CVE-2022-20917

CVE-2022-20917 describes a vulnerability in the XMPP message processing feature of Cisco Jabber. The issue arises from improper handling of nested XMPP messages in requests, enabling an authenticated, remote attacker to manipulate the content of XMPP messages used by the Jabber client and potenti...

CVE-2020-3495

CVE-2020-3495 affects Cisco Jabber for Windows. The vulnerability stems from improper validation of message contents in XMPP/XHTML-IM handling, allowing an authenticated remote attacker to execute arbitrary code by sending specially crafted messages. Exploitation could run code with the user’s pr...

CVE-2020-26085

CVE-2020-26085 and related Cisco Jabber vulnerabilities affect Cisco Jabber Desktop and Mobile Client (Windows, macOS, and mobile). The connected sources describe multiple flaws that could allow an attacker to execute arbitrary code or access sensitive information on the underlying OS, with netwo...

CVE-2019-12645

CVE-2019-12645 concerns Cisco Jabber Client Framework (JCF) for Mac Software used by Cisco Jabber for Mac. Exploitation requires an authenticated, local attacker and relies on improper file-level permissions on the host running JCF for Mac, enabling arbitrary code execution or modification of con...

CVE-2019-1855

Cisco Jabber for Windows DLL Preloading Vulnerability (CVE-2019-1855) affects Jabber for Windows where insufficient validation of loaded resources allows a local, authenticated attacker to preload a malicious DLL and achieve arbitrary code execution when Jabber launches. Exploitation requires cra...

CVE-2021-1411

Cisco Jabber for Windows, macOS, and mobile platforms is affected by multiple vulnerabilities (CVE-2021-1411) that could allow remote attackers to execute arbitrary code with the user’s privileges, access sensitive data, intercept network traffic, or cause a Denial of Service. Affected products i...

CVE-2020-3430

CVE-2020-3430 – Cisco Jabber for Windows Protocol Handler Command Injection : A vulnerability in the application protocol handling features allows an unauthenticated, remote attacker to execute arbitrary commands by convincing a user to click a crafted link in a message. It arises from improper i...

CVE-2021-1471

Cisco Jabber for Windows, macOS, and mobile platforms were affected by multiple vulnerabilities leading to possible remote code execution with the user’s privileges, access to sensitive data, interception of protected traffic, or DoS. Cisco notes these originate from Cisco Jabber components and h...

CVE-2020-3537

Cisco Jabber for Windows contains a vulnerability (CVE-2020-3537) caused by improper validation of message contents. An authenticated, remote attacker can exploit this by sending specially crafted UNC-containing messages to a targeted user, persuading them to open the link and causing the applica...

CVE-2020-3155

CVE-2020-3155 is a Cisco Intelligent Proximity SSL certificate validation vulnerability. The issue stems from a lack of validation of the SSL server certificate when establishing connections to Cisco Webex video devices or Cisco collaboration endpoints. An unauthenticated, remote attacker could p...

CVE-2020-3498

CVE-2020-3498 is a Cisco Jabber for Windows information-disclosure vulnerability. The issue arises from improper validation of message contents, allowing an authenticated, remote attacker to cause the application to return sensitive authentication information to another system by sending speciall...

CVE-2021-1418

CVE-2021-1418 affects Cisco Jabber Desktop and Mobile Client Software (Windows, macOS, and mobile). The connected sources confirm multiple vulnerabilities that could allow remote code execution with elevated privileges, access to sensitive data, interception of protected traffic, or DoS. Affected...

CVE-2021-1417

CVE-2021-1417 covers multiple vulnerabilities in Cisco Jabber Desktop and Mobile Client software (for Windows, macOS, and mobile platforms) that could allow an attacker to execute arbitrary code, access sensitive information, intercept network traffic, or cause a DoS. The Cisco advisory notes the...

CVE-2021-1570

Cisco Jabber Desktop and Mobile Client vulnerabilities (CVE-2021-1570) affect Cisco Jabber for Windows, macOS, and mobile platforms and arise from improper validation of message content in XMPP processing. Exploitation could disclose sensitive information or trigger a DoS. Cisco’s advisory (CISCO...

CVE-2017-12356

CVE-2017-12356 affects Cisco Jabber web-based management interfaces across Windows, Mac, Android and iOS. The issue stems from insufficient input validation in the web UI, enabling an unauthenticated, remote attacker to entice a user to click a crafted link and execute arbitrary script in the int...

CVE-2018-0199

CVE-2018-0199 affects Cisco Jabber Client Framework (JCF) for Windows and Mac. The issue is improper neutralization of scripts in attributes in a web page, enabling an unauthenticated, remote attacker to execute arbitrary JavaScript in the Jabber client and potentially achieve remote code executi...

CVE-2021-1469

Cisco Jabber CVE-2021-1469 entails multiple vulnerabilities in Cisco Jabber for Windows, macOS, and mobile clients that could allow an attacker to execute arbitrary code with the user’s privileges, access sensitive information, intercept protected network traffic, or cause a DoS. The Cisco adviso...

CVE-2021-1569

Cisco Jabber for Windows, along with Jabber for Mac and mobile, is affected by CVE-2021-1569 due to improper validation of message content in XMPP handling. This can allow an authenticated, remote attacker to access sensitive information (information disclosure) or cause a denial of service (DoS)...

CVE-2020-27127

CVE-2020-27127 affects Cisco Jabber Desktop and Mobile Client across Windows, macOS and mobile platforms. The root cause is a command-injection vulnerability in protocol handlers (e.g., XMPP/U RL URLs) that could let an unauthenticated/remote attacker cause arbitrary commands to run with the user...

CVE-2017-12358

Cisco Jabber’s web-based management interface (Windows, Mac, Android, iOS) contains an XSS vulnerability due to insufficient input validation. An authenticated, remote attacker could entice a user to click a malicious link, potentially executing arbitrary script code in the interface or accessing...

CVE-2018-0201

CVE-2018-0201 is a cross-site scripting vulnerability in Cisco Jabber Client Framework (JCF). The issue arises from improper neutralization of input during web page generation, enabling an authenticated, remote attacker to trigger XSS by embedding media in instant messages. The exploit could caus...

CVE-2020-27134

CVE-2020-27134 affects Cisco Jabber Desktop and Mobile Client (Windows, MacOS, and mobile) and is caused by improper validation of message contents, enabling an authenticated remote attacker to inject scripts and potentially execute arbitrary commands on the target system with user privileges. Ci...

CVE-2020-27133

CVE-2020-27133 is a Cisco Jabber Desktop and Mobile Client vulnerability family affecting Cisco Jabber for Windows, MacOS, and mobile platforms. The CVE entries arise from multiple issues in message handling and input validation: CVE-2020-26085 (XMPP message handling leading to remote code execut...

CVE-2017-12284

The CVE-2017-12284 issue affects Cisco Jabber for Windows Client (web interface). Affected component: the web interface of Cisco Jabber for Windows. Root cause: insufficient input and validation checks that allow an authenticated, local attacker to issue commands and view profile information beyo...

CVE-2020-27132

Cisco Jabber Desktop and Mobile Client (Windows, MacOS, and mobile platforms) has multiple CVEs (notably 26085, 27132, 27133, 27134, 27127) tied to the 12.1–12.9 release family. The issues include: a zero-click cross-site scripting path that can escape the Chromium sandbox to achieve remote code ...

CVE-2018-0483

Cisco Jabber Client Framework (JCF) XSS vulnerability (CVE-2018-0483) arises from insufficient validation of user-supplied input, enabling an authenticated, remote attacker to run arbitrary JavaScript in the recipient’s Jabber client and potentially access client data. Affected software is Cisco ...

CVE-2017-12286

Cisco Jabber web interface vulnerability (CVE-2017-12286) allows an authenticated, local attacker to retrieve full user profile information due to insufficient input/validation checks. Affected releases are all Cisco Jabber versions prior to 1.9.31. Exploitation requires local authentication and ...

CVE-2017-12361

Cisco Jabber for Windows contains an information-disclosure vulnerability where an unauthenticated, local attacker can access sensitive communications by manipulating the RNG data used in SSL handshakes. The root cause is how random numbers are generated for SSL connections between Jabber clients...

CVE-2013-1228

CVE-2013-1228 affects Cisco Jabber for Windows. The root cause is a failure to validate X.509 server certificates during SSL, enabling MITMattacks to spoof servers and modify the client–server data stream. Cisco’s advisory confirms a vulnerability in the Windows client and notes impacted software...

CVE-2018-0449

Cisco Jabber Client Framework (JCF) in the Cisco Jabber for Mac client is affected. The root cause is insecure directory permissions on a JCF-created directory, enabling an authenticated local attacker who can access that directory to create a hard link to an arbitrary location, potentially creat...

CVE-2013-3393

The CVE-2013-3393 issue affects Cisco’s Precision Video Engine used by Cisco Jabber for Windows and Cisco Virtualization Experience Media Engine. The root cause is improper handling of crafted RTP packets, which can be sent remotely to trigger a denial of service, causing process crashes and disc...

CVE-2015-4218

Cisco Jabber for Windows (web-based UI) is vulnerable to information disclosure via a crafted value in an HTTP GET request for versions 9.6(3) and 9.7–9.7(5). The root cause is insufficient validation of GET parameters, allowing remote attackers to obtain sensitive information. Affected product: ...

CVE-2015-6409

Cisco Jabber for Windows (affected: 10.6.x, 11.0.x, 11.1.x) is vulnerable to a STARTTLS downgrade in XMPP due to improper verification of TLS, enabling MITM to force cleartext XMPP sessions. Exploitation details are not provided in the sources. Cisco indicates software updates will address the vu...

CVE-2014-0666

Cisco Jabber for Windows is affected by a directory traversal vulnerability in the Send Screen Capture feature (CVE-2014-0666). Affected: Jabber for Windows 9.x before 9.2(2) (Windows). Root cause: input validation issue in the Send Screen Capture flow that could traverse directories and write ar...