Cisco Unity Connection目录遍历漏洞

Bugtraq ID:66676 CVE ID:CVE-2014-2145 Cisco Unity Connection 可以透明地将留言和语音识别组件与您的数据网络集成到一起，不间断地提供对呼叫和留言的全面访问。 Cisco Unity Connection的消息传送API在实现上存在目录遍历漏洞，这可使经过身份验证的远程用户通过.wav文件和audio/x-wav MIME类型的访问限制，利用此漏洞读取任意文件。 0 Cisco Unity Connection 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

Cisco Unity Connection Directory Traversal Vulnerability

A vulnerability in the messaging API of Cisco Unity Connection could allow an authenticated, remote attacker to execute a directory traversal and download arbitrary files that match the allowed MIME types. The vulnerability occurs because there is insufficient input filtering and file types other...

CVE-2014-2145

Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071...

Directory traversal

Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071...

CVE-2014-2145

Cisco Unity Connection contains a directory traversal vulnerability in its messaging API (CVE-2014-2145). An authenticated, remote attacker can read arbitrary files by exploiting insufficient input filtering and relaxed restrictions on file types beyond .wav, via the audio/x-wav MIME type. Impact...

CVE-2014-2145

Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related to unenforced access constraints for .wav files and the audio/x-wav MIME type, aka Bug ID CSCun91071...

CVE-2014-2125

Cross-site scripting XSS vulnerability in the Web Inbox in Cisco Unity Connection 8.62aSU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web Inbox in Cisco Unity Connection 8.62aSU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028...

CVE-2014-2125

Cross-site scripting XSS vulnerability in the Web Inbox in Cisco Unity Connection 8.62aSU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028...

CVE-2014-2125

Cisco Unity Connection Web Inbox v8.6(2a)SU3 and earlier are affected by a cross-site scripting (XSS) vulnerability caused by insufficient input validation on a web inbox parameter. An unauthenticated, remote attacker could lure a user to a crafted link, allowing execution of arbitrary HTML/JavaS...

Cisco Unity Connection Web Inbox跨站脚本漏洞

CVE ID:CVE-2014-2125 Cisco Unity Connection是运行在Linux-based Cisco Unified Communications操作系统上的功能强大的语音消息通讯平台。 由于某些关于网页收件箱的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML 和脚本代码。 0 Cisco Unity Connection 8.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

Cisco Unity Connection Cross-Site Scripting Vulnerability

A vulnerability in Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of a parameter. An attacker could exploit this vulnerability by persuading a user to access a...

Cisco Unity Connection Internet Message Access Protocol Denial of Service Vulnerability

A vulnerability in the Internet Message Access Protocol IMAP function of Cisco Unity Connection could allow an authenticated, remote attacker to cause 100 percent CPU utilization on the Cisco Unity Connection server, which may cause a denial of service DoS condition. The vulnerability is due to t...

CVE-2014-0664

The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service CPU consumption via unspecified IMAP commands, aka Bug ID CSCul49976...

Code injection

The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service CPU consumption via unspecified IMAP commands, aka Bug ID CSCul49976...

CVE-2014-0664

CVE-2014-0664 affects Cisco Unity Connection. The issue is an IMAP DoS where an authenticated, remote attacker can cause 100% CPU by issuing specific IMAP commands due to how IMAP commands are processed. Cisco’s advisory states the vulnerability can be mitigated by applying the provided software ...

CVE-2014-0664

The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service CPU consumption via unspecified IMAP commands, aka Bug ID CSCul49976...

CVE-2013-5534

Directory traversal vulnerability in the attachment service in the Voice Message Web Service aka VMWS or Cisco Unity Web Service in Cisco Unity Connection allows remote authenticated users to create files, and consequently execute arbitrary JSP code, via a crafted pathname for a file that is not ...

Directory traversal

Directory traversal vulnerability in the attachment service in the Voice Message Web Service aka VMWS or Cisco Unity Web Service in Cisco Unity Connection allows remote authenticated users to create files, and consequently execute arbitrary JSP code, via a crafted pathname for a file that is not ...

CVE-2013-5534

CVE-2013-5534 concerns Cisco Unity Connection’s VMWS attachment service. A directory traversal flaw in the VMWS/Nube (Voice Message Web Service) allows an authenticated remote user to craft file names that bypass validation, enabling placement of attacker-controlled files and, in some cases, arbi...