CVE-2008-4544

Unspecified vulnerability in an unspecified Microsoft API, as used by Cisco Unity and possibly other products, allows remote attackers to cause a denial of service by sending crafted packets to dynamic UDP ports, related to a "processing error."...

CVE-2008-4543

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8, when using anonymous authentication aka native Unity authentication, allows remote attackers to cause a denial of service session exhaustion via a large number of connections...

Directory traversal

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8 uses weak permissions for the D:\CommServer\Reports directory, which allows remote authenticated users to obtain sensitive information by reading files in this directory...

CVE-2008-4544

Unspecified vulnerability in an unspecified Microsoft API, as used by Cisco Unity and possibly other products, allows remote attackers to cause a denial of service by sending crafted packets to dynamic UDP ports, related to a "processing error."...

CVE-2008-4543

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8, when using anonymous authentication aka native Unity authentication, allows remote attackers to cause a denial of service session exhaustion via a large number of connections...

CVE-2008-4545

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8 uses weak permissions for the D:\CommServer\Reports directory, which allows remote authenticated users to obtain sensitive information by reading files in this directory...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

Authentication flaw

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8, when using anonymous authentication aka native Unity authentication, allows remote attackers to cause a denial of service session exhaustion via a large number of connections...

CVE-2008-4542

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

CVE-2008-4545

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8 uses weak permissions for the D:\CommServer\Reports directory, which allows remote authenticated users to obtain sensitive information by reading files in this directory...

CVE-2008-4543

Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8, when using anonymous authentication aka native Unity authentication, allows remote attackers to cause a denial of service session exhaustion via a large number of connections...

CVE-2008-4543

Cisco Unity in 4.x (before 4.2(1)ES161), 5.x (before 5.0(1)ES53), and 7.x (before 7.0(2)ES8) is affected when using anonymous/native Unity authentication. A remote attacker can cause a denial of service by exhausting sessions via a large number of connections. Root cause is an authentication/conf...

CVE-2008-4544

Cisco Unity (Server 4.2/5.0/7.0) contains a vulnerability that allows an unauthenticated, remote attacker to cause a denial-of-service by sending crafted UDP packets to dynamic ports due to improper handling of network messages. The issue affects Cisco Unity Server deployments (as cited in Cisco ...

CVE-2008-4542

Cross-site scripting XSS vulnerability in Cisco Unity 4.x before 4.21ES162, 5.x before 5.01ES56, and 7.x before 7.02ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database aka data store...

Cisco Unity Connection Exhaustion Denial of Service Vulnerability

Cisco Unity contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability exists due to improper handling of network messages. An unauthenticated, remote attacker to exploit this vulnerability to render the Cisco Unity...

Cisco Unity authentication bypass

Authentication bypass to administration features if anonymous access is enabled...

Cisco Unity 7.0存在多个漏洞

BUGTRAQ ID: 31642 CNCAN ID：CNCAN-2008100906 Cisco Unity是一款面向企业级机构的统一通信解决方案。 Cisco Unity存在多个安全问题，包括： -Unity监听在动态UDP端口的多个服务处理特殊报文存在拒绝服务攻击。 -Unity server共享目录可泄漏信息给所有域用户。 -Unity server的会话管理看起来受限制，允许恶意用户使用所有可用户会话对合法管理者进行拒绝服务访问。要恢复新会话功能需要重新启动系统，重新启动默认WEB将不奏效。 -存在输入验证问题，导致多个跨站脚本攻击。 Cisco Unity 7.0...

Cisco Security Advisory: Authentication Bypass in Cisco Unity

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Authentication Bypass in Cisco Unity Advisory ID: cisco-sa-20081008-unity http://www.cisco.com/warp/public/707/cisco-sa-20081008-unity.shtml Revision 1.0 For Public Release 2008 October 08 1600 UTC GMT Summary ======= A...

Cisco Unity远程管理验证绕过漏洞

BUGTRAQ ID: 31638 CVE ID：CVE-2008-3814 CNCVE ID：CNCVE-20083814 Cisco Unity是一款面向企业级机构的统一通信解决方案。 Cisco Unity WEB接口验证实现存在问题，远程攻击者可以利用漏洞访问受限制资源。 第一次尝试连接任意特定链接，会重定向到验证页，但是任意后续的尝试会导致无需要合法登录验证凭证而成功访问，攻击者借此可获得敏感信息或可编辑配置。 Cisco Unity 7.0 Cisco Unity 5.0 Cisco Unity 4.0 Cisco将发布补丁来提供解决方案，请用户关注供应商进度：...

CVE-2008-3814

Unspecified vulnerability in Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8, when using anonymous authentication aka native Unity authentication, allows remote attackers to bypass authentication and read or modify system configuration parameters by going to a specif...