Code injection

The CallServer component in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to cause a denial of service call-acceptance outage via malformed SIP INVITE messages, aka Bug ID CSCua65148...

Cross site request forgery (csrf)

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38379...

Xxe

Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager 1 HTTP or 2 HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka...

CVE-2013-1223

The log viewer in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly validate an unspecified parameter, which allows remote attackers to read arbitrary files via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38372...

CVE-2013-1220

The CallServer component in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to cause a denial of service call-acceptance outage via malformed SIP INVITE messages, aka Bug ID CSCua65148...

CVE-2013-1224

CVE-2013-1224 affects Cisco Unified CVP (Resource Manager) prior to 9.0.1 ES 11. A directory traversal flaw allows remote attackers to overwrite arbitrary files by sending crafted HTTP or HTTPS requests that bypass parameter validation (Bug CSCub38369). The issue is tied to the Resource Manager c...

CVE-2013-1223

The CVE-2013-1223 issue affects Cisco Unified CVP Software prior to 9.0.1 ES 11, where the log viewer does not properly validate an unspecified parameter, enabling remote attackers to read arbitrary files via a crafted HTTP or HTTPS request. The vulnerability arises from improper input validation...

CVE-2013-1221

CVE-2013-1221 affects Cisco Unified CVP (Tomcat Web Management) prior to 9.0.1 ES 11. The vulnerability arises from improper Tomcat component configuration, enabling remote code execution via crafted HTTP or HTTPS requests. Impact is consistent with a full compromise of affected CVP deployments. ...

Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software

Cisco Unified Customer Voice Portal Software Unified CVP contains multiple vulnerabilities. Various components of Cisco Unified CVP are affected; see the "Details" section for more information on the vulnerabilities. These vulnerabilities can be exploited independently; however, more than one...

Cisco Unified Computing System multiple security vulnerabilities

Buffer overflow, information leakage, authentication bypass, DoS...

CVE-2013-1240

The command-line interface in Cisco Unified Communications Manager CUCM does not properly validate input, which allows local users to read arbitrary files via unspecified vectors, aka Bug ID CSCue25770...

Design/Logic Flaw

The command-line interface in Cisco Unified Communications Manager CUCM does not properly validate input, which allows local users to read arbitrary files via unspecified vectors, aka Bug ID CSCue25770...

CVE-2013-1240

The Cisco Unified Communications Manager (CUCM) CLI vulnerability arises from incomplete input validation in the command-line interface. It enables a local, authenticated attacker to read arbitrary files on the device by issuing a crafted command. The exploit requires local access; no public expl...

CVE-2013-1240

The command-line interface in Cisco Unified Communications Manager CUCM does not properly validate input, which allows local users to read arbitrary files via unspecified vectors, aka Bug ID CSCue25770...

Design/Logic Flaw

Cisco Unified Communications Domain Manager allows remote attackers to cause a denial of service CPU consumption via a flood of malformed UDP packets, aka Bug ID CSCug47057...

CVE-2013-1230

Cisco Unified Communications Domain Manager is affected by a denial-of-service vulnerability caused by a flood of malformed UDP packets (Bug ID CSCug47057). The available records state that remote attackers can trigger CPU consumption leading to DoS. No vendor patch/version details or remediation...

CVE-2013-1230

Cisco Unified Communications Domain Manager allows remote attackers to cause a denial of service CPU consumption via a flood of malformed UDP packets, aka Bug ID CSCug47057...

CVE-2013-1196

The command-line interface in Cisco Secure Access Control System ACS, Identity Services Engine Software, Context Directory Agent, Application Networking Manager ANM, Prime Network Control System, Prime LAN Management Solution LMS, Prime Collaboration, Unified Provisioning Manager, Network Service...

Cisco Unified Computing System Central Software DOM-Based Cross-Site Scripting Vulnerability

Cisco Unified Computing System Central Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability exists because the affected software fails to perform sufficient validation and sanitation of user-supplied inpu...

CVE-2013-1227

Cross-site scripting XSS vulnerability in the web framework in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCug37902...