CVE-2017-6779

CVE-2017-6779 affects multiple Cisco VOS-based products (Emergency Responder, Finesse, UCM family, Unity Connection, UIC, SME, UCCx, MediaSense, Prime products, and related). Root cause: system log file has no maximum size limit, enabling an unauthenticated, remote attacker to cause high disk uti...

CVE-2017-12337

CVE-2017-12337 affects Cisco Voice Operating System (Voice OS) upgrade mechanisms. A refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration can leave an engineering flag enabled after completion, potentially allowing an unauthenticated attacker to gain root access with a known pas...

CVE-2015-0736

Cisco MediaSense is affected by a Cross‑Site Request Forgery (CSRF) vulnerability in version 10.5(1) and earlier. The root cause is insufficient CSRF protections on the web interface, enabling an attacker to hijack the authentication of an authenticated user and perform actions in that user’s con...

CVE-2014-0670

Cisco MediaSense is affected by a Cross-Site Scripting (XSS) vulnerability in the Search and Play interface (CVE-2014-0670). The root cause is insufficient input validation of a parameter, enabling an unauthenticated, remote attacker to inject arbitrary web script or HTML by luring a user to a ma...

CVE-2014-0672

The CVE-2014-0672 issue affects Cisco MediaSense: the Search and Play interface does not properly enforce authorization, allowing an authenticated remote attacker to download arbitrary recordings. Root cause is insufficient authorization controls on the Search and Play interface. Impact is access...

CVE-2013-5501

Cisco MediaSense is affected by a cross-site scripting (XSS) vulnerability in the oraservice page. The issue stems from insufficient input validation of a parameter, allowing an unauthenticated, remote attacker to execute arbitrary script or HTML in a user’s browser via a crafted link. Cisco’s ad...

CVE-2013-5502

Summary: The Cisco MediaSense web interface contains a vulnerability where the client–server communication is not properly protected, allowing an unauthenticated, remote attacker to collect sensitive information (e.g., query strings and cookies) by intercepting traffic. This is due to an insecure...

CVE-2014-0671

Cisco MediaSense contains an open redirect vulnerability exploitable by an unauthenticated, remote attacker due to insufficient input validation in a specific URL parameter. An attacker can craft a link directing users to a malicious site, enabling phishing attempts. The Cisco advisory notes no s...

CVE-2013-5500

Cisco MediaSense CVE-2013-5500 describes multiple XSS vulnerabilities in the oraadmin web page. The issue stems from insufficient input validation on a parameter, enabling an unauthenticated, remote attacker to conduct cross-site scripting against users of the web interface. Exploitation involves...