CVE-2015-6416

Cross-site scripting XSS vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.01 allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479...

CVE-2015-6410

The Mobile and Remote Access MRA services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypass intended call-reception and call-setup restrictions by spoofing a user, aka Bug ID CSCuu97283...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943...

CVE-2015-6378

Cross-site request forgery CSRF vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943...

Code injection

The self-service application in Cisco Unified Communications Domain Manager CUCDM 10.61 allows remote authenticated users to cause a denial of service subapplication outage via malformed requests, aka Bug ID CSCuu10981...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.01 allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479...

Authentication flaw

Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allow remote attackers to bypass an intended authentication requirement and execute unspecified administrative functions via a crafted HTTP request, aka Bug ID CSCux24941...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCux24935...

CVE-2015-6401

Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11 and 5.7.1 are affected by CVE-2015-6401, where an unauthenticated remote attacker can bypass the intended web authentication and execute unspecified administrative functions via a crafted HTTP request (Bug CSCux24941). Public references include Cisco...

CVE-2015-6422

The self-service application in Cisco Unified Communications Domain Manager CUCDM 10.61 allows remote authenticated users to cause a denial of service subapplication outage via malformed requests, aka Bug ID CSCuu10981...

CVE-2015-6378

The CVE-2015-6378 entry corresponds to a CSRF vulnerability in Cisco DPQ3925 devices with EDVA 5.5.2. The root cause is insufficient CSRF protections in the device web interface, enabling a remote attacker to hijack the authentication of arbitrary users by enticing them to visit a malicious link,...

CVE-2015-6422

The CVE-2015-6422 entry concerns Cisco Unified Communications Domain Manager (CUCDM) self-service application in version 10.6(1). The vulnerability arises from improper handling of malformed requests by the self-service component, allowing an authenticated remote user to cause a denial of service...

CVE-2015-6416

CVE-2015-6416 is a cross-site scripting (XSS) vulnerability in Cisco’s Unified Email Interaction Manager and Unified Web Interaction Manager version 11.0(1). The issue arises from insufficient sanitization of user-supplied input in the web interface, allowing an unauthenticated, remote attacker t...

CVE-2015-6407

Cisco Emergency Responder 10.53.10000.9 allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501...

CVE-2015-6405

Cross-site request forgery CSRF vulnerability in Cisco Emergency Responder 10.51 and 10.51a allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv26501...

CVE-2015-6389

Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session and leveraging knowledge of this account's password, aka Bug ID CSCus62707...

Code injection

Cisco TelePresence Video Communication Server VCS X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516...

Design/Logic Flaw

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

Design/Logic Flaw

Cisco TelePresence Video Communication Server VCS Expressway X8.6 allows remote authenticated users to bypass intended read-only restrictions and upload Tandberg Linux Package TLP files by visiting an administrative page, aka Bug ID CSCuw55651...

Directory traversal

Directory traversal vulnerability in the Tools menu in Cisco Emergency Responder 10.51.10000.5 allows remote authenticated users to write to arbitrary files via a crafted filename, aka Bug ID CSCuv21781...