CVE-2014-0336

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the 1 DBCONN, 2 DBNAME, 3 DMHOST, 4 MANDBNAME, 5 framecmd, 6 identifier, 7 merant.adm.adapters.AdmDialogPropertyMgr, 8...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...

CVE-2014-0335

Serena Dimensions CM 12.2 Build 7.199.0 web client contains multiple cross-site scripting vulnerabilities (CWE-79). Exploitable via unauthenticated vectors in parameters such as DB_CONN, DB_NAME, DM_HOST, MAN_DB_NAME, framecmd, identifier, merant.adm.adapters.AdmDialogPropertyMgr, nav_frame, nav_...

CVE-2014-0335

Multiple cross-site scripting XSS vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the 1 DBCONN, 2 DBNAME, 3 DMHOST, 4 MANDBNAME, 5 framecmd, 6 identifier, 7 merant.adm.adapters.AdmDialogPropertyMgr, 8...

CVE-2014-0336

The CVE-2014-0336 issue affects Serena Dimensions CM 12.2 Build 7.199.0 web client (and possibly earlier) and is caused by a cross-site request forgery (CSRF) vulnerability in the web client. An attacker can craft a malicious URI to perform actions in an administrator’s session via the user_new_m...

CVE-2014-0336

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...

Serena Dimensions CM 12.2 Build 7.199.0 web client vulnerabilities

Overview Serena Dimensions CM 12.2 Build 7.199.0 web client and possibly earlier versions contains multiple cross-site scripting vulnerabilities. Description Serena Dimensions CM 12.2 Build 7.199.0 web client and possibly earlier versions contains multiple cross-site scripting...

Code injection

The Certificate Authority Proxy Function CAPF CLI implementation in the CSR management feature in Cisco Unified Communications Manager Unified CM 10.01 and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464...

CVE-2014-0742

CVE-2014-0742 concerns Cisco Unified Communications Manager (Unified CM) CAPF CSR management CLI. The CAPF CSR management feature contains insufficient input validation, allowing an authenticated, local attacker to read or write arbitrary files on the underlying OS via crafted CLI input (Bug ID C...

CVE-2014-0747

The Certificate Authority Proxy Function CAPF CLI implementation in Cisco Unified Communications Manager Unified CM 10.01 and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493...

CVE-2014-0735

Cross-site scripting XSS vulnerability in the IP Manager Assistant IPMA interface in Cisco Unified Communications Manager Unified CM 10.01 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470...

CVE-2014-0734

CVE-2014-0734 affects Cisco Unified Communications Manager CAPF. The Certificate Authority Proxy Function fails to properly sanitize user input, enabling a remote attacker to craft a URL that executes arbitrary SQL commands. Affected: UCM 10.0(1) and earlier. Impact: potential data exposure/modif...

CVE-2014-0736

Cisco Unified Communications Manager (Unified CM) is affected by CSRF on the CAR page, for 10.0(1) and earlier. An attacker can trick a logged-in user into issuing CAR-modification requests, potentially hijacking the user’s authentication for those actions. The issue is addressed in Cisco’s advis...

Cisco Unified Communications Manager CAPF Unauthenticated Blind SQL Injection Vulnerability

A vulnerability in the Certificate Authority Proxy Function CAPF of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate...

Cisco Unified Communications Manager Operating System-Level Privilege Escalation Vulnerability

A vulnerability in underlying file permissions of specific operating system-level commands of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, local attacker to gain elevated privileges. The vulnerability is due to insufficient file permissions. An attacker coul...

CVE-2014-0657

CVE-2014-0657 affects Cisco Unified Communications Manager (Unified CM) administration portal (9.1(1) and earlier). The issue is insufficient role restriction processing, allowing a remote, authenticated attacker to bypass role-based access by revisiting a previously denied portal URL, potentiall...

CVE-2013-3462

Cisco Unified Communications Manager (Unified CM) is affected by CVE-2013-3462, a remote buffer overflow (Bug ID CSCud54358) that could allow an authenticated, remote attacker to execute arbitrary code. Impact applies to CUCM 7.1(x) before 7.1(5b)su6, 8.5(x) before 8.5(1)su6, 8.6(x) before 8.6(2a...

CVE-2013-3459

CVE-2013-3459 affects Cisco Unified Communications Manager (CUCM) 7.1.x prior to 7.1(5b)su6a, where error handling in registration messages can be abused to trigger a denial of service. Root cause: improper error handling leads to service disruption via malformed registration traffic. According t...

CVE-2013-3451

Cisco Unified Communications Manager (Unified CM) Web Page CSRF vulnerability (CVE-2013-3451) allows unauthenticated attackers to perform arbitrary operations by exploiting insufficient CSRF protections in the web interface. The root cause is CSRF protection gaps that let a user’s browser submit ...