Cisco Unified Operations Manager 8.5 - 'iptm/ddv.do?deviceInstanceName' Cross-Site Scripting

source: https://www.securityfocus.com/bid/47901/info Cisco Unified Operations Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...

Cisco Unified Operations Manager 8.5 - iptm/eventmon Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/47901/info Cisco Unified Operations Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...

CVE-2011-1602

The su utility on Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.0.3 allows local users to gain privileges via unspecified vectors, aka Bug ID CSCtf07426...

Code injection

Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.2.1 do not properly verify signatures for software images, which allows local users to gain privileges via a crafted image, aka Bug ID CSCtn65962...

CVE-2011-1637

Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.2.1 do not properly verify signatures for software images, which allows local users to gain privileges via a crafted image, aka Bug ID CSCtn65962...

Code injection

The su utility on Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.0.3 allows local users to gain privileges via unspecified vectors, aka Bug ID CSCtf07426...

CVE-2011-1603

CVE-2011-1603 affects Cisco Unified IP Phones 7900 Series running software before 9.2.1. The two privilege-escalation flaws (CVE-2011-1602, CVE-2011-1603) could let an authenticated local user change configurations or access information; a separate signature-verification bypass (CVE-2011-1637) co...

CVE-2011-1637

CVE-2011-1637 affects Cisco Unified IP Phones 7900 Series (TNP phones). The issue is an insecure signature verification check that allows an authenticated, local attacker to load a software image without verification, due to improper verification of signatures. Root cause: unsigned code installat...

CVE-2011-1602

Cisco Unified IP Phones 7900 Series (TNP phones) are affected by CVE-2011-1602 due to two privilege-escalation vulnerabilities in the su utility. Devices with software before 9.0.3 could allow an authenticated local attacker to change phone configuration or disclose information; the CVSS base sco...

CVE-2011-1603

Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.2.1 allow local users to gain privileges via unspecified vectors, aka Bug ID CSCtn65815...

CVE-2011-1602

The su utility on Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.0.3 allows local users to gain privileges via unspecified vectors, aka Bug ID CSCtf07426...

CVE-2011-1637

Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.2.1 do not properly verify signatures for software images, which allows local users to gain privileges via a crafted image, aka Bug ID CSCtn65962...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified IP Phones 7900 Series

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified IP Phones 7900 Series Advisory ID: cisco-sa-20110601-phone Revision 1.0 For Public Release 2011 June 1 1600 UTC GMT +----------------------------------------------------------------...

Cisco Unified Operations Manager multiple security vulnerabilities

Crossite scripting, SQL injection...

Cisco Unified Operations Manager Multiple Vulnerabilities - SOS-11-006

Sense of Security - Security Advisory - SOS-11-006 Release Date. 18-May-2011 Last Update. - Vendor Notification Date. 28-Feb-2011 Product. Cisco Unified Operations Manager Common Services Framework Help Servlet Common Services Device Center CiscoWorks Homepage Note: All of the above products are...

CVE-2011-0962

Cross-site scripting XSS vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager CUOM before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug ID CSCto12712...

CVE-2011-0959

Multiple cross-site scripting XSS vulnerabilities in Cisco Unified Operations Manager CUOM before 8.6 allow remote attackers to inject arbitrary web script or HTML via 1 the extn parameter to iptm/advancedfind.do, 2 the deviceInstanceName parameter to iptm/ddv.do, the 3 cmd or 4 group parameter t...

Sql injection

Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager CUOM before 8.6 allow remote attackers to execute arbitrary SQL commands via 1 the CCMs parameter to iptm/PRTestCreation.do or 2 the ccm parameter to iptm/TelePresenceReportAction.do, aka Bug ID CSCtn61716...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Unified Operations Manager CUOM before 8.6 allow remote attackers to inject arbitrary web script or HTML via 1 the extn parameter to iptm/advancedfind.do, 2 the deviceInstanceName parameter to iptm/ddv.do, the 3 cmd or 4 group parameter t...

Cross site scripting

Cross-site scripting XSS vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager CUOM before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug ID CSCto12712...