Cisco TelePresence Video Communication Server (VCS) Detection (SIP)

SIP based detection of Cisco TelePresence Video Communication Server VCS. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability (Cisco-SA-20150812-CVE-2015-4314)

A vulnerability in the System Snapshot of Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to view sensitive data. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Design/Logic Flaw

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to bypass intended access restrictions and read configuration files by leveraging the Mobile and Remote Access MRA role and establishing a TFTP session, aka Bug ID CSCuv78531...

CVE-2015-6261

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to bypass intended access restrictions and read configuration files by leveraging the Mobile and Remote Access MRA role and establishing a TFTP session, aka Bug ID CSCuv78531...

CVE-2015-6261

Cisco TelePresence Video Communication Server Expressway X8.5.2 contains CVE-2015-6261: remote authenticated users with the Mobile and Remote Access (MRA) role can bypass access controls and read configuration files by initiating a TFTP session. Root cause is lack of TFTP authentication/controls ...

CVE-2015-6261

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to bypass intended access restrictions and read configuration files by leveraging the Mobile and Remote Access MRA role and establishing a TFTP session, aka Bug ID CSCuv78531...

Cisco TelePresence VCS Expressway Series 8.5.1 Information Disclosure

According to its self-reported version, the instance of Cisco TelePresence Video Communication Server VCS Expressway running on the remote host is affected by an information disclosure vulnerability due to a flaw in the System Snapshot feature. An authenticated, remote attacker can download...

Cisco TelePresence VCS Expressway 8.5.3 XML External Entity (XXE) Injection

According to its self-reported version, the instance of Cisco TelePresence Video Communication Server VCS Expressway running on the remote host is affected by an XML External Entity XXE injection vulnerability due to insufficient validation of declared document type definitions DTD stored...

Cisco TelePresence VCS Expressway Series 8.5.2 Multiple Vulnerabilities

According to its self-reported version, the instance of Cisco TelePresence Video Communication Server VCS Expressway running on the remote host is affected by multiple vulnerabilities : - A command injection vulnerability exists in the web framework component due to insufficient validation of...

Cisco TelePresence Video Communication Server Expressway TFTP Information Disclosure Vulnerability

A vulnerability in TFTP in Cisco TelePresence Video Communication Server VCS Expressway could allow an authenticated, remote attacker to obtain unauthorized access to configuration files from the device by using TFTP. The vulnerability is due to lack of TFTP authentication and control for the...

Design/Logic Flaw

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528...

CVE-2015-4318

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528...

CVE-2015-4318

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528...

CVE-2015-4318

CVE-2015-4318 affects Cisco TelePresence Video Communication Server Expressway (X8.5.2). The root cause is improper handling of malformed GET requests, allowing an unauthenticated, remote attacker to cause a denial of service, potentially affecting availability. Multiple sources (NVD entry and Ci...

CVE-2015-4319

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

CVE-2015-4316

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

CVE-2015-4303

Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333...

Design/Logic Flaw

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

Input validation

The Mobile and Remote Access MRA endpoint-validation feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a crafted registration, aka B...

Command injection

Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333...