Telepresence Video Communication Server Security Vulnerabilities and Issues — Telepresence Video Communication Server CVE List

Lucene search

CiscoTelepresence Video Communication Server

39 matches found

CVE•added 2023/10/10 2:15 p.m.•4425 views

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

7.5CVSS8AI score0.94434EPSS

CVE•added 2022/07/06 9:15 p.m.•1081 views

CVE-2022-20812

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expre...

9CVSS7.4AI score0.00109EPSS

CVE•added 2022/07/06 9:15 p.m.•1008 views

CVE-2022-20813

9CVSS7.7AI score0.00078EPSS

CVE•added 2022/05/26 2:15 p.m.•892 views

CVE-2022-20809

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about...

6.5CVSS5.7AI score0.00266EPSS

CVE•added 2022/05/27 2:15 p.m.•861 views

CVE-2022-20806

7.1CVSS5.8AI score0.00169EPSS

CVE•added 2022/05/27 2:15 p.m.•827 views

CVE-2022-20807

6.5CVSS5.7AI score0.00208EPSS

CVE•added 2023/06/28 3:15 p.m.•808 views

CVE-2023-20105

A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with Read-only credentials to elevate privileges to Administrator on an affected system. This vulnerability is due to...

9.6CVSS6.5AI score0.00126EPSS

CVE•added 2023/06/28 3:15 p.m.•721 views

CVE-2023-20192

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write credentials on an affected system. Note: "Cis...

9.6CVSS8.2AI score0.0011EPSS

CVE•added 2022/04/06 7:15 p.m.•164 views

CVE-2022-20754

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the unde...

9CVSS8AI score0.00364EPSS

CVE•added 2023/08/16 9:15 p.m.•115 views

CVE-2023-20209

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code...

7.2CVSS7.5AI score0.37311EPSS

CVE•added 2019/10/16 7:15 p.m.•97 views

CVE-2019-12705

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected...

6.1CVSS6AI score0.00319EPSS

CVE•added 2022/04/06 7:15 p.m.•92 views

CVE-2022-20755

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the unde...

9CVSS8AI score0.03268EPSS

CVE•added 2019/06/05 5:29 p.m.•86 views

CVE-2019-1845

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a service outage for users a...

8.6CVSS8.7AI score0.09319EPSS

CVE•added 2020/10/08 5:15 a.m.•84 views

CVE-2020-3596

A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect handl...

7.8CVSS6.6AI score0.00596EPSS

CVE•added 2021/08/18 8:15 p.m.•75 views

CVE-2021-34716

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrec...

9CVSS7AI score0.01103EPSS

CVE•added 2019/10/29 7:15 p.m.•71 views

CVE-2011-2538

Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackers to execute arbitrary commands.

9CVSS7.3AI score0.02957EPSS

CVE•added 2019/04/18 1:29 a.m.•67 views

CVE-2019-1721

A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnera...

7.7CVSS6.4AI score0.00437EPSS

CVE•added 2018/08/15 8:29 p.m.•66 views

CVE-2018-0409

A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS) and Expressway could allow an unauthenticated, remote attacker to cause a temporary service outage for all IM&P users, ...

7.5CVSS7.6AI score0.01042EPSS

CVE•added 2019/06/05 5:29 p.m.•64 views

CVE-2019-1872

A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on network services in the af...

5.3CVSS5.4AI score0.00375EPSS

CVE•added 2019/05/03 5:29 p.m.•63 views

CVE-2019-1854

A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit this...

4.3CVSS4.4AI score0.00065EPSS

CVE•added 2020/11/18 7:15 p.m.•62 views

CVE-2020-3482

A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific ...

6.5CVSS6.7AI score0.00197EPSS

CVE•added 2021/08/18 8:15 p.m.•61 views

CVE-2021-34715

A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insuffici...

9CVSS5.9AI score0.00669EPSS

CVE•added 2017/02/01 7:59 p.m.•59 views

CVE-2017-3790

A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is ...

8.6CVSS8.7AI score0.00302EPSS

CVE•added 2019/02/07 9:29 p.m.•59 views

CVE-2019-1679

A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack ...

5CVSS5.2AI score0.00136EPSS

CVE•added 2017/08/17 8:29 p.m.•56 views

CVE-2017-6790

A vulnerability in the Session Initiation Protocol (SIP) on the Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the d...

7.1CVSS6.6AI score0.01795EPSS

CVE•added 2019/04/18 1:29 a.m.•50 views

CVE-2019-1720

A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is d...

6.8CVSS5.5AI score0.00316EPSS

CVE•added 2017/10/19 8:29 a.m.•49 views

CVE-2017-12287

A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to cause the CDB process on an affected system to restart unexpectedly, resulting in ...

4.3CVSS4.8AI score0.00497EPSS

CVE•added 2016/05/25 1:59 a.m.•45 views

CVE-2016-1400

Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header, aka Bug ID CSCuy43258.

7.5CVSS7.2AI score0.01315EPSS

CVE•added 2016/07/07 2:59 p.m.•45 views

CVE-2016-1444

The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass authentication via an arbitrary trusted certificate, aka Bug ID CSCuz64601.

6.5CVSS6.8AI score0.00314EPSS

CVE•added 2015/01/14 7:59 p.m.•43 views

CVE-2015-0579

Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473.

5CVSS6.7AI score0.00853EPSS

CVE•added 2019/04/18 1:29 a.m.•43 views

CVE-2019-1722

A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is du...

6.5CVSS6.7AI score0.00141EPSS

CVE•added 2012/03/01 1:55 a.m.•42 views

CVE-2012-0330

Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a malformed SIP message, aka Bug ID CSCtr20426.

7.8CVSS6.7AI score0.00427EPSS

CVE•added 2024/10/02 5:15 p.m.•42 views

CVE-2024-20492

A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credentia...

6.7CVSS6.4AI score0.00206EPSS

CVE•added 2014/01/23 4:41 a.m.•41 views

CVE-2014-0675

The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's tru...

6.4CVSS6.7AI score0.00448EPSS

CVE•added 2015/05/29 3:59 p.m.•41 views

CVE-2015-0752

Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635.

4.3CVSS5.8AI score0.00263EPSS

CVE•added 2016/08/08 12:59 a.m.•41 views

CVE-2016-1468

The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to execute arbitrary commands via crafted fields, aka Bug ID CSCuv12531.

8.8CVSS8.7AI score0.00671EPSS

CVE•added 2018/10/05 2:29 p.m.•41 views

CVE-2018-15430

A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficien...

7.2CVSS7.1AI score0.01581EPSS

CVE•added 2012/03/01 1:55 a.m.•40 views

CVE-2012-0331

Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP packet, as demonstrated by a SIP INVITE message from a Tandberg device, aka Bug ID CSCtq73319.

7.5CVSS6.7AI score0.0046EPSS

CVE•added 2018/06/21 11:29 a.m.•40 views

CVE-2018-0358

A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to exhaustion of file descriptors while processing a high volume o...

7.5CVSS7.5AI score0.01673EPSS