CVE-2017-12214

A vulnerability in the Operations, Administration, Maintenance, and Provisioning OAMP credential reset functionality for Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation...

CVE-2016-9012

CVE-2016-9012 concerns Arista Networks CloudVision Portal (CVP) before 2016.1.2.1. The issue allows a remote authenticated user with access to the management plane to gain access to internal configuration mechanisms via the management interface, related to a request to /web/system/console/bundle....

Security Advisory 0027

Security Advisory 0027 PDF Date: December 1st, 2016 Version: 1.1 Revision| Date| Changes ---|---|--- 1.0 | December 1st, 2016 | Initial Release 1.1 | December 6th, 2016 | Impact section of this advisory is updated Affected Platforms: CloudVision Portal CVP only. Affected Software Version: All...

CVE-2015-0735

CVE-2015-0735 affects Cisco Unified CVP 10.5(1). The vulnerability is a Cross-Site Request Forgery (CSRF) flaw caused by insufficient CSRF protections, enabling an unauthenticated, remote attacker to coerce a logged-in user to perform actions in the browser (in the context of that user). No softw...

CVE-2015-0735

Cross-site request forgery CSRF vulnerability in Cisco Unified Customer Voice Portal CVP 10.51 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970...

CVE-2014-3325

CVE-2014-3325 concerns multiple cross-site scripting (XSS) vulnerabilities in the Cisco Unified Customer Voice Portal (CVP) web interface. The root cause is insufficient input validation of a parameter used by web pages, enabling remote attackers to inject arbitrary script/HTML via crafted input....

CVE-2013-1225

Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager 1 HTTP or 2 HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka...

CVE-2013-1221

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38384...

Cross site request forgery (csrf)

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38384...

CVE-2013-1220

CVE-2013-1220 affects Cisco Unified CVP (CallServer) prior to 9.0.1 ES 11, where remote attackers can trigger a denial of service (call-acceptance outage) by sending malformed SIP INVITE messages. The vulnerability is documented in Cisco advisory cisco-sa-20130508-cvp and is confirmed in multiple...

CVE-2013-1225

The CVE-2013-1225 issue affects Cisco Unified CVP Software prior to 9.0.1 ES 11. It is an XML External Entity (XXE) vulnerability in the Resource Manager reachable via HTTP/HTTPS, allowing remote attackers to read arbitrary files. The root cause is an XXE processing flaw in the file/HTTP(S) reque...

CVE-2013-1224

CVE-2013-1224 affects Cisco Unified CVP (Resource Manager) prior to 9.0.1 ES 11. A directory traversal flaw allows remote attackers to overwrite arbitrary files by sending crafted HTTP or HTTPS requests that bypass parameter validation (Bug CSCub38369). The issue is tied to the Resource Manager c...

CVE-2013-1222

The CVE-2013-1222 issue affects Cisco Unified Customer Voice Portal (CVP) Software prior to 9.0.1 ES 11, where the Tomcat Web Management feature does not properly configure Tomcat components. This allows remote attackers to launch arbitrary custom web applications via a crafted HTTP or HTTPS requ...

CVE-2013-1223

The CVE-2013-1223 issue affects Cisco Unified CVP Software prior to 9.0.1 ES 11, where the log viewer does not properly validate an unspecified parameter, enabling remote attackers to read arbitrary files via a crafted HTTP or HTTPS request. The vulnerability arises from improper input validation...

CVE-2013-1221

CVE-2013-1221 affects Cisco Unified CVP (Tomcat Web Management) prior to 9.0.1 ES 11. The vulnerability arises from improper Tomcat component configuration, enabling remote code execution via crafted HTTP or HTTPS requests. Impact is consistent with a full compromise of affected CVP deployments. ...

CVE-2013-1221

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal CVP Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted 1 HTTP or 2 HTTPS request, aka Bug ID CSCub38384...

Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software

Cisco Unified Customer Voice Portal Software Unified CVP contains multiple vulnerabilities. Various components of Cisco Unified CVP are affected; see the "Details" section for more information on the vulnerabilities. These vulnerabilities can be exploited independently; however, more than one...

Cisco Unified Customer Voice Portal权限提升漏洞

BUGTRAQ ID: 29315 CVECAN ID: CVE-2008-2053 Cisco Unified Customer Voice Portal（CVP）是Cisco用户交互网络解决方案的一部分，可为用户提供语音和视频自助服务集成。 CVP中有三个不同的用户角色：超级用户，管理员和只读访问。CVP中的安全漏洞允许管理员角色的用户创建、修改或删除更高系统权限的超级用户帐号。 Cisco CVP 7.x Cisco CVP 4.1.x Cisco CVP 4.0.x Cisco -----...

CVE-2003-1449

Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol CVP data, which allows remote attackers to bypass virus protection...

CVE-2003-1449

Affected product: Aladdin Knowledge Systems eSafe Gateway 3.5.126.0. Issue: CVP data stream incomplete validation allows remote attackers to bypass virus protection. Root cause: CVP data is not checked in full. Impact (per sources): partial confidentiality, integrity, and availability; CVSS v2 ba...