Cisco TelePresence Video Communication Server Expressway Arbitrary Command Execution Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

CVE-2015-4314

The System Snapshot feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422...

CVE-2015-4329: Improper Input Validation

The administrator web interface in Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796...

PT-2015-1955

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.1 Description The issue is related to the System Snapshot feature, which lacks protection of sensitive data. This allows a remote authenticated user to obtain sensitive...

PT-2015-1957

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.2 Description The issue is related to the improper validation of the phone line used for registration in the Mobile and Remote Access MRA endpoint-validation feature. Th...

Cisco TelePresence Video Communication Server Expressway Privilege Gain Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

PT-2015-1954

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server version X8.5.2 Description The issue is related to insufficient access control for certain features in the Cisco TelePresence Video Communication Server, which can be exploited by a remote attacker...

Cisco TelePresence Video Communication Server Expressway Remote Command Injection Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

CVE-2015-4303: Undefined Security Weakness

Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333...

PT-2015-1959

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.2 Description The issue is related to errors in resource management, which can be exploited by a remote attacker to cause a denial of service. This can be achieved via...

PT-2015-1962

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.2 Description The issue concerns insufficient input validation in the CLI component of the Cisco TelePresence Video Communication Server, allowing a local user to gain...

PT-2015-1958

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server version X8.5.2 Description The issue is caused by resource management errors in the device's firmware, allowing a remote attacker to cause a denial of service by sending network packets with...

PT-2015-1960

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server VCS Expressway version X8.5.1 Description The issue is related to improper authorization in the password-change feature of the administrative web interface, allowing remote authenticated users to...

CVE-2015-4318: Undefined Security Weakness

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528...

CVE-2015-4314: Exposure of Sensitive Information to an Unauthorized Actor

The System Snapshot feature in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 allows remote authenticated users to obtain sensitive password-hash information by reading the snapshot file, aka Bug ID CSCuv40422...

CVE-2015-4315: Improper Input Validation

The Call Policy Configuration page in Cisco TelePresence Video Communication Server VCS Expressway X8.5.3 improperly validates external DTDs, which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document, aka Bug ID CSCuv31853...

CVE-2015-4319: Undefined Security Weakness

The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server VCS Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors, aka Bug ID CSCuv12338...

CVE-2015-4328: Improper Input Validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-4320: Exposure of Sensitive Information to an Unauthorized Actor

The Configuration Log File component in Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 allows remote authenticated users to obtain sensitive information by reading a log file, aka Bug ID CSCuv12340...

PT-2015-1963

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server versions X8.5.2 Description The issue exists due to insufficient input validation in the software. It allows a remote attacker to execute arbitrary OS commands using a specially crafted HTTP reques...