Command injection

The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133...

CVE-2014-2180

The Cisco advisory for CVE-2014-2180 describes a vulnerability in the Document Management component of Cisco Unified Contact Center Express where insufficient parameter validation allows an authenticated, remote attacker to upload files to arbitrary filesystem locations via a crafted HTTP request...