Command injection

Cisco Unified Computing System UCS Central Software 1.1 and earlier allows local users to gain privileges via a CLI copy command in a local-mgmt context, aka Bug ID CSCul53128...

CVE-2014-0731

Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier is affected by CVE-2014-0731, where the administration interface does not enforce authentication sufficiently, allowing remote attackers to bypass auth and read Java class files via a direct URL. This is the vulnerability descr...

CVE-2014-0737

Cisco CVE-2014-0737 affects the Cisco Unified IP Phone 7960G (9.2(1) and earlier). The root issue is insufficient CTL (Certificate Trust List) validation, allowing remote attackers to bypass authentication and inject a crafted CTL file to change trust relationships, enabling control over trusted ...

CVE-2014-0721

The CVE-2014-0721 entry concerns the Cisco Unified SIP Phone 3905 with firmware before 9.4(1). The vulnerability stems from an undocumented test interface exposed on TCP port 7870, which an unauthenticated, remote attacker could use to gain root-level access to the device. Impact stated in source...

CVE-2014-0731

The administration interface in Cisco Unified Communications Manager Unified CM 10.01 and earlier allows remote attackers to bypass authentication and read Java class files via a direct request, aka Bug ID CSCum46497...

Cisco Unified Communications Manager ELM信息泄漏漏洞

Bugtraq ID:65643 CVE ID:CVE-2014-0733 Cisco Unified Communications Manager是一款Cisco IP电话解决方案中的呼叫处理组件。 访问某些相关ELM的URL时Cisco Unified Communications Manager应用对其缺少正确的验证，允许远程攻击者利用漏洞获取受限文件敏感内容信息。 0 Cisco Unified Communications Manager 10.01.10000.3 厂商补丁： Cisco ----- Cisco Unified Communications Manager...

Cisco Unified Communications Manager Java类文件信息泄漏漏洞

Bugtraq ID:65644 CVE ID:CVE-2014-0731 Cisco Unified Communications Manager是一款Cisco IP电话解决方案中的呼叫处理组件。 Cisco Unified Communications Manager管理接口不正确执行正确的验证，允许远程攻击者利用漏洞访问UCM管理接口中特定的URL，未授权访问部分Java类文件。 0 Cisco Unified Communications Manager 10.01.10000.3 目前没有详细解决方案提供：...

Cisco Unified Communications Manager CAPF SQL注入漏洞

Bugtraq ID:65645 CVE ID:CVE-2014-0734 Cisco Unified Communications Manager是一款Cisco IP电话解决方案中的呼叫处理组件。 Cisco Unified Communications Manager证书授权代理功能Certificate Authority Proxy Function不正确过滤用户提交的输入，允许远程攻击者利用漏洞提交特制的SQL查询，可操作或获取数据库数据。 0 Cisco Unified Communications Manager 10.01.10000.3 厂商补丁： Cisco ---...

Cisco Unified Communications Manager跨站请求伪造漏洞

Bugtraq ID:65640 CVE ID:CVE-2014-0736 Cisco Unified Communications Manager是一款Cisco IP电话解决方案中的呼叫处理组件。 Cisco Unified Communications Manager存在跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作，如在CDR分析和报告页面上执行未授权操作。 0 Cisco Unified Communications Manager 10.01.10000.3 厂商补丁： Cisco ----- Cisco Unified...

Cisco Unified Computing System 'copy'命令本地特权提升漏洞

Bugtraq ID:65638 CVE ID:CVE-2014-0730 Cisco Unified Computing System通过将统一计算、网络、存储访问和虚拟化整合到一个系统中,简化IT管理并提高灵活性。 Cisco Unified Computing System local-mgmt上下文存在安全漏洞，允许本地通过验证的攻击者提升权限。漏洞是由于不正确校验copy命令的输入，允许攻击者提交特殊命令来获得对shell的访问。 0 Cisco Unified Computing System Central Software 厂商补丁： Cisco -----...

Cisco Unified Communications Manager IPMA跨站脚本漏洞

Bugtraq ID:65641 CVE ID:CVE-2014-0735 Cisco Unified Communications Manager是一款Cisco IP电话解决方案中的呼叫处理组件。 Cisco Unified Communications Manager处理相关IPMA的输入时缺少充分过滤，远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Cisco Unified Communications Manager 10.01.10000.3 厂商补丁： Cisco ----- Cisco Unified...

Cisco Unified Communications Manager RTMT信息泄漏漏洞

Bugtraq ID:65642 CVE ID:CVE-2014-0732 Cisco Unified Communications Manager是一款Cisco IP电话解决方案中的呼叫处理组件。 访问某些RTMT WEB应用资源时Cisco Unified Communications Manager应用对其缺少正确的验证，允许远程攻击者利用漏洞获取受限文件敏感内容信息。 0 Cisco Unified Communications Manager 10.01.10000.3 厂商补丁： Cisco ----- Cisco Unified Communications Manage...

Cisco Unified Computing System Director默认验证凭据安全绕过漏洞

Bugtraq ID:65666 CVE ID:CVE-2014-0709 Cisco Unified Computing System通过将统一计算、网络、存储访问和虚拟化整合到一个系统中,简化IT管理并提高灵活性。 Cisco Unified Computing System Director存在安全漏洞，允许远程攻击者利用漏洞完全控制设备。漏洞是由于安装过程中创建了默认的root用户账户，允许攻击者利用该账户远程访问服务器CLI，控制设备。 0 Cisco UCS Director 4.0.0.3 厂商补丁： Cisco ----- Cisco UCS Director...

Cisco Unified SIP Phone 3905未授权访问漏洞

Bugtraq ID:65663 CVE ID:CVE-2014-0721 Cisco Unified SIP Phone 3905是一款价格经济的IP电话。 Cisco Unified SIP Phone 3905存在未文档化的测试接口，允许远程攻击者连接该接口获得对设备的root访问。 0 Cisco Unified SIP Phone 3905 厂商补丁： Cisco ----- Cisco Unified SIP Phone 3905固件版本9.41已经修复该漏洞，建议用户下载更新： http://www.cisco.com/public/sw-center/...

CVE-2014-0733

The Enterprise License Manager ELM component in Cisco Unified Communications Manager Unified CM 10.01 and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494...

Authentication flaw

The Enterprise License Manager ELM component in Cisco Unified Communications Manager Unified CM 10.01 and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494...

CVE-2014-0733

The Enterprise License Manager ELM component in Cisco Unified Communications Manager Unified CM 10.01 and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494...

CVE-2014-0733

The vulnerability CVE-2014-0733 affects Cisco Unified Communications Manager’s Enterprise License Manager (ELM). The ELM component in Unified CM 10.0(1) and earlier does not properly enforce authentication, allowing remote attackers to read ELM files by directly requesting a URL. The issue is an ...

CVE-2014-0734

SQL injection vulnerability in the Certificate Authority Proxy Function CAPF implementation in Cisco Unified Communications Manager Unified CM 10.01 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483...

CVE-2014-0732

The Real Time Monitoring Tool RTMT web application in Cisco Unified Communications Manager Unified CM 10.01 and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495...