CVE-2008-2061

CVE-2008-2061 affects Cisco Unified Communications Manager (CUCM) CTI Manager service. The vulnerability allows remote attackers to cause a denial of service (TSP crash) by sending malformed traffic to TCP port 2748. Affected CUCM versions: 5.x before 5.1(3c) and 6.x before 6.1(2). The DoS is tri...

CVE-2008-2730

The CVE-2008-2730 entry describes an authentication bypass in Cisco Unified Communications Manager (CUCM) RIS Data Collector, allowing read-only access to cluster information via a direct TCP connection to port 2556. Affected CUCM versions include 4.x, 5.x, and 6.x; fixes/remedies are provided in...

Cisco Unified Communications Manager多个拒绝服务漏洞

BUGTRAQ ID: 29221 CVECAN ID: CVE-2008-1744,CVE-2008-1745,CVE-2008-1746,CVE-2008-1747,CVE-2008-1748,CVE-2008-1742,CVE-2008-1743 Cisco Unified Communications Manager（CUCM，之前被称为CallManager）是Cisco IP电话解决方案中的呼叫处理组件。 CUCM中存在多个拒绝服务漏洞，可能导致语音服务中断。 以下Cisco Unified Communications Manager服务受影响： 证书信任列表（CTL）供应...

Code injection

Cisco Unified Communications Manager CUCM 5.x before 5.12 and 6.x before 6.11 allows remote attackers to cause a denial of service service interruption via a SIP JOIN message with a malformed header, aka Bug ID CSCsi48115...

CVE-2008-1743

Memory leak in the Certificate Trust List CTL Provider service in Cisco Unified Communications Manager CUCM 5.x before 5.13 and 6.x before 6.11 allows remote attackers to cause a denial of service memory consumption and service interruption via a series of malformed TCP packets, aka Bug ID...

Memory corruption

Memory leak in the Certificate Trust List CTL Provider service in Cisco Unified Communications Manager CUCM 5.x before 5.13 and 6.x before 6.11 allows remote attackers to cause a denial of service memory consumption and service interruption via a series of malformed TCP packets, aka Bug ID...

Memory corruption

Memory leak in the Certificate Trust List CTL Provider service in Cisco Unified Communications Manager CUCM 5.x before 5.13 allows remote attackers to cause a denial of service memory consumption and service interruption via a series of malformed TCP packets, as demonstrated by TCPFUZZ, aka Bug I...

CVE-2008-1745

Cisco Unified Communications Manager (CUCM) is affected by CVE-2008-1745. A DoS can be triggered by receiving a malformed SIP JOIN header, impacting CUCM 5.x before 5.1(2) and 6.x before 6.1(1). The SIP processing path is a known vulnerability area; related advisories indicate this is a denial of...

CVE-2008-1743

The CVE-2008-1743 issue affects Cisco Unified Communications Manager (CUCM) 5.x (before 5.1(3)) and 6.x (before 6.1(1)). It is a memory-leak denial-of-service in the Certificate Trust List (CTL) Provider service triggered by a series of malformed TCP packets, with CTL Provider listening on TCP 24...

CVE-2008-1744

CVE-2008-1744 affects Cisco Unified Communications Manager (CUCM) CAPF (Certificate Authority Proxy Function) across CUCM 4.1/4.2/4.3 with specific SR updates. The CAPF service, normally TCP 3804 and disabled by default, may be abused by remote malformed network traffic to trigger a denial-of-ser...

CVE-2008-1743

Memory leak in the Certificate Trust List CTL Provider service in Cisco Unified Communications Manager CUCM 5.x before 5.13 and 6.x before 6.11 allows remote attackers to cause a denial of service memory consumption and service interruption via a series of malformed TCP packets, aka Bug ID...

Cisco Unified Communications Manager key参数SQL注入漏洞

BUGTRAQ ID: 27775 CVECAN ID: CVE-2008-0026 Cisco Unified Communications Manager（CUCM，之前被称为CallManager）是Cisco IP电话解决方案中的呼叫处理组件。 CUCM的管理员和用户界面页面的key参数存在SQL注入漏洞，远程攻击者可能利用此漏洞获取敏感信息。 攻击者可以在管理员或用户界面页面的key参数中输入特制值触发SQL注入漏洞，可通过Web界面使用http或https协议来执行攻击，成功攻击可以终止SQL调用，强制到后端数据库的连接，导致泄露敏感信息，如用户名和口令哈希。 Cisco...

Sql injection

SQL injection vulnerability in Cisco Unified CallManager/Communications Manager CUCM 5.0/5.1 before 5.13a and 6.0/6.1 before 6.11a allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the 1 admin and 2 user interface pages...

CVE-2008-0026

Cisco Unified CallManager/Communications Manager (CUCM) versions affected: 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a). A SQL injection vulnerability exists in the key parameter of the admin and user interface pages, allowing an authenticated remote attacker to inject SQL commands. The atta...

CVE-2008-0027

CVE-2008-0027 corresponds to a heap overflow in Cisco Unified Communications Manager’s CTL Provider service (CTLProvider.exe). The flaw; occurs in CUCM 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1, and in CallManager 4.0/4.1 before 4.1(3)SR5c; the CTL Provider listens on TCP port 2444 and proces...

Design/Logic Flaw

The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an...

CVE-2007-6190

The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remote authenticated users of other phones associated with the same CUCM server to eavesdrop on the physical environment via a CiscoIPPhoneExecute message containing a URL attribute of an...

CVE-2007-5537

CVE-2007-5537 affects Cisco Unified Communications Manager (CUCM, former CallManager) 5.1 before 5.1(2) and Unified CallManager 5.0. The vulnerability allows remote attackers to cause a denial of service (kernel panic) by sending a flood of SIP INVITE messages to UDP port 5060, triggering resourc...

Cisco CallManager 4.2 CUCM 4.2 - Logon Page lang SQL Injection

Cisco CallManager 4.2 CUCM 4.2 - Logon Page lang SQL Injection source: https://www.securityfocus.com/bid/25480/info Cisco Unified CallManager and Unified Communications Manager are prone to multiple input-validation vulnerabilities because the applications fail to properly sanitize user-supplied...

Code injection

Unspecified vulnerability in Cisco Unified Communications Manager CUCM 5.0, 5.1, and 6.0, and IOS 12.0 through 12.4, allows remote attackers to execute arbitrary code via a malformed SIP packet, aka CSCsi80102...