355 matches found
CVE-2019-19865
Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored XSS payload...
Cross site scripting
Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored XSS payload...
CVE-2019-19865
CVE-2019-19865 affects Atos Unify OpenScape UC Application: V9 (before R4.31.0) and V10 (before R0.6.0). The vulnerability is a stored XSS in the Profile Name field that can be triggered when an authenticated user is convinced to inject arbitrary JavaScript, leading to execution in the user’s bro...
CVE-2019-19866
Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with...
CVE-2019-19866
CVE-2019-19866 affects Atos Unify OpenScape UC Web Client: OpenScape UC Web Client V9 before R4.31.0 and V10 before R0.6.0 are vulnerable. An attacker can enumerate all scheduled conferences by iterating conferenceId in the JSON API getMailFunction, exposing conference numbers and access PINs. Th...
Command injection
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...
Directory traversal
Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...
CVE-2012-6609
Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...
CVE-2012-6610
CVE-2012-6610 affects Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J. The vulnerability is a command injection that allows remote authenticated users to execute arbitrary commands via the ping feature, demonstrated by using a semicolon to inject commands. Evidence from multip...
Cisco Unified Communications Manager Cross-Site Request Forgery (XSRF) Vulnerability (cisco-sa-20191002-cucm-csrf)
According to its self-reported version, Cisco Unified Communications Manager is affected by a cross-site request forgery XSRF vulnerability exists in its web application interface component due to insufficient XSRF protections. A remote attacker can exploit this by tricking a user into visiting a...
Arbitrary Deletion Vulnerability in HongCMS v4.0 uc_a***.php File
HongCMS is an open source lightweight content management system CMS. HongCMS v4.0 uca.php file contains an arbitrary deletion vulnerability. An attacker can exploit the vulnerability to delete arbitrary files, resulting in a system reinstallation...
Huawei eSpace 1.1.11.103 - DLL Hijacking
/ Huawei eSpace Desktop DLL Hijacking Vulnerability Vendor: Huawei Technologies Co., Ltd. Product web page: https://www.huawei.com Affected version: eSpace 1.1.11.103 aka eSpace ECS, eSpace Desktop, eSpace Meeting, eSpace UC Summary: Create more convenient Enhanced Communications EC services for...
Unpatched Flaw in UC Browser Apps Could Let Hackers Launch Phishing Attacks
A bug hunter has discovered and publicly disclosed details of an unpatched browser address bar spoofing vulnerability that affects popular Chinese UC Browser and UC Browser Mini apps for Android. Developed by Alibaba-owned UCWeb, UC Browser is one of the most popular mobile browsers, specifically...
Unpatched Flaw in UC Browser Apps Could Let Hackers Launch Phishing Attacks
A bug hunter has discovered and publicly disclosed details of an unpatched browser address bar spoofing vulnerability that affects popular Chinese UC Browser and UC Browser Mini apps for Android. Developed by Alibaba-owned UCWeb, UC Browser is one of the most popular mobile browsers, specifically...
Alibaba Group UC Browser application for Android encryption issue vulnerability
Alibaba Group UC Browser application for Android is a mobile browser based on the Android platform from China's Alibaba Group Alibaba Group. A security vulnerability exists in the 2019-03-26 and earlier versions of the UCWeb UC Browser application for Android-based platforms. An attacker can...
UC Browser is the presence of man in the middle attacks(MITM)vulnerability that could impact more than a billion devices-vulnerability warning-the black bar safety net
Researchers find UC Browser in the presence of a vulnerable functional block can be exploited by attackers to perform MiTM attacks. Because the UC Browser using the HTTP Protocol to communicate with the server, the transmission information is not encrypted, so the would be attacker hook request...
Design/Logic Flaw
The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...
CVE-2019-10251
The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files related to libpicsel, which allows MITM attacks...