Cisco Unified Computing System Smart Call Home Input Validation Vulnerability (CSCtl00186)

A vulnerability in Cisco Unified Computing System UCS Manager could allow an authenticated, local attacker to trigger a denial of service DoS condition. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by configuring an invalid contact address fo...

Unified Automation OPC SDK OpenSSL Vulnerability

OVERVIEW On April 09, 2014, Unified Automation GmbH announced that its OPC UA Software Development Kits SDKs for Windows included vulnerable OpenSSL libraries. HTTPS support is disabled by default in Unified Automation SDK products. However if HTTPS is used, Unified Automation recommends replacin...

Cisco Unified Communications Manager WAR File Availability Vulnerability

A vulnerability in the availability of Cisco Unified Communications Manager UCM web archive WAR files could allow an unauthenticated, remote attacker to access the files. The vulnerability is due to missing authentication requirements on locations that store WAR files. An attacker could exploit...

Cisco Unified Communications Manager Enterprise Mobility Application Blind SQL Injection Vulnerability

A vulnerability in the Enterprise Mobility Application EMApp interface of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a failure to valida...

CVE-2014-0724

The bulk administration interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340...

CVE-2014-0729

SQL injection vulnerability in the Enterprise Mobility Application EMApp interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302...

CVE-2014-0723

Cross-site scripting XSS vulnerability in the IP Manager Assistant IPMA interface in Cisco Unified Communications Manager UCM allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343...

CVE-2014-0726

SQL injection vulnerability in the IP Manager Assistant IPMA interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326...

Authentication flaw

The bulk administration interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340...

Cross site scripting

Cross-site scripting XSS vulnerability in the IP Manager Assistant IPMA interface in Cisco Unified Communications Manager UCM allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343...

Sql injection

SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313...

Sql injection

SQL injection vulnerability in the Enterprise Mobility Application EMApp interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302...

CVE-2014-0725

Cisco Unified Communications Manager UCM does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337...

CVE-2014-0724

The bulk administration interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340...

CVE-2014-0722

The log4jinit web application in Cisco Unified Communications Manager UCM does not properly validate authentication, which allows remote attackers to cause a denial of service performance degradation via unspecified use of this application, aka Bug ID CSCum05347...

CVE-2014-0728

Cisco Unified Communications Manager (UCM) Java database interface is affected by a SQL injection vulnerability in versions 10.0(1) and earlier. Root cause: failure to validate user-supplied input used to construct SQL queries, allowing remote attackers to execute arbitrary SQL via crafted URLs (...

CVE-2014-0729

SQL injection vulnerability in the Enterprise Mobility Application EMApp interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302...

CVE-2014-0727

SQL injection vulnerability in the CallManager Interactive Voice Response CMIVR interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318...

CVE-2014-0726

Cisco Unified Communications Manager IP Manager Assistant (IPMA) suffers a blind SQL injection vulnerability that allows remote, unauthenticated attackers to execute arbitrary SQL via crafted URLs. Affected product/version: UCM 10.0(1) and earlier; root cause is lack of input validation within SQ...

CVE-2014-0726

SQL injection vulnerability in the IP Manager Assistant IPMA interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326...