Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment is a suite of software for centralized management of Cisco HCS solutions. A cross-site request forgery vulnerability exists in Cisco Hosted Collaboration Mediation Fulfillment that could allow a remote attacker to construct a malicious URI, trick a...

Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability

A cross-site request forgery CSRF vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an unauthenticated, remote attacker to execute unwanted actions. The vulnerability is due to a lack of CSRF protections by an affected device. An...

Cisco Hosted Collaboration Mediation Fulfillment Directory Traversal Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is a set of software for centralized management of Cisco HCS solutions from Cisco USA. The software provides configuration, management and monitoring of Cisco HCM-F services and other functions. A directory traversal vulnerability exists in...

Cisco Hosted Collaboration Mediation Fulfillment Directory Traversal Vulnerability (CNVD-2016-07110)

Cisco Hosted Collaboration Solution HCS is a cloud service that provides communication and collaboration solutions. A security vulnerability exists in the web interface of Cisco Hosted Collaboration Mediation Fulfillment. Due to the program not properly validating the HTTP URL format. An...

Cisco Hosted Collaboration Mediation Fulfillment Authenticated Directory Traversal Vulnerability

A vulnerability in the web interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an authenticated, remote attacker to access arbitrary files on the system. This vulnerability allows the attacker to perform directory traversal. The vulnerability is due to a lack of proper input...

Cisco Hosted Collaboration Mediation Fulfillment Directory Traversal File System Vulnerability

A vulnerability in the web interface of Cisco Hosted Collaboration Mediation Fulfillment application could allow an unauthenticated, remote attacker to write arbitrary files to any file system location that the application server has permissions to access. The vulnerability is due to lack of prop...

HackerOne: Requesting Mediation possible on reports that are too old for mediation

Hi Hackerone Team, it is possible to request mediation for reports, that have the closedTooLongToMediate-parameter set to true, by requesting a mediation for a new report and changing the report id to the old report. PoC report: https://hackerone.com/reports/77834 My Request looks like: POST...

HackerOne: Repeated mediation requests and multiple emails possible on a report.

Hi, 1 We can by pass used buttom Confirm on Request Mediation from HackerOne where is disable him POC: Edit html and delete disabled="" And buttom in active. 2 Next catch request https://hackerone.com/reports/nubmerreport/hackerhelp POST: message=&mediationtype=resolution If parametr message null...

Paragon Initiative Enterprises: User enumeration via Password reset page [Minor]

Hey, I've found a 'minor' issue in bridge.cspr.ng CMS Airship The issue is 'username enumeration' Means, an attacker can know that if a user exists or not; just by noticing the error! So, once the attacker knows that a user exists, he can launch a brute force attack against it! Steps of replicati...

Nextcloud: nextcloud.com: Content Injection Custom 404 Error

Hello Team , Request: if u think the reported issues have acceptable risk and u r not going to make changes then kindly request to mark as Informative . Description : This report is about how an attacker is able to spoof the content of 404 page and can add thr own Text in way that the Current...

KLA10822 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, elevate privileges, cause denial of service, conduct XSS or obtain sensitive information. Below is a complete list of...

HackerOne: Mediation link can be accepted by other users

When a company user requests mediation on a report, a support ticket is created for the HackerOne team to investigate. @kirkj found out that the support ticket included an invitation link, and that some support reps may include it inadvertently within email replies. If HackerOne had not accepted...

Cisco Hosted Collaboration Mediation Fulfillment Information Disclosure Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is a set of software for centralized management of Cisco HCS solutions from Cisco USA. The software provides configuration, management and monitoring of Cisco HCM-F services and other functions. An information disclosure vulnerability exists ...

CVE-2015-6404

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...

Code injection

Cisco Hosted Collaboration Mediation Fulfillment 10.63 does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374...

CVE-2015-6404

The CVE-2015-6404 entry concerns Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3), where lack of RBAC in the SOAP API allows an authenticated admin user to retrieve sensitive credentials and other restricted data. Root cause: missing RBAC in the HCM-F SOAP interface. Impact: infor...

Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability

A vulnerability in the Simple Object Access Protocol SOAP application programming interface API of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an authenticated, remote attacker to obtain sensitive information that should be restricted. The attacker must authentica...

Description of the cumulative update for Lync Server 2010: July 2011

Describes the bug that is resolved in the July, 2011 cumulative update package for Lync Server 2010.SummaryThis article describes the cumulative update for Microsoft Lync Server 2010 that is dated July, 2011. INTRODUCTIONIssues that this update package fixesThis cumulative update fixes the...

Description of the cumulative update for Lync Server 2010, Mediation Server: November 2011

Describes the bugs that are fixed in the November, 2011 cumulative update package for Lync Server 2010.SummaryThis article describes the issue that is fixed in the update package for Microsoft Lync Server 2010, Mediation Server that is dated November 2011.This article describes the following item...

Cisco Hosted Collaboration Mediation Excessive CPU Utilization Vulnerability

A vulnerability in the network stack of Cisco Hosted Collaboration Mediation could allow an unauthenticated, remote attacker to cause excessive CPU utilization on the affected system. The vulnerability is due to insufficient optimization of resources when the affected system is flooded with...