Cisco CallManager 3.x/4.x Web Interface ccmadmin/phonelist.asp pattern Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/18504/info Cisco CallManager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the web-interface to properly sanitize user-supplied input. An attacker may leverage this issue to have...

Cisco CallManager 1.0/2.0/3.x/4.0 CTI Manager Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14251/info The CallManager CTI Manager service is susceptible to a remote denial of service vulnerability. This issue is documented in Cisco bug CSCee00116, which is available to Cisco customers. This issue may be exploit...

Cisco CallManager 3.x/4.x Web Interface ccmuser/logon.asp XSS

No description provided by source. source: http://www.securityfocus.com/bid/18504/info Cisco CallManager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the web-interface to properly sanitize user-supplied input. An attacker may leverage this issue to have...

Cisco CallManager <= 4.2 / CUCM 4.2 Logon Page lang Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/25480/info Cisco Unified CallManager and Unified Communications Manager are prone to multiple input-validation vulnerabilities because the applications fail to properly sanitize user-supplied input. These issues include a...

Sql injection

SQL injection vulnerability in the CallManager Interactive Voice Response CMIVR interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318...

Cisco CallManager vulnerable to brute force attack

Roberto Suggi Liverani, founder of the OWASP Open Web Application Security Project New Zealand chapter discover a vulnerability in Cisco CallManager AKA Unified Communications Manager. It is a software-based call-processing system developed by Cisco Systems. He described on his blog "During a...

Code injection

The SIP process in Cisco Unified Communications Manager aka CUCM, formerly CallManager 7.x before 7.15bsu4 and 8.x before 8.01 does not properly handle SDP data within a SIP call in certain situations related to use of the g729ar8 codec for a Media Termination Point MTP, which allows remote...

CVE-2011-1643

CVE-2011-1643 affects Cisco Unified Communications Manager (CUCM) and Cisco Unified Presence Server. Affected CUCM versions: 6.x, 7.x before 7.1(5b)su4, 8.0, and 8.5 before 8.5(1)su2; Presence Server: 6.x, 7.x, 8.0, and 8.5 before 8.5xnr. Root cause: an open query interface could disclose databas...

CVE-2011-2561

Cisco Unified Communications Manager (CUCM) 7.x prior to 7.1(5b)su4 and 8.x prior to 8.0(1) is vulnerable in its SIP processing when handling SDP data during SIP calls using the g729ar8 codec for a Media Termination Point (MTP). The flaw, tracked as Bug CSCtc61990, can allow remote attackers to c...

CVE-2011-2562

CVE-2011-2562 affects Cisco Unified Communications Manager (CUCM) versions: 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5 before 8.5(1)su1. The vulnerability allows remote attackers to cause a denial of service (service outage) by sending a SIP INVITE message. Root c...

CVE-2011-1604

Memory leak in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15su3, 7.x before 7.15bsu3, 8.0 before 8.03asu2, and 8.5 before 8.51 allows remote attackers to cause a denial of service memory consumption and process failure via a malformed SIP message, aka Bug ID...

Memory corruption

Memory leak in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15su3, 7.x before 7.15bsu3, 8.0 before 8.03asu2, and 8.5 before 8.51 allows remote attackers to cause a denial of service memory consumption and process failure via a malformed SIP message, aka Bug ID...

CVE-2011-1605

CVE-2011-1605 affects Cisco Unified Communications Manager (CUCM) 6.x, 7.x, and 8.x. The vulnerability arises from processing malformed SIP messages in the SIP services, leading to a denial of service (process failure). Cisco’s advisory lists fixes in CUCM versions 6.1(5)SU2/3, 7.1(5b)SU2, 8.0(3)...

CVE-2011-1609

Cisco Unified Communications Manager (CUCM) is affected by SQL injection vulnerabilities (CVE-2011-1609) in 6.x prior to 6.1(5)su2, 7.x prior to 7.1(5)su1, 8.0 prior to 8.0(3), and 8.5 prior to 8.5(1). The flaw allows a remote authenticated user to execute arbitrary SQL commands via unspecified v...

ZDI-11-143: Cisco Unified CallManager xmldirectorylist.jsp SQL Injection Vulnerability

ZDI-11-143formerly ZDI-CAN-965: Cisco Unified CallManager xmldirectorylist.jsp SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-143 April 28, 2011 -- CVE ID: CVE-2011-1610 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Cisco -- Affected Products: Cisco...

Cisco Unified CallManager xmldirectorylist.jsp SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Cisco Unified CM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Call Manager component. The system exposes an Apache...

CVE-2009-5040

CallManager Express CME on Cisco IOS before 15.01XA allows remote authenticated users to cause a denial of service device crash by using an extension mobility EM phone to interact with the menu for SNR number changes, aka Bug ID CSCta63555...

Design/Logic Flaw

CallManager Express CME on Cisco IOS before 15.01XA1 does not properly handle SIP TRUNK traffic that contains rate bursts and a "peculiar" request size, which allows remote attackers to cause a denial of service memory consumption by sending this traffic over a long duration, aka Bug ID CSCtb4795...

CVE-2009-5040

CallManager Express CME on Cisco IOS before 15.01XA allows remote authenticated users to cause a denial of service device crash by using an extension mobility EM phone to interact with the menu for SNR number changes, aka Bug ID CSCta63555...

Design/Logic Flaw

CallManager Express CME on Cisco IOS before 15.01XA allows remote authenticated users to cause a denial of service device crash by using an extension mobility EM phone to interact with the menu for SNR number changes, aka Bug ID CSCta63555...