CVE-2014-0726

Cisco Unified Communications Manager IP Manager Assistant (IPMA) suffers a blind SQL injection vulnerability that allows remote, unauthenticated attackers to execute arbitrary SQL via crafted URLs. Affected product/version: UCM 10.0(1) and earlier; root cause is lack of input validation within SQ...

CVE-2014-0728

Cisco Unified Communications Manager (UCM) Java database interface is affected by a SQL injection vulnerability in versions 10.0(1) and earlier. Root cause: failure to validate user-supplied input used to construct SQL queries, allowing remote attackers to execute arbitrary SQL via crafted URLs (...

CVE-2014-0727

SQL injection vulnerability in the CallManager Interactive Voice Response CMIVR interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318...

CVE-2014-0724

The bulk administration interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340...

CVE-2014-0722

The log4jinit web application in Cisco Unified Communications Manager UCM does not properly validate authentication, which allows remote attackers to cause a denial of service performance degradation via unspecified use of this application, aka Bug ID CSCum05347...

CVE-2014-0728

SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313...

CVE-2014-0723

Cisco IP Manager Assistant (IPMA) within Cisco Unified Communications Manager (UCM) suffers a cross-site scripting (XSS) vulnerability. The issue stems from insufficient input validation in the IPMA web interface, allowing an unauthenticated, remote attacker to craft a URL that injects arbitrary ...

CVE-2014-0727

Cisco Unified Communications Manager (UCM) CMIVR interface is affected by a SQL injection vulnerability (CVE-2014-0727) that can be exploited remotely by unauthenticated attackers via crafted URLs to execute arbitrary SQL commands. The root cause is insufficient input validation in SQL queries wi...

CVE-2014-0723

Cross-site scripting XSS vulnerability in the IP Manager Assistant IPMA interface in Cisco Unified Communications Manager UCM allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343...

Cisco TelePresence Video Communication Server Expressway Default SSL Certificate

The X.509 certificate of the remote host is known to ship by default with the remote service / device. The private key for this cert has been published, therefore the SSL communications done with the remote host cannot be considered secret as anyone with the ability to snoop the traffic between t...

CVE-2014-0681

Cross-site scripting XSS vulnerability in Cisco Identity Services Engine ISE 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064...

CVE-2014-0680

Cross-site scripting XSS vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038...

CVE-2014-0682

Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and 1 join arbitrary meetings, or 2 terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346...

Authorization

Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and 1 join arbitrary meetings, or 2 terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346...

Cross site scripting

Cross-site scripting XSS vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Identity Services Engine ISE 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064...

CVE-2014-0681

Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier is affected by a cross-site scripting (XSS) vulnerability in the report output pages. The root cause is insufficient input validation when generating reports, allowing an unauthenticated, remote attacker to inject arbitrary web script o...

CVE-2014-0681

Cross-site scripting XSS vulnerability in Cisco Identity Services Engine ISE 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064...

CVE-2014-0680

Cisco Identity Services Engine (ISE) NAC Web Agent’s HTTP control interface is affected by a Cross-Site Scripting (XSS) vulnerability. The issue arises from insufficient input validation, allowing remote attackers to inject arbitrary scripts via a crafted URL. Exploitation could cause a user to e...

Design/Logic Flaw

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...