CVE-2013-4869

Cisco Unified Communications Manager CUCM 7.1x through 9.12 and the IM & Presence Service in Cisco Unified Presence Server through 9.12 use the same CTI and database-encryption key across different customers' installations, which makes it easier for context-dependent attackers to defeat...

Hardcoded credentials

Cisco Unified Communications Manager CUCM 7.1x through 9.12 and the IM & Presence Service in Cisco Unified Presence Server through 9.12 use the same CTI and database-encryption key across different customers' installations, which makes it easier for context-dependent attackers to defeat...

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allow local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCuh73454...

Sql injection

SQL injection vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.12 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuh81766...

Design/Logic Flaw

Untrusted search path vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02276...

CVE-2013-4869

Cisco Unified Communications Manager (CUCM) versions 7.1.x–9.1(2) and the IM & Presence Service in Cisco Unified Presence Server up to 9.1(2) share the same CTI and database-encryption key across different customer installations. This creates a cryptographic risk where context-dependent attackers...

CVE-2013-3402

CVE-2013-3402 affects Cisco Unified Communications Manager (CUCM) 7.1.x through 9.1(2). The root cause is improper validation in an unspecified function that allows a remote, authenticated attacker to execute arbitrary commands via unknown vectors, effectively a command-injection bug (Bug ID CSCu...

CVE-2013-3434

Untrusted search path vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02242...

Cisco Releases Multiple Security Advisories

Cisco has released two security advisories to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code on a vulnerable system or cause a denial-of-service condition. US-CERT encourages users and administrators to review the following Cisco...

CVE-2013-3404

SQL injection vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows remote attackers to execute arbitrary SQL commands via unspecified vectors, leading to discovery of encrypted credentials by leveraging metadata, aka Bug ID CSCuh01051...

CVE-2013-3412

Cisco Unified Communications Manager (CUCM) is affected by a blind SQL injection vulnerability (CVE-2013-3412) in versions 7.1(x) through 9.1(2). The issue allows an authenticated, remote attacker to execute arbitrary SQL commands via unspecified vectors, potentially impacting confidentiality, in...

CVE-2013-3404

Cisco CUCM (7.1.x–9.1(1a)) is affected by a remote SQL injection vulnerability that allows an unauthenticated attacker to run arbitrary SQL via unspecified vectors and, via metadata, potentially reconstruct encrypted credentials. Exploitation can enable credential discovery and, in combination wi...

CVE-2013-3434

CVE-2013-3434 affects Cisco Unified Communications Manager (CUCM) versions 7.1.x through 9.1(1a). The root cause is an untrusted search path due to unspecified file-permission and environment-variable issues on privileged programs (Bug CSCui02242). This enables local privilege escalation for auth...

CVE-2013-3403

Multiple untrusted search path vulnerabilities in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allow local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCuh73454...

CVE-2013-3402

An unspecified function in Cisco Unified Communications Manager CUCM 7.1x through 9.12 allows remote authenticated users to execute arbitrary commands via unknown vectors, aka Bug ID CSCuh73440...

CVE-2013-3403

CVE-2013-3403 corresponds to multiple untrusted search path vulnerabilities in Cisco Unified Communications Manager (CUCM) versions 7.1.x–9.1(1a) that allow a local user to gain privileges by exploiting unspecified file-permission and environment-variable issues in privileged programs (Bug ID CSC...

CVE-2013-3433

Untrusted search path vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02276...

CVE-2013-3433

CVE-2013-3433 concerns Cisco Unified Communications Manager (CUCM) 7.1.x–9.1(1a). The root cause is improper file permissions on a privileged system binary, leading to an untrusted search path that enables a local, authenticated attacker to escalate privileges. Public PoC code exists. Impact is l...

Cisco Unified Communications Manager Command Injection Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM could allow an authenticated, remote attacker to execute commands on the underlying operating system with the privileges of the database user. The vulnerability is due to improper validation of user-supplied input. An attacker cou...

Cisco Unified Communications Manager Privilege Escalation Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM could allow an authenticated, local attacker to elevate privileges on the system. The vulnerability is due to improper file permissions, environment variables, and relative paths in a privileged system script. An attacker could...