Cisco Unified Communications Manager Administration Page Cross-Site Scripting Vulnerability (cisco-sa-20161207-cucm)

A vulnerability in the ccmadmin page of Cisco Unified Communications Manager CUCM could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting XSS attacks. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, a...

CVE-2016-6440

CVE-2016-6440 affects Cisco Unified Communications Manager (CUCM). Root cause: lack of input sanitization for iframe data in HTTP requests, enabling an attacker to display data inside an iframe and trigger clickjacking (phishing) without user interaction. Affected releases include CUCM 11.0(1.100...

Cisco Unified Communications Manager Information Disclosure Vulnerability (cisco-sa-20160208-ucm)

Cisco Unified Communications Manager CUCM is prone to an information disclosure vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-lat...

Cisco Unified Communications Manager - Multiple Vulnerabilities

Cisco Unified Communications Manager - Multiple Vulnerabilities Vantage Point Security Advisory 2015-001 ======================================== Title: Cisco Unified Communications Manager Multiple Vulnerabilities Vendor: Cisco Vendor URL: http://www.cisco.com/ Versions affected: Summary: ------...

Cisco Unified Communications Manager Multiple Vulnerabilities (VP2015-001)

Vantage Point Security Advisory 2015-001 ======================================== Title: Cisco Unified Communications Manager Multiple Vulnerabilities Vendor: Cisco Vendor URL: http://www.cisco.com/ Versions affected: 9.2, 10.5.2, 11.0.1. Severity: Low to medium Vendor notified: Yes Reported: Oct...

CUCM IM and Presence Service GNU Bash Environment Variable Handling Command Injection (CSCur05454) (Shellshock)

According to its self-reported version, the CUCM IM and Presence Service installed on the remote host contains a version of GNU Bash that is affected by a command injection vulnerability known as Shellshock, which is due to the processing of trailing strings after function definitions in the valu...

Cisco Unified Communications Manager Multiple Reflected XSS

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by multiple reflected cross-site scripting vulnerabilities due to insufficient input validation of certain parameters passed via HTTP GET or POST methods. %NASLMINLEVEL 70300 C Tenable...

CVE-2013-7030

CVE-2013-7030 affects Cisco Unified Communications Manager: the TFTP service can leak sensitive phone configuration data via an RRQ, specifically exposing a cleartext UseUserCredential in SPDefault.cnf.xml. The issue stems from a default TFTP behavior described as exposing this field, with Cisco ...

CVE-2013-5555

Cisco Unified Communications Manager (CUCM) is affected by a DoS vulnerability caused by improper parsing of a crafted SIP message (Bug ID CSCub54349). An unauthenticated, remote attacker can trigger a service restart. Multiple connected sources confirm the issue and Cisco has released an advisor...

Cisco Unified Communications Manager (CUCM) Web Detection

The web interface for Cisco Unified Communications Manager CUCM was detected. Note: This plugin does not report anything. It only collects version information to be used downstream. C Tenable, Inc. include'compat.inc'; if description scriptid70088; scriptversion"1.9";...

Sql injection

SQL injection vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows remote attackers to execute arbitrary SQL commands via unspecified vectors, leading to discovery of encrypted credentials by leveraging metadata, aka Bug ID CSCuh01051...

Hardcoded credentials

Cisco Unified Communications Manager CUCM 7.1x through 9.12 and the IM & Presence Service in Cisco Unified Presence Server through 9.12 use the same CTI and database-encryption key across different customers' installations, which makes it easier for context-dependent attackers to defeat...

Design/Logic Flaw

Untrusted search path vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02242...

Code injection

An unspecified function in Cisco Unified Communications Manager CUCM 7.1x through 9.12 allows remote authenticated users to execute arbitrary commands via unknown vectors, aka Bug ID CSCuh73440...

CVE-2013-3404

SQL injection vulnerability in Cisco Unified Communications Manager CUCM 7.1x through 9.11a allows remote attackers to execute arbitrary SQL commands via unspecified vectors, leading to discovery of encrypted credentials by leveraging metadata, aka Bug ID CSCuh01051...

CVE-2013-3434

CVE-2013-3434 affects Cisco Unified Communications Manager (CUCM) versions 7.1.x through 9.1(1a). The root cause is an untrusted search path due to unspecified file-permission and environment-variable issues on privileged programs (Bug CSCui02242). This enables local privilege escalation for auth...

CVE-2013-3433

CVE-2013-3433 concerns Cisco Unified Communications Manager (CUCM) 7.1.x–9.1(1a). The root cause is improper file permissions on a privileged system binary, leading to an untrusted search path that enables a local, authenticated attacker to escalate privileges. Public PoC code exists. Impact is l...

CVE-2013-4869

Cisco Unified Communications Manager CUCM 7.1x through 9.12 and the IM & Presence Service in Cisco Unified Presence Server through 9.12 use the same CTI and database-encryption key across different customers' installations, which makes it easier for context-dependent attackers to defeat...

CVE-2013-4869

Cisco Unified Communications Manager (CUCM) versions 7.1.x–9.1(2) and the IM & Presence Service in Cisco Unified Presence Server up to 9.1(2) share the same CTI and database-encryption key across different customer installations. This creates a cryptographic risk where context-dependent attackers...

CVE-2013-3404

Cisco CUCM (7.1.x–9.1(1a)) is affected by a remote SQL injection vulnerability that allows an unauthenticated attacker to run arbitrary SQL via unspecified vectors and, via metadata, potentially reconstruct encrypted credentials. Exploitation can enable credential discovery and, in combination wi...