CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2005-0356

CVE-2005-0356 affects F5 BIG-IP BIG-IP LTM 9.0.0–9.0.5; other listed BIG-IP lines are not affected (e.g., 9.1.x, 9.2.x, 9.3.x, 9.4.x, 9.6.x are Not Affected). The issue is described as inadequate validation for TCP segments with PAWS/timestamps, enabling a remote attacker to cause a denial of ser...

CVE-2023-20259

CVE-2023-20259 concerns Cisco Unified Communications products exposing an unauthenticated API that can be abused to cause high CPU utilization and DoS, potentially impacting web management access and call processing. The issue arises from improper API authentication and incomplete validation of A...

CVE-2023-20101

Cisco Emergency Responder is affected by a vulnerability where an unauthenticated attacker can log in via the root account that uses default, static credentials. The issue comes from static root credentials that cannot be changed or deleted, enabling the attacker to log in and execute arbitrary c...

CVE-2017-12227

CVE-2017-12227 corresponds to a blind SQL injection in the Cisco Emergency Responder SQL database interface. The vulnerability arises from failure to validate user-supplied input used in SQL queries, allowing an authenticated, remote attacker to craft URLs containing SQL statements and potentiall...

CVE-2023-20266

CVE-2023-20266 affects Cisco Emergency Responder, Unified CM, Unified CM SME, and Cisco Unity Connection. The issue stems from improper restrictions on upgrade files, where a crafted upgrade package could enable an authenticated attacker with platform administrator credentials to elevate privileg...

CVE-2019-16025

CVE-2019-16025 affects Cisco Emergency Responder’s web-based management interface. The root cause is insufficient validation of user-supplied input in the web server, enabling an authenticated, remote attacker to perform a cross-site scripting (XSS) attack. Exploitation involves persuading a user...

CVE-2024-20352

Cisco Emergency Responder is affected by CVE-2024-20352, a directory traversal flaw in the web UI that can let an authenticated, remote attacker perform arbitrary actions on the device with the user’s privileges, including accessing password/log files and uploading/deleting files. The issue arise...

CVE-2021-1226

The CVE-2021-1226 issue affects Cisco UCM family (including Cisco Unified Communications Manager, Session Management Edition, IM&P Service, Unity Connection, Emergency Responder, and Prime License Manager). It arises from storing certain credentials in clear text within audit logs, enabling an au...

CVE-2024-20347

Cisco Emergency Responder is affected by a cross-site request forgery (CSRF) vulnerability in the web UI that, together with insufficient protections, could allow an unauthenticated or user-privileged actor to perform arbitrary actions on the device when a user visits a crafted link. The root cau...

CVE-2017-12337

CVE-2017-12337 affects Cisco Voice Operating System (Voice OS) upgrade mechanisms. A refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration can leave an engineering flag enabled after completion, potentially allowing an unauthenticated attacker to gain root access with a known pas...

CVE-2008-1154

The CVE-2008-1154 issue affects Cisco Unified Communications products featuring Disaster Recovery Framework (DRF). The DRF Master server accepts network requests without authentication, allowing a remote, unauthenticated attacker to perform DRF tasks and, per the sources, potentially execute arbi...

CVE-2017-6779

CVE-2017-6779 affects multiple Cisco VOS-based products (Emergency Responder, Finesse, UCM family, Unity Connection, UIC, SME, UCCx, MediaSense, Prime products, and related). Root cause: system log file has no maximum size limit, enabling an unauthenticated, remote attacker to cause high disk uti...

CVE-2015-6400

Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability (CVE-2015-6400) affects Cisco Emergency Responder 10.5(1a). The issue is a stored XSS flaw caused by insufficient validation on input fields in the web framework, allowing an unauthenticated, remote attacker to inject and ...

CVE-2018-15403

CVE-2018-15403 describes an open redirect vulnerability in Cisco Emergency Responder (CER) and related Cisco Unified Communications products (CER, UCM, UCM IM&P, Unity Connection). The issue stems from improper input validation of HTTP request parameters in the web interface, enabling an authenti...

CVE-2004-1759

Cisco voice products running the IBM Director Agent on IBM servers prior to OS 2000.2.6 are affected by CVE-2004-1759. The issue allows remote attackers to cause a denial of service (CPU consumption) by sending arbitrary packets to TCP port 14247, demonstrated via port scanning. The provided docu...

CVE-2014-2116

Cisco Emergency Responder (ER) 8.6 and earlier is affected by CVE-2014-2116 due to insufficient input validation in the web interface. An unauthenticated, remote attacker could inject web pages and modify dynamic content by exploiting parameters in the web UI (Web page injection). This is documen...

CVE-2015-6405

CVE-2015-6405 is a CSRF vulnerability in Cisco Emergency Responder (web framework) affecting version 10.5(1) and 10.5(1a). The issue arises from insufficient CSRF protection, allowing an unauthenticated, remote attacker to perform actions with a user’s privileges by tricking them into visiting a ...

CVE-2015-6406

CVE-2015-6406 describes a directory traversal vulnerability in Cisco Emergency Responder’s Tools menu. Affected software is Cisco Emergency Responder 10.5(1.10000.5). The root cause is improper sanitization of user-supplied input that forms a filename, allowing authenticated, remote attackers to ...

CVE-2004-1760

The CVE-2004-1760 entry covers unauthenticated remote admin access on Cisco voice products running the IBM Director Agent on IBM servers before OS 2000.2.6. The vulnerability allows an attacker to gain administrator privileges by connecting to TCP port 14247. The description specifies the affecte...

CVE-2015-6407

Cisco Emergency Responder 10.5(3.10000.9) is affected by a Web Framework Arbitrary File Upload vulnerability. The issue stems from insufficient parameter validation in the CER web framework, allowing unauthenticated remote attackers to upload arbitrary files to arbitrary locations on the device v...

CVE-2014-2117

CVE-2014-2117 affects Cisco Emergency Responder (ER) 8.6 and earlier. The issue arises from insufficient input validation in the ER web interface, enabling open redirects to arbitrary sites via crafted parameters. This could allow remote, unauthenticated attackers to funnel users to phishing page...

CVE-2012-1346

Summary (CVE-2012-1346): Cisco Emergency Responder versions 8.6 and 9.2 are vulnerable to a remote DoS via malformed UDP packets sent to the CERPT port, due to improper handling. The issue can cause CPU exhaustion and potentially affect availability. Cisco and Red Hat/NVD references confirm the v...

CVE-2014-2114

CVE-2014-2114 concerns a cross-site scripting (XSS) vulnerability in the Cisco Emergency Responder (ER) software, specifically the UserServlet, affecting 8.6 and earlier. The issue stems from insufficient input validation on a parameter, allowing an unauthenticated, remote attacker to inject arbi...

CVE-2014-2115

CVE-2014-2115 affects Cisco Emergency Responder (ER) CERUserServlet pages in ER 8.6 and earlier. The root cause is insufficient CSRF protections, enabling unauthenticated, remote attackers to abuse an authenticated user’s session to perform unauthorized actions. Impact is session hijacking via CS...

CVE-2016-9208

This CVE affects Cisco Emergency Responder: the vulnerability arises from improper sanitization of user-supplied HTTP POST parameters that describe filenames in the File Management Utility, the Download File form, and the Serviceability application. An authenticated, remote attacker could travers...

CVE-2016-6468

The CVE-2016-6468 issue affects Cisco Emergency Responder’s web-based management interface. A CSRF vulnerability could allow an unauthenticated, remote attacker to perform arbitrary actions on an affected device due to insufficient CSRF protections. Known affected release: 11.5(1.10000.4); known ...