PT-2019-1382 · Cisco · Cisco Telepresence Video Communication Server +2

Name of the Vulnerable Software and Affected Versions: Cisco TelePresence Conductor versions prior to XC4.3.4 Cisco Expressway Series versions prior to XC4.3.4 Cisco TelePresence Video Communication Server versions prior to XC4.3.4 Description: The issue is related to insufficient access controls...

Security Bulletin: Vulnerability in Apache Commons FileUpload DiskFileItem File Manipulation affects IBM Spectrum Conductor with Spark 2.2.0 (CVE-2016-1000031)

Summary A security vulnerability relating to remote code execution CVE-2016-1000031 has been reported against Apache Commons FileUpload DiskFileItem File Manipulation, which IBM Spectrum Conductor with Spark 2.2.0 uses as a framework for some services. Commons FileUpload 1.3.3 addresses this...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Conductor with Spark

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM Spectrum Conductor with Spark. These issues were disclosed as part of the IBM Java updates in January 2018. Vulnerability Details CVEID: CVE-2018-2579 DESCRIPTION: An unspecified vulnerability in Oracle Ja...

Security Bulletin: A vulnerability in Apache Struts 2 affects IBM Spectrum Conductor with Spark (CVE-2017-9787, CVE-2017-9804, and CVE-2017-12611)

Summary Several security vulnerabilities CVE-2017-9787 S2-049 CVE-2017-9804 S2-050 CVE-2017-12611 S2-053 have been reported against Apache Struts 2, which IBM Spectrum Conductor with Spark uses as a framework for its WEBGUI service. Struts 2.3.34 addresses these vulnerabilities and can be applied...

Cisco Expressway Series, Cisco TelePresence Video Communication Server, and Cisco TelePresence Conductor REST API Denial of Service Vulnerability

A vulnerability in the cluster database CDB management component of Cisco Expressway Series Software, Cisco TelePresence Video Communication Server VCS Software, and Cisco TelePresence Conductor Software could allow an authenticated, remote attacker to cause the CDB process on an affected system ...

The vulnerability of the microprogramming software of the Cisco TelePresence Conductor conference call control device allows a intruder to gain access to the device.

The vulnerability of the control interface for microprogramming-based conference communication devices like Cisco TelePresence Conductor is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to the device using a...

Design/Logic Flaw

Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408...

CVE-2015-0747

Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408...

CVE-2015-0747

CVE-2015-0747 affects Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release. A remote attacker can inject arbitrary cookies by sending a crafted HTTP request due to improper input validation of an HTTP header, potentially taking control of an HTTP session. Cisco’s advisory confirms ...

CVE-2015-0747: Improper Input Validation

Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408...

Cisco Conductor for Videoscape and Cisco Headend System Release HTTP Injection Vulnerability

A vulnerability in the Cisco Conductor for Videoscape and Cisco Headend System Releases could allow an unauthenticated, remote attacker to inject arbitrary HTTP cookies via an HTTP request. The vulnerability is due to improper input validation of an HTTP request header. An attacker could exploit...

Cisco TelePresence Conductor Login Security Bypass Vulnerability

According to its self-reported version number, the Cisco TelePresence Conductor on the remote host contains an vulnerability due to inadequate validation of parameters passed during the login process. A remote attacker, using a crafted request and knowledge of a valid user name, can bypass...

Cisco TelePresence Conductor SDP Media Description Vulnerability

According to its self-reported version number, the Cisco TelePresence Conductor on the remote host contains an vulnerability related to the Session Description Protocol SDP packet handler function. A remote, unauthenticated attacker, using a crafted SDP packet to trigger a reload, can exploit thi...

Authentication flaw

The management interface in Cisco TelePresence Video Communication Server VCS and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login...

CVE-2015-0652

CVE-2015-0652 affects Cisco TelePresence VCS, Cisco Expressway (before X8.2) and Cisco TelePresence Conductor (before XC2.4). The SDP packet handler vulnerability allows a remote, unauthenticated attacker to cause a denial of service (mishandled exception and device reload) via a crafted SDP medi...

CVE-2015-0653

CVE-2015-0653 affects Cisco TelePresence VCS/Expressway, Cisco TelePresence Conductor, and XC2.4-era components, where the management interfaces allow remote authentication bypass via crafted login parameters. The root cause is inadequate validation of login parameters, enabling an attacker with ...

CVE-2015-0652: Improper Input Validation

The Session Description Protocol SDP implementation in Cisco TelePresence Video Communication Server VCS and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service mishandled exception and device reload via a crafted media...

CVE-2015-0653: Improper Authentication

The management interface in Cisco TelePresence Video Communication Server VCS and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login...

Cisco TelePresence VCS and Conductor SDP Message Denial of Service Vulnerability

Cisco TelePresence is a telepresence conferencing solution developed by Cisco.Cisco Expressway is a video conferencing application. A security vulnerability in Cisco TelePresence VCS and Conductor SDP message handling allows attackers to exploit the vulnerability to submit special IPv4 or IPv6v6...

Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor

Cisco TelePresence Video Communication Server VCS, Cisco Expressway and Cisco TelePresence Conductor contain the following vulnerabilities: SDP Media Description Denial of Service Vulnerability Authentication Bypass Vulnerability Successful exploitation of the SDP Media Description Denial of...