468 matches found
Command injection
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...
Directory traversal
Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...
CVE-2012-6609
Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...
CVE-2012-6610
CVE-2012-6610 affects Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J. The vulnerability is a command injection that allows remote authenticated users to execute arbitrary commands via the ping feature, demonstrated by using a semicolon to inject commands. Evidence from multip...
CVE-2012-6610: Improper Neutralization of Special Elements used in an OS Command
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...
PT-2020-7314
Name of the Vulnerable Software and Affected Versions: Polycom HDX Video End Points versions prior to 3.0.4 UC APL versions prior to 2.7.1.J Description: The issue allows remote authenticated users to execute arbitrary commands. This can be demonstrated by appending a semicolon to the ping comman...
Cisco Unified Communications Manager Cross-Site Request Forgery (XSRF) Vulnerability (cisco-sa-20191002-cucm-csrf)
According to its self-reported version, Cisco Unified Communications Manager is affected by a cross-site request forgery XSRF vulnerability exists in its web application interface component due to insufficient XSRF protections. A remote attacker can exploit this by tricking a user into visiting a...
Arbitrary Deletion Vulnerability in HongCMS v4.0 uc_a***.php File
HongCMS is an open source lightweight content management system CMS. HongCMS v4.0 uca.php file contains an arbitrary deletion vulnerability. An attacker can exploit the vulnerability to delete arbitrary files, resulting in a system reinstallation...
PT-2019-13046
Name of the Vulnerable Software and Affected Versions Polycom UC Software affected versions not specified Description A vulnerability in the web-based management interface of certain Polycom phones could allow an authenticated, remote attacker with admin privileges to cause a denial of service Do...
CVE-2019-12948: Exposed Dangerous Method or Function
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service DoS condition or execute arbitrary co...
Huawei eSpace 1.1.11.103 - DLL Hijacking
/ Huawei eSpace Desktop DLL Hijacking Vulnerability Vendor: Huawei Technologies Co., Ltd. Product web page: https://www.huawei.com Affected version: eSpace 1.1.11.103 aka eSpace ECS, eSpace Desktop, eSpace Meeting, eSpace UC Summary: Create more convenient Enhanced Communications EC services for...
Unpatched Flaw in UC Browser Apps Could Let Hackers Launch Phishing Attacks
A bug hunter has discovered and publicly disclosed details of an unpatched browser address bar spoofing vulnerability that affects popular Chinese UC Browser and UC Browser Mini apps for Android. Developed by Alibaba-owned UCWeb, UC Browser is one of the most popular mobile browsers, specifically...
Unpatched Flaw in UC Browser Apps Could Let Hackers Launch Phishing Attacks
A bug hunter has discovered and publicly disclosed details of an unpatched browser address bar spoofing vulnerability that affects popular Chinese UC Browser and UC Browser Mini apps for Android. Developed by Alibaba-owned UCWeb, UC Browser is one of the most popular mobile browsers, specifically...
Alibaba Group UC Browser application for Android encryption issue vulnerability
Alibaba Group UC Browser application for Android is a mobile browser based on the Android platform from China's Alibaba Group Alibaba Group. A security vulnerability exists in the 2019-03-26 and earlier versions of the UCWeb UC Browser application for Android-based platforms. An attacker can...
UC Browser is the presence of man in the middle attacks(MITM)vulnerability that could impact more than a billion devices-vulnerability warning-the black bar safety net
Researchers find UC Browser in the presence of a vulnerable functional block can be exploited by attackers to perform MiTM attacks. Because the UC Browser using the HTTP Protocol to communicate with the server, the transmission information is not encrypted, so the would be attacker hook request...
CVE-2019-10251
The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...
Design/Logic Flaw
The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...
CVE-2019-10251
The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...
CVE-2019-10250
UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks...
CVE-2019-10251
The CVE-2019-10251 entry concerns the UCWeb UC Browser on Android (pre-2020) that downloads modules tied to PDF/Office processing via libpicsel over HTTP. This insecure HTTP traffic enables man‑in‑the‑middle attacks against module downloads, exposing users to potential data interception or tamper...