PT-2021-7024

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings affected versions not specified Description A vulnerability in the authentication component of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a use...

CVE-2021-34743

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...

Cross site request forgery (csrf)

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...

CVE-2021-34743 Cisco Webex Software Application Authorization Bypass Vulnerability

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...

CVE-2021-34743 Cisco Webex Software Application Authorization Bypass Vulnerability

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...

CVE-2021-34743

Cisco Webex Software is affected by a CSRF (cross-site request forgery) vulnerability that can allow an unauthenticated, remote attacker to authorize an external application to access a user’s account without consent. The issue arises from improper validation of CSRF tokens, and an attacker must ...

CVE-2021-34743: Cross-Site Request Forgery (CSRF)

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...

Cisco Webex Software Application Authorization Bypass Vulnerability

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...

CVE-2021-34743

A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation o...

Cisco Webex 跨站请求伪造漏洞

Cisco Webex is a suite of video conferencing and collaboration products from Cisco. Cisco Webex suffers from a cross-site request forgery vulnerability that could allow an unauthenticated, remote attacker to authorize external application integration and access user accounts without the user's...

PT-2021-6124

Name of the Vulnerable Software and Affected Versions Cisco Webex Software affected versions not specified Description A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m keynoting CIISec Live—an all-online event—September 15-16, 2021. I’m speaking at the Infosecurity Magazine EMEA Autumn Online Summit on September 21, 2021. I’m speaking at the Cybersecurity and Data Privacy Law Conference in...

Cisco WebEx Network Recording Player ARF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco WebEx Network Recording Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Cisco WebEx Network Recording Player ARF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco WebEx Network Recording Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Cisco WebEx Network Recording Player ARF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco WebEx Network Recording Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Cisco Webex Player Memory Corruption (cisco-sa-webex-player-kOf8zVT)

The version of Cisco Webex Player installed on the remote host is affected by a memory corruption vulnerability due to insufficient validation of values in Webex recording files that are in Webex Recording Format WRF. An attacker could exploit this by sending a user a malicious WRF file through a...

Cisco Webex Network Recording Player and Cisco Webex Player DLL Injection (cisco-sa-webex-dll-inject-XNmcSGTU)

According to its self-reported version, Cisco Webex Network Recording Player is affected by an dll injection vulnerability due to incorrect handling of directory paths at run time. An authenticated, local attacker can exploit this, by inserting a configuration file in a specific path in the syste...

Cisco Webex Meetings DLL Injection (cisco-sa-webex-dll-inject-XNmcSGTU)

According to its self-reported version, Cisco Webex Meetings is affected by an dll injection vulnerability due to incorrect handling of directory paths at run time. An authenticated, local attacker can exploit this, by inserting a configuration file in a specific path in the system, to execute...

Cisco Webex Teams for Windows DLL Injection (cisco-sa-webex-dll-inject-XNmcSGTU)

According to its self-reported version, Cisco Webex Teams for Windows is affected by an dll injection vulnerability due to incorrect handling of directory paths at run time. An authenticated, local attacker can exploit this, by inserting a configuration file in a specific path in the system, to...

The vulnerability of the Cisco Webex Player for Windows and MacOS operating systems stems from insufficient validation of values in Webex recording files, allowing attackers to trigger service interruptions.

The vulnerability of the Cisco Webex Player for Windows and MacOS operating systems is related to insufficient checking of values in Webex recording files. Exploiting this vulnerability can allow attackers to trigger a service failure by sending specially crafted WRF Webex Recording Format files...