CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2022-20802

The CVE-2022-20802 vulnerability affects Cisco Enterprise Chat and Email (ECE) Web Interface. A cross-site scripting (XSS) flaw arises from insufficient validation of user-supplied input processed by the web interface, enabling an authenticated, remote attacker with agent credentials to potential...

CVE-2022-20631

Cisco Enterprise Chat and Email (ECE) exposes a cross-site scripting (XSS) vulnerability in its web-based management interface. An unauthenticated, remote attacker could inject malicious script via the chat window due to improper input validation, potentially executing code in the interface conte...

CVE-2025-20139

CVE-2025-20139 – Cisco Enterprise Chat and Email (ECE) vulnerabilities arise from improper validation of input at chat entry points, enabling an unauthenticated, remote attacker to cause a DoS. Exploitation involves sending malicious requests to the affected chat entry point, potentially making t...

CVE-2022-20633

Cisco ECE (Enterprise Chat and Email) web-based management interface is affected by CVE-2022-20633. The issue arises from differences in authentication responses during login, enabling unauthenticated remote attackers to perform username enumeration and confirm existing user accounts. The vulnera...

CVE-2022-20632

Cisco Enterprise Chat and Email (ECE) web-based management interface vulnerability (CVE-2022-20632) allows an unauthenticated, remote attacker to perform a reflected XSS by enticing a user to click a crafted link. The issue arises from inadequate validation of user-supplied input in the interface...

CVE-2019-1870

CVE-2019-1870 describes a cross-site scripting (XSS) vulnerability in Cisco Enterprise Chat and Email (ECE) Center’s web-based management interface. The issue stems from insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to persuade a user to click a craf...

CVE-2022-20634

Cisco Enterprise Chat and Email (ECE) Web-based management interface vulnerability (CVE-2022-20634) allows an unauthenticated, remote attacker to cause user redirection to a malicious URL via crafted links. Root cause: improper input validation of URL parameters in HTTP requests. Affects Cisco EC...

CVE-2024-20367

Cisco Enterprise Chat and Email (ECE) web UI vulnerability (CVE-2024-20367) enables authenticated, remote XSS due to improper input validation. An attacker must coerce a user to click a crafted link, potentially executing arbitrary script in the UI or accessing browser data. Impact is limited to ...

CVE-2024-20484

CVE-2024-20484 affects Cisco Enterprise Chat and Email (ECE) External Agent Assignment Service (EAAS). The root cause is insufficient validation of MR PIM traffic, allowing an unauthenticated remote attacker to trigger a MR PIM connection failure between ECE and Cisco Unified Contact Center Enter...

CVE-2019-1877

Cisco Enterprise Chat and Email contains an HTTP API vulnerability in the file-download function due to insufficient authentication, allowing unauthenticated, remote attackers to download files attached in chat sessions. A crafted request to the API can exfiltrate files from other users. Affected...

CVE-2019-1702

Cisco Enterprise Chat and Email suffers cross-site scripting (XSS) in its web-based management interface due to insufficient input validation. An unauthenticated attacker could lure a user to click a crafted link or open a chat window containing malicious code, potentially executing script in the...

CVE-2025-20310

CVE-2025-20310 : Cisco Enterprise Chat and Email (ECE) web UI vulnerability where input in the interface is not properly validated, enabling a stored XSS attack. An unauthenticated, remote attacker could lure a user to click a crafted link, potentially executing arbitrary script in the user’s bro...