CVE-2017-12337

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade RU or...

CVE-2017-12337: Improper Authentication

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade RU or...

Cisco Voice Operating System-Based Products Unauthorized Access Vulnerability

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade or Prim...

PT-2017-3275 · Cisco · Cisco Voice Operating System

Name of the Vulnerable Software and Affected Versions: Cisco collaboration products based on the Cisco Voice Operating System software platform affected versions not specified Description: A vulnerability in the upgrade mechanism of Cisco collaboration products could allow an unauthenticated,...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of November 6, 2017

I started a 14-day detox this week that eliminates common food allergens and hormones. It’s going to be two weeks of no fun, but it’s good to give your body a little reset. Plus, I’ll be done just in time for the Thanksgiving holiday. Eliminating toxins from your body can be compared to eliminati...

Webcast Q&A: DevSecOps – Building Continuous Security Into IT and App Infrastructures

As organizations adopt DevOps to create and deliver software quickly and continuously — a key step for supporting their digital transformation initiatives — they must not overlook security. In DevOps, development and operations teams add agility and efficiency to software lifecycles with automati...

Cisco Prime Collaboration Provisioning < 12.3 Authenticated SQL Injection Vulnerability (cisco-sa-20171101-cpcp)

According to its self-reported version number, the remote Cisco Prime Collaboration Provisioning server is 9.x, 10.x, 11.x, or 12.x prior to 12.3. It is, therefore, affected by an authenticated SQL injection vulnerability. Note that Nessus has not tested for this issue but has instead relied only...

SQL Injection Vulnerability in Tonglian Da3 Collaboration Office Platform

Tonglian Da3 cooperative office platform is a series of Da3 management software products provided by Tonglian for governmental units at all levels, focusing on "mobile government office". There is a SQL injection vulnerability in the Da3 collaborative office platform, which can be exploited by an...

CVE-2017-12276

A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. Th...

Sql injection

A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. Th...

CVE-2017-12276

A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. Th...

CVE-2017-12276

Cisco Prime Collaboration Provisioning (before v12.3) is affected by an authenticated SQL injection in the web framework’s SQL database interface (CVE-2017-12276). Exploitation requires valid user credentials and can lead to disclosure/integrity impact by executing arbitrary SQL queries through c...

CVE-2017-12276

A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. Th...

PT-2017-12451

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning Software Releases prior to 12.3 Description A vulnerability in the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact...

CVE-2017-12276: Improper Input Validation

A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. Th...

Cisco Prime Collaboration Provisioning SQL Injection Vulnerability

Cisco Prime Collaboration Provisioning application is the United States of America Cisco Cisco company's set of Web-based next-generation communications services software. The software provides IP communication service features for IP telephony, voice mail and unified communications environments....

Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability

A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries. The attacker could re...

Cisco Releases Security Updates

Cisco has released updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the...

HackerOne: View Any Program's Team Members through GET https://hackerone.com/invitations/

@nickcas discovered that it was possible to view all the team members of a program through a JSON response that is sent when a user is invited to collaborate on a report via the /invitations/ endpoint. He was able to provide a very clear PoC, which consisted of a list showing all the members of t...

When cybersecurity isn’t all cyber: What does it really take to work in cybersecurity?

With the multitude of breaches and outbreaks already witnessed in 2017, it's become clear that industries across all verticals are challenged by cybersecurity. This is a serious business problem that needs to be addressed ASAP. As much talk as there is about organizations getting hacked, scores o...