Cross site request forgery (csrf)

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38384...

CVE-2013-1221

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38384...

CVE-2013-1220

CVE-2013-1220 affects Cisco Unified CVP (CallServer) prior to 9.0.1 ES 11, where remote attackers can trigger a denial of service (call-acceptance outage) by sending malformed SIP INVITE messages. The vulnerability is documented in Cisco advisory cisco-sa-20130508-cvp and is confirmed in multiple...

CVE-2013-1225

The CVE-2013-1225 issue affects Cisco Unified CVP Software prior to 9.0.1 ES 11. It is an XML External Entity (XXE) vulnerability in the Resource Manager reachable via HTTP/HTTPS, allowing remote attackers to read arbitrary files. The root cause is an XXE processing flaw in the file/HTTP(S) reque...

CVE-2013-1223

The CVE-2013-1223 issue affects Cisco Unified CVP Software prior to 9.0.1 ES 11, where the log viewer does not properly validate an unspecified parameter, enabling remote attackers to read arbitrary files via a crafted HTTP or HTTPS request. The vulnerability arises from improper input validation...

CVE-2013-1221

CVE-2013-1221 affects Cisco Unified CVP (Tomcat Web Management) prior to 9.0.1 ES 11. The vulnerability arises from improper Tomcat component configuration, enabling remote code execution via crafted HTTP or HTTPS requests. Impact is consistent with a full compromise of affected CVP deployments. ...

CVE-2013-1224

CVE-2013-1224 affects Cisco Unified CVP (Resource Manager) prior to 9.0.1 ES 11. A directory traversal flaw allows remote attackers to overwrite arbitrary files by sending crafted HTTP or HTTPS requests that bypass parameter validation (Bug CSCub38369). The issue is tied to the Resource Manager c...

CVE-2013-1222

The CVE-2013-1222 issue affects Cisco Unified Customer Voice Portal (CVP) Software prior to 9.0.1 ES 11, where the Tomcat Web Management feature does not properly configure Tomcat components. This allows remote attackers to launch arbitrary custom web applications via a crafted HTTP or HTTPS requ...

CVE-2013-1224: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted 1 HTTP or 2 HTTPS request that triggers incorrect parameter validation, aka Bug ID CSCub38369...

PT-2013-2987

Name of the Vulnerable Software and Affected Versions Cisco Unified Customer Voice Portal CVP Software versions prior to 9.0.1 ES 11 Description The issue is related to a directory traversal vulnerability in the Resource Manager. This allows remote attackers to overwrite arbitrary files by sendin...

CVE-2013-1222: Undefined Security Weakness

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38379...

CVE-2013-1225: Undefined Security Weakness

Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager 1 HTTP or 2 HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka...

CVE-2013-1221: Undefined Security Weakness

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38384...

CVE-2013-1220: Undefined Security Weakness

The CallServer component in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to cause a denial of service call-acceptance outage via malformed SIP INVITE messages, aka Bug ID CSCua65148...

CVE-2013-1223: Improper Input Validation

The log viewer in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly validate an unspecified parameter, which allows remote attackers to read arbitrary files via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38372...

Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software

Cisco Unified Customer Voice Portal Software Unified CVP contains multiple vulnerabilities. Various components of Cisco Unified CVP are affected; see the "Details" section for more information on the vulnerabilities. These vulnerabilities can be exploited independently; however, more than one...

Cisco Unified Customer Voice Portal权限提升漏洞

BUGTRAQ ID: 29315 CVECAN ID: CVE-2008-2053 Cisco Unified Customer Voice Portal（CVP）是Cisco用户交互网络解决方案的一部分，可为用户提供语音和视频自助服务集成。 CVP中有三个不同的用户角色：超级用户，管理员和只读访问。CVP中的安全漏洞允许管理员角色的用户创建、修改或删除更高系统权限的超级用户帐号。 Cisco CVP 7.x Cisco CVP 4.1.x Cisco CVP 4.0.x Cisco -----...

CVE-2008-2053: Undefined Security Weakness

Unspecified vulnerability in Cisco Unified Customer Voice Portal CVP 4.0.x before 4.02ES14, 4.1.x before 4.11ES11, and 7.x before 7.01 allows remote authenticated users with administrator role privileges to create, modify, or delete a superuser account...

CVE-2003-1449

Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol CVP data, which allows remote attackers to bypass virus protection...

CVE-2003-1449

Affected product: Aladdin Knowledge Systems eSafe Gateway 3.5.126.0. Issue: CVP data stream incomplete validation allows remote attackers to bypass virus protection. Root cause: CVP data is not checked in full. Impact (per sources): partial confidentiality, integrity, and availability; CVSS v2 ba...