document is uploaded containing these types of constructs,...

Cisco CallManager <= 4.2 / CUCM 4.2 Logon Page lang Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/25480/info Cisco Unified CallManager and Unified Communications Manager are prone to multiple input-validation vulnerabilities because the applications fail to properly sanitize user-supplied input. These issues include a...

Cisco Unified Communications Manager - TFTP Service

No description provided by source. !/bin/bash Proof of Concept on how to get tftp config files from cisco phones This can be performed anonymously and privileges gathered relies on those assigned to the ldap account Developed by Daniel Svartman [email protected] In case tftp files are...

AlienVault OSSIM 4.6.1 - Authenticated SQL Injection

No description provided by source. Exploit Title: AlienVault newpolicyform.php SQLi Date: 5/9/2014 Exploit Author: chrisdhebertatgmail.com Vendor Homepage: http://www.alienvault.com/ Software Link: http://www.alienvault.com/free-downloads-services Version: 4.6.1 and below Tested on: Linux CVE : n...

CVE-2013-6737

IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly restrict the content of a dump file upon encountering a 1691 hardware fault, which allows remote authenticated users to obtain sensitive customer-data fragments by reading this file after it is copied...

CVE-2013-6737

IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly restrict the content of a dump file upon encountering a 1691 hardware fault, which allows remote authenticated users to obtain sensitive customer-data fragments by reading this file after it is copied...

CVE-2013-6737

CVE-2013-6737 affects IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x prior to 1.4.3.0, where a rare hardware fault (1691) can cause fragments of customer data to be dumped into a file. An authorized user may copy this file and read the data fragments, potentially compromising confident...

Cisco Unified Communications Manager Java Interface SQL Injection (CSCuo17337)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by a SQL injection vulnerability in 'BulkViewFileContentsAction.java'. An authenticated, remote attacker can exploit this, by using a crafted 'filename' parameter, to execute arbitrary...

Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability

A vulnerability in BulkViewFileContentsAction.java of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to improper filename parameters. An attacker could exploit this vulnerability by...

Cisco Unified Communications Manager Real-Time Monitoring Tool Multiple Vulnerabilities

A vulnerability in the Real-Time Monitoring Tool RTMT of Cisco Unified Communications Manager could allow an authenticated, remote attacker to download or delete files from arbitrary locations on the filesystem. The vulnerability is due to insufficient input validation. An attacker could exploit...

CVE-2014-3287

SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Manager Unified CM allows remote authenticated users to execute arbitrary SQL commands via crafted filename parameters in a URL, aka Bug ID CSCuo17337...

CVE-2014-3292

The Real Time Monitoring Tool RTMT implementation in Cisco Unified Communications Manager Unified CM allows remote authenticated users to 1 read or 2 delete arbitrary files via a crafted URL, aka Bug IDs CSCuo17302 and CSCuo17199...

Sql injection

SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Manager Unified CM allows remote authenticated users to execute arbitrary SQL commands via crafted filename parameters in a URL, aka Bug ID CSCuo17337...