CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2021-1254

Cisco Finesse’s web-based management interface contains cross-site scripting (XSS) vulnerabilities due to insufficient validation of user-supplied input. An authenticated attacker with administrator credentials can inject malicious scripts, potentially persuading users to click malicious links an...

CVE-2024-20404

CVE-2024-20404 affects Cisco Finesse web-based management interface. The issue is an SSRF caused by insufficient validation of user-supplied input in HTTP requests sent to the device. An unauthenticated, remote attacker can exploit crafted HTTP requests to obtain limited sensitive information fro...

CVE-2023-20088

The vulnerability CVE-2023-20088 affects Cisco Finesse’s VPN-less reverse proxy, where the nginx-based reverse proxy improperly filters IP addresses. An unauthenticated, remote attacker can send crafted requests via the load balancer to cause a denial of service (DoS) for current and new users, a...

CVE-2024-20405

CVE-2024-20405 affects Cisco Finesse, specifically the web-based management interface. The flaw arises from insufficient input validation for HTTP requests, enabling an unauthenticated, remote attacker to perform a stored XSS by exploiting a remote file inclusion (RFI) vulnerability. A crafted li...

CVE-2021-1245

The CVE-2021-1245 entry concerns Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor. The connected Cisco advisory sources confirm an XSS vulnerability in the web-based management interface caused by improper input validation. An unauthenticated, remote attacker can lure a user to click ...

CVE-2020-3159

CVE-2020-3159 affects Cisco Finesse: a cross-site scripting vulnerability in the Web-based management interface due to insufficient validation of user-supplied input. An unauthenticated, remote attacker could entice a user to click a crafted link and execute script code within the interface conte...

CVE-2021-1246

Cisco CVE-2021-1246 refers to an unauthenticated access vulnerability in the web management interfaces of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor. The issue arises from missing authentication in a particular section of the web-based managemen...