CVE-2015-0699

SQL injection vulnerability in the Interactive Voice Response IVR component in Cisco Unified Communications Manager UCM 10.51.98991.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563...

CVE-2015-0684

SQL injection vulnerability in the Image Management component in Cisco Unified Communications Domain Manager 8.14 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq52515...

CVE-2014-3363

Cross-site scripting XSS vulnerability in the web framework in Cisco Unified Communications Manager UCM 9.12.10000.28 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443...

CVE-2014-3363

CVE-2014-3363 is an XSS vulnerability in Cisco Unified Communications Manager (UCM) web framework, affecting version 9.1(2.10000.28). It allows an authenticated, remote attacker to inject arbitrary web script or HTML via an unspecified parameter. The root cause is insufficient validation of the p...

Cisco Patches Hardcoded SSH Key Vulnerability in UCM

The Cisco Unified Communications Domain Manager contains a default private SSH key that could allow an attacker to run arbitrary code on vulnerable installations. The bug is about as serious as they come, giving remote, unauthenticated attackers access to affected machines with the rights of a ro...

Cisco Unified Communications Manager Java类文件信息泄漏漏洞

Bugtraq ID:65644 CVE ID:CVE-2014-0731 Cisco Unified Communications Manager是一款Cisco IP电话解决方案中的呼叫处理组件。 Cisco Unified Communications Manager管理接口不正确执行正确的验证，允许远程攻击者利用漏洞访问UCM管理接口中特定的URL，未授权访问部分Java类文件。 0 Cisco Unified Communications Manager 10.01.10000.3 目前没有详细解决方案提供：...

CVE-2014-0722

The log4jinit web application in Cisco Unified Communications Manager UCM does not properly validate authentication, which allows remote attackers to cause a denial of service performance degradation via unspecified use of this application, aka Bug ID CSCum05347...

CVE-2014-0727

SQL injection vulnerability in the CallManager Interactive Voice Response CMIVR interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318...

CVE-2014-0728

SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313...

CVE-2014-0725

Cisco Unified Communications Manager UCM does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337...

Sql injection

SQL injection vulnerability in the CallManager Interactive Voice Response CMIVR interface in Cisco Unified Communications Manager UCM allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05318...

Authentication flaw

Cisco Unified Communications Manager UCM does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337...

Authentication flaw

The log4jinit web application in Cisco Unified Communications Manager UCM does not properly validate authentication, which allows remote attackers to cause a denial of service performance degradation via unspecified use of this application, aka Bug ID CSCum05347...

CVE-2014-0726

Cisco Unified Communications Manager IP Manager Assistant (IPMA) suffers a blind SQL injection vulnerability that allows remote, unauthenticated attackers to execute arbitrary SQL via crafted URLs. Affected product/version: UCM 10.0(1) and earlier; root cause is lack of input validation within SQ...

CVE-2014-0725

CVE-2014-0725 affects Cisco Unified Communications Manager (UCM). A vulnerability due to missing authentication allows an unauthenticated, remote attacker to access WAR files stored in a file storage location, potentially exposing sensitive information contained in those files. Cisco’s advisory n...

CVE-2014-0728

Cisco Unified Communications Manager (UCM) Java database interface is affected by a SQL injection vulnerability in versions 10.0(1) and earlier. Root cause: failure to validate user-supplied input used to construct SQL queries, allowing remote attackers to execute arbitrary SQL via crafted URLs (...

CVE-2014-0724

Cisco Unified Communications Manager (UCM) bulk administration interface (affected: 10.0(1) and earlier) is affected by an authentication bypass leading to arbitrary file read via an unspecified prompt. Root cause: insufficient input validation in the bulk admin prompt flow. Impact: authenticated...

CVE-2014-0729

Cisco’s advisory confirms a Blind SQL Injection in the Enterprise Mobility Application (EMApp) interface of Cisco Unified Communications Manager (UCM). The root cause is a failure to validate user-supplied input used to build SQL queries, enabling an unauthenticated, remote attacker to exfiltrate...

CVE-2014-0722

The CVE-2014-0722 issue affects Cisco Unified Communications Manager (UCM) log4jinit web application, where insufficient authentication validation allows an unauthenticated, remote attacker to access the log4jinit web app and cause denial of service via performance degradation. Impact is noted as...

CVE-2014-0728

SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager UCM 10.01 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313...