CVE-2022-46404

A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager 8 before R2.22.18, 10 before 0.28.13, and 10 R1 before R1.34.4 that may allow an unauthenticated attacker to upload arbitrary files and achieve administrative access to th...

CVE-2022-36444: Undefined Security Weakness

An issue was discovered in Atos Unify OpenScape SBC 9 and 10 before 10R2.2.1, Atos Unify OpenScape Branch 9 and 10 before version 10R2.1.1, and Atos Unify OpenScape BCF 10 before 10R9.12.1. A remote code execution vulnerability may allow an unauthenticated attacker with network access to the admi...

Atos Unify OpenScape 安全漏洞

Atos Unify OpenScape SBC and others are products of Atos France.Atos Unify OpenScape SBC is a datacenter-ready virtualized security application.Atos Unify OpenScape Branch is a virtual appliance or standard server application.Atos Unify OpenScape BCF is a unified communications and collaboration...

CVE-2019-19866

Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with...

Design/Logic Flaw

Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with...

CVE-2019-19866

Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with...

PT-2020-10272

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 Atos Unify OpenScape UC Web Client V10 before version V10 R0.6.0 Description The issue allows remote attackers to obtain sensitive information by iterating the value of conference...

CVE-2019-19866: Authorization Bypass Through User-Controlled Key

Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with...

PT-2020-10271

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 Atos Unify OpenScape UC Application V10 before version V10 R0.6.0 Description The issue allows for cross-site scripting XSS, where an attacker could inject arbitrary JavaScript...

CVE-2019-19865: Improper Neutralization of Input During Web Page Generation

Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored XSS payload...

Command injection

Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface...

CVE-2014-9563: Improper Neutralization of CRLF Sequences

CRLF injection vulnerability in the web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via th...

CVE-2014-8422: Insufficient Entropy

The web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack...