CVE-2015-4316

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

Design/Logic Flaw

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

Input validation

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

CVE-2015-4316

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

CVE-2015-4319

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

CVE-2015-4319

CVE-2015-4319 affects Cisco TelePresence Video Communication Server (VCS) Expressway; the Password Change function in the Administrative Web Interface fails to properly enforce authorization, enabling an authenticated, remote attacker to reset arbitrary active-user passwords via crafted packets. ...

CVE-2015-4317

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469...

CVE-2015-4315

The Call Policy Configuration page in Cisco TelePresence Video Communication Server VCS Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853...

Authentication flaw

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in an authentication packet, aka Bug ID CSCuv40469...

CVE-2015-4327: Improper Input Validation

The CLI in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542...

CVE-2015-4315

The Call Policy Configuration page in Cisco TelePresence Video Communication Server VCS Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853...

CVE-2015-4320

The Configuration Log File component in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340...

CVE-2015-4328

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

PT-2015-1959

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.2 Description The issue is related to errors in resource management, which can be exploited by a remote attacker to cause a denial of service. This can be achieved via...

PT-2015-1957

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.2 Description The issue is related to the improper validation of the phone line used for registration in the Mobile and Remote Access MRA endpoint-validation feature. Th...

PT-2015-1955

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.1 Description The issue is related to the System Snapshot feature, which lacks protection of sensitive data. This allows a remote authenticated user to obtain sensitive...

CVE-2015-4318: Undefined Security Weakness

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528...

CVE-2015-4319: Undefined Security Weakness

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

CVE-2015-4316: Improper Input Validation

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

CVE-2015-4314: Exposure of Sensitive Information to an Unauthorized Actor

The System Snapshot feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422...