CVE-2020-3193

CVE-2020-3193 concerns Cisco Prime Collaboration Provisioning; the web-based management interface reveals unnecessary server information in responses, allowing unauthenticated remote attackers to obtain details about the OS and web server version. Root cause: information disclosure via standard i...

CVE-2021-34732

Cisco Prime Collaboration Provisioning’s web-based management interface is vulnerable to cross-site scripting (XSS) due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can coax a user to click a crafted link, allowing arbitrary script execution within the us...

CVE-2017-12276

Cisco Prime Collaboration Provisioning (before v12.3) is affected by an authenticated SQL injection in the web framework’s SQL database interface (CVE-2017-12276). Exploitation requires valid user credentials and can lead to disclosure/integrity impact by executing arbitrary SQL queries through c...

CVE-2015-6329

CVE-2015-6329 corresponds to a SQL injection vulnerability in Cisco Prime Collaboration Provisioning (PCP). The issue affects PCP 10.6.x and 11.0.x prior to 11.0.0.815 (per Nessus) and Cisco’s advisory describes an authenticated, remote attacker able to execute unauthorized SQL queries via the we...

CVE-2020-3184

The CVE-2020-3184 entry relates to Cisco Prime Collaboration Provisioning Software. The vulnerability exists in the web-based management interface where input for certain SQL queries is not properly validated. An authenticated attacker with valid admin credentials could exploit this to perform SQ...

CVE-2020-3192

CVE-2020-3192 affects Cisco Prime Collaboration Provisioning web-based management interface. Root cause: insufficient validation of user-supplied input enabling cross-site scripting (XSS). An unauthenticated, remote attacker could entice a user to click a crafted link to execute arbitrary script ...

CVE-2018-0321

CVE-2018-0321 describes an unauthenticated remote access vulnerability in Cisco Prime Collaboration Provisioning (PCP) caused by an open port in the Network Interface and Configuration Engine (NICE) that exposes the Java RMI system. A remote attacker could access the RMI interface on affected PCP...

CVE-2018-0204

CVE-2018-0204 affects the Cisco Prime Collaboration Provisioning Tool web portal. The root cause is weak login controls, enabling an unauthenticated, remote attacker to perform brute-force login attempts that can restrict user access and cause a DoS condition for individual users. The impact is r...

CVE-2017-6779

CVE-2017-6779 affects multiple Cisco VOS-based products (Emergency Responder, Finesse, UCM family, Unity Connection, UIC, SME, UCCx, MediaSense, Prime products, and related). Root cause: system log file has no maximum size limit, enabling an unauthenticated, remote attacker to cause high disk uti...

CVE-2018-0141

Cisco Prime Collaboration Provisioning (PCP) Software 11.6 is affected by CVE-2018-0141, a hard-coded SSH password vulnerability that allows an unauthenticated, local attacker to log into the PCP host and gain low-privilege OS access, then escalate to root privileges. The issue stems from a hard-...

CVE-2017-6622

Cisco Prime Collaboration Provisioning ScriptMgr HEAD request vulnerability (CVE-2017-6622) affects PCP versions prior to 12.1. A remote, unauthenticated attacker can bypass authentication via crafted HEAD requests to the ScriptMgr servlet and achieve remote code execution with root privileges. T...

CVE-2018-0317

CVE-2018-0317 concerns Cisco Prime Collaboration Provisioning (PCP) web interface authentication/authorization. The issue, present in PCP Releases 12.2 and earlier, stems from insufficient web portal access control checks, enabling an authenticated, remote attacker to modify an access request and...

CVE-2017-6621

CVE-2017-6621 affects Cisco Prime Collaboration Provisioning web interface, where an unauthenticated attacker can disclose sensitive data via crafted HTTP responses due to insufficient protection of data in replies. It impacts Cisco Prime Collaboration Provisioning software releases 10.6–11.5. Co...

CVE-2018-0322

CVE-2018-0322 affects Cisco Prime Collaboration Provisioning (PCP) — releases up to 12.1. The issue is an access-control flaw in the web management interface, where authentication for Help Desk and User Provisioning roles is not properly enforced, allowing an authenticated attacker to modify priv...

CVE-2017-6637

Cisco Prime Collaboration Provisioning (PCP) web interface vulnerability CVE-2017-6637 allows an authenticated, remote attacker to delete arbitrary files due to insufficient HTTP request input validation and lack of RBAC enforcement, via directory traversal on the affected system. Core issue: imp...

CVE-2017-6755

Cisco Prime Collaboration Provisioning Tool Web Portal is affected by CVE-2017-6755. The vulnerability is a cross-site scripting (XSS) flaw in the PCP web interface caused by insufficient input validation of user-supplied data, allowing an unauthenticated, remote attacker to trigger JavaScript ex...

CVE-2018-0318

Cisco Prime Collaboration Provisioning (PCP) Password Reset Vulnerability (CVE-2018-0318) allows an unauthenticated, remote attacker to gain administrative privileges by abusing weak validation in the password reset function. Affected releases: PCP 11.6 and prior. The issue stems from insufficien...

CVE-2017-6635

CVE-2017-6635 affects Cisco Prime Collaboration Provisioning Software (before Release 12.1). The web interface allows authenticated, remote attackers to delete arbitrary files via crafted HTTP requests that exploit directory traversal and weak RBAC enforcement. The issue is rooted in insufficient...

CVE-2017-6756

The CVE-2017-6756 entry describes a CSRF vulnerability in the Web UI Application of Cisco Prime Collaboration Provisioning Tool (PCPT) up to version 12.2. An unauthenticated, remote attacker could induce a user’s browser to perform actions authorized for that user, enabling partial impact to conf...

CVE-2015-4307

CVE-2015-4307 affects Cisco Prime Collaboration Provisioning Web Framework prior to 11.0. An authenticated, remote attacker can bypass access controls via a crafted URL and create administrative accounts (Bug CSCut64111). The issue enables access to higher-privileged functions that should be rest...

CVE-2017-6704

CVE-2017-6704 applies to the Cisco Prime Collaboration Provisioning Tool web application. An authenticated, remote attacker could exploit insufficient input validation to download arbitrary files from the system, reading files on the underlying filesystem. Public references in Cisco’s advisory co...

CVE-2017-6793

The CVE-2017-6793 entry concerns Cisco Prime Collaboration Provisioning Tool, specifically its Inventory Management feature. A vulnerability arises from insufficient protection of restricted information, enabling an authenticated, remote attacker to view sensitive data through the user interface....

CVE-2017-6636

CVE-2017-6636 affects Cisco Prime Collaboration Provisioning Software (prior to Release 11.1). The issue is directory traversal due to insufficient input validation and RBAC enforcement on HTTP URLs, enabling an attacker to view arbitrary files. ZDI notes the vulnerability can be exploited withou...

CVE-2017-6792

CVE-2017-6792 : Cisco Prime Collaboration Provisioning Tool’s batch provisioning feature is vulnerable due to lack of input validation of parameters in BatchFileName and Directory. An authenticated, remote attacker could exploit this to overwrite system files as root. Root cause and impact are de...

CVE-2018-0320

Cisco Prime Collaboration Provisioning (PCP) SQL Injection (CVE-2018-0320) affects PCP releases 12.1 and earlier. The root cause is lack of proper validation of user-supplied input in SQL queries within the web framework code, enabling an unauthenticated, remote attacker to execute arbitrary SQL ...

CVE-2016-1416

CVE-2016-1416 affects Cisco Prime Collaboration Provisioning 10.6 SP2 (10.6.0.10602). The root cause is an improper implementation of LDAP authentication, allowing a remote attacker to bypass authentication and gain full administrator privileges via a crafted login attempt. Multiple connected sou...

CVE-2018-0391

The CVE-2018-0391 issue affects Cisco Prime Collaboration Provisioning (PCP) prior to 12.3, with the root cause being insufficient validation of a password-change request in the authentication flow. A remote attacker could cause the targeted device to become inoperable, resulting in a DoS conditi...

CVE-2017-6759

CVE-2017-6759 affects Cisco Prime Collaboration Provisioning Tool (PCPT) 12.1 UpgradeManager. The flaw stems from insufficient input validation in the upgrade package installation functionality, allowing an authenticated, remote attacker to write arbitrary files as root on the system. Documents c...

CVE-2018-0319

CVE-2018-0319 affects Cisco Prime Collaboration Provisioning (PCP) Password Recovery. The root cause is insufficient validation of a password recovery request, allowing an unauthenticated remote attacker to submit a recovery request, change the password for any user, and potentially gain administ...

CVE-2017-6703

The CVE-2017-6703 issue affects Cisco Prime Collaboration Provisioning Tool and describes a vulnerability in the web application that allows an unauthenticated, remote attacker to hijack another user’s session due to insufficient session management during authentication (session fixation). Affect...

CVE-2016-6451

CVE-2016-6451 concerns Cisco Prime Collaboration Provisioning. The Cisco advisory and NVD entry describe multiple vulnerabilities in the web framework code that could allow an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack against users of the web interface. The r...

CVE-2018-0205

The CVE-2018-0205 issue affects Cisco Prime Collaboration Provisioning Tool, specifically the User Provisioning tab. It arises from improper input validation, allowing an unauthenticated, remote attacker to inject crafted data into the provisioning database and trigger a cross-site scripting (XSS...

CVE-2017-6706

The CVE-2017-6706 entry concerns a vulnerability in the logging subsystem of Cisco Prime Collaboration Provisioning Tool that could allow an unauthenticated, local attacker to access sensitive information. Affected behavior is described as information disclosure via log files; the issue stems fro...

CVE-2017-6705

The CVE-2017-6705 issue affects the Cisco Prime Collaboration Provisioning Tool. Affected component: the filesystem; root cause is insecure file permissions. Impact: an authenticated, local attacker can disclose sensitive information. Known affected release: 12.1. The Cisco advisory states there ...