Cisco Unity Express - Multiple Vulnerabilities

Exploit Title: Cisco Unity Express Multiple Vulnerabilities Reported: December 2012 Disclosed: February 2013 Author: Jacob Holcomb of Independent Security Evaluators CVE: XSS - CVE-2013-1114 and CSRF - CVE-2013-1120 http://infosec42.blogspot.com/2013/02/cisco-unity-express-vulnerabilites.html Cis...

Cisco Unity Express Cross Site Request Forgery / Cross Site Scripting

Exploit Title: Cisco Unity Express Multiple Vulnerabilities Reported: December 2012 Disclosed: February 2013 Author: Jacob Holcomb of Independent Security Evaluators CVE: XSS - CVE-2013-1114 and CSRF - CVE-2013-1120 http://infosec42.blogspot.com/2013/02/cisco-unity-express-vulnerabilites.html Cis...

Cisco Unity Express Cross-Site Scripting Vulnerabilities

Cisco Unity Express contains multiple vulnerabilities that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerabilities are due to insufficient sanitization of user-supplied input processed by the Cisco Unity Express software. An unauthenticated,...

CVE-2012-3060

Cisco Unity Connection UC 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service CPU consumption via malformed UDP packets, aka Bug ID CSCtz76269...

CVE-2012-3096

Cisco Unity Connection UC 7.1, 8.0, and 8.5 allows remote authenticated users to cause a denial of service resource consumption and administration outage via extended use of the product, aka Bug ID CSCtd79132...

Code injection

Cisco Unity Connection UC 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service CPU consumption via malformed UDP packets, aka Bug ID CSCtz76269...

Code injection

Cisco Unity Connection UC 7.1, 8.0, and 8.5 allows remote authenticated users to cause a denial of service resource consumption and administration outage via extended use of the product, aka Bug ID CSCtd79132...

Cisco Unity Connection security vulnerabilities

Privilege escalation, crafted TCP packets DoS...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unity Connection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unity Connection Advisory ID: cisco-sa-20120229-cuc Revision 1.0 For Public Release 2012 February 29 16:00 UTC GMT +---------------------------------------------------------------------...

CVE-2012-0366

Cisco Unity Connection before 7.1.3bSu2 allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141...

CVE-2012-0367

Cisco Unity Connection before 7.1.5bSu5, 8.0 and 8.5 before 8.5.1Su3, and 8.6 before 8.6.2 allows remote attackers to cause a denial of service services crash via a series of crafted TCP segments, aka Bug ID CSCtq67899...

Code injection

Cisco Unity Connection before 7.1.5bSu5, 8.0 and 8.5 before 8.5.1Su3, and 8.6 before 8.6.2 allows remote attackers to cause a denial of service services crash via a series of crafted TCP segments, aka Bug ID CSCtq67899...

Design/Logic Flaw

Cisco Unity Connection before 7.1.3bSu2 allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141...

CVE-2012-0367

Cisco Unity Connection before 7.1.5bSu5, 8.0 and 8.5 before 8.5.1Su3, and 8.6 before 8.6.2 allows remote attackers to cause a denial of service services crash via a series of crafted TCP segments, aka Bug ID CSCtq67899...

CVE-2012-0367

Cisco Unity Connection is affected by CVE-2012-0367, a remote denial of service caused by the improper handling of TCP segments. Affected versions include: Privilege Escalation vulnerability: prior to 7.1, 7.1, and 8.0/8.5/8.6 are listed in Cisco advisories as affected for the related issue, with...

CVE-2012-0366

Cisco Unity Connection before 7.1.3bSu2 allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141...

Multiple Vulnerabilities in Cisco Unity Connection

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco Unity多个远程安全漏洞

BUGTRAQ ID: 31642 CVECAN ID: CVE-2008-4545,CVE-2008-4544,CVE-2008-4543,CVE-2008-4542 Cisco Unity是一个语音和统一的消息平台。 Cisco Unity中存在多个安全漏洞，可能允许恶意用户泄露敏感信息、导致拒绝服务或注入恶意脚本。 1 Cisco Unity中存在跨站脚本漏洞，远程攻击者可以向数据库提供恶意数据，当下一次管理员登录并访问依赖于存储信息的页面时，就可以执行跨站脚本。 2...

CVE-2008-4542

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

CVE-2008-4545

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8 uses weak permissions for the D:\CommServer\Reports directory, which allows remote authenticated users to obtain sensitive information by reading files in this directory...