CVE-2023-20265

CVE-2023-20265 is a stored XSS vulnerability in the web-based management interface of a subset of Cisco IP Phones. Root cause: insufficient validation of user-supplied input; an authenticated, remote attacker needs valid credentials to lure a user into viewing a page containing malicious HTML/scr...

CVE-2020-3574

CVE-2020-3574 affects Cisco IP Phones, where the TCP packet processing path is vulnerable due to insufficient TCP ingress packet rate limiting. An unauthenticated remote attacker can send a high, sustained rate of crafted TCP traffic to disrupt operations, causing calls to stop, drop, or the devi...