CVE-2019-15968

Cisco Unified Communications Domain Manager (CUCDM) web-based management interface is affected by a cross-site scripting (XSS) vulnerability caused by insufficient input validation. An authenticated remote attacker could lure a user to click a crafted link, enabling arbitrary script execution in ...

CVE-2018-0386

Cisco Unified Communications Domain Manager Software contains a cross-site scripting (XSS) vulnerability (CVE-2018-0386) due to improper input validation. A remote, unauthenticated attacker can lure a user to a malicious URL to access sensitive information or perform actions in the user’s securit...

CVE-2018-0364

Cisco Unified Communications Domain Manager is affected by a CSRF vulnerability in its web-based management interface. The issue arises from insufficient CSRF protections, allowing an unauthenticated or user-trresent remote attacker to coax a logged-in user to click a crafted link and perform arb...

CVE-2016-1354

CVE-2016-1354 affects Cisco Unified Communications Domain Manager (UCDM/UCDM) versions 8.x before 8.1.1. The vulnerability is a cross-site scripting (XSS) flaw in the web framework triggered by crafted markup data, due to insufficient input validation. Multiple sources (NVD, CVE listings, CNVD, C...

CVE-2017-12302

CVE-2017-12302 concerns Cisco Unified Communications Manager (CUCM) — specifically the SQL database interface. A vulnerability exists due to lack of input validation in SQL queries, allowing an authenticated, remote attacker to execute arbitrary SQL statements and potentially infer data from the ...

CVE-2015-4229

Cisco Unified Communications Domain Manager 8.1(4)ER1 contains an information-disclosure vulnerability in the web framework (bvsmweb directory) that allows unauthenticated remote attackers to obtain sensitive information due to insufficient access controls (Bug ID CSCuq22589). Multiple sources (C...

CVE-2015-0699

CVE-2015-0699 affects Cisco Unified Communications Manager (UCM) IVR interface. A SQL injection exists in the IVR component (UCM 10.5(1.98991.13)) that allows an unauthenticated, remote attacker to execute arbitrary SQL via unspecified vectors, as described in Cisco’s advisory (Bug CSCut21563). T...

CVE-2014-2104

Cisco Unified Communications Domain Manager BVSM page (in 9.0(.1)) contains multiple XSS flaws due to insufficient input validation of BVSM parameters. Exploitation allows remote attackers to craft malicious links/URIs to inject script or HTML via unspecified parameters, potentially compromising ...

CVE-2013-1132

Cisco Unified Communications Domain Manager contains multiple XSS vulnerabilities exploitable by an unauthenticated remote attacker via links to the IptAccountMgmt, IptFeatureConfigTemplateMgmt, IptFeatureDisplayPolicyMgmt, or IptProviderMgmt pages. Root cause: improper input validation. Impact p...

CVE-2015-4196

CVE-2015-4196 affects Cisco Unified Communications Domain Manager (CDM) Platform Software before 4.4.5 (CDM 8.x). The root cause is a hardcoded privileged account password that allows an unauthenticated, remote attacker to obtain root access by SSHing with that credential. Impact stated as full c...

CVE-2014-3300

CVE-2014-3300 affects Cisco Unified Communications Domain Manager (CDM) BVSMWeb portal in Unified CDM Application Software prior to 10, where insufficient access control allows remote attackers to modify BVSMWeb user information via a crafted URL. Related materials show Metasploit/Viproy modules ...

CVE-2013-3418

CVE-2013-3418 affects Cisco Unified Communications Domain Manager. The issue arises from improper memory allocation when handling crafted HTTP GET/POST requests to the management interface, allowing an authenticated remote attacker to exhaust memory and crash multiple processes, potentially takin...

CVE-2014-2197

CVE-2014-2197 affects Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software prior to 8.1.4. The Admin GUI did not properly implement access control, allowing remote authenticated users to modify administrative credentials via a crafted URL (Privilege Escalation typ...

CVE-2014-8018

Cisco SA-20150106-CVE-2014-8018 describes a reflected XSS vulnerability in the web framework of Cisco Unified Communications Domain Manager (BVSM pages) allowing unauthenticated remote attackers to inject arbitrary script via a crafted link. Root cause: improper validation of user-supplied input....

CVE-2018-0124

CVE-2018-0124 concerns Cisco Unified Communications Domain Manager. A remote, unauthenticated attacker could bypass protections, elevate privileges, and execute arbitrary code due to insecure key generation during application configuration. Exploitation involves sending requests with the known in...

CVE-2014-3279

The CVE-2014-3279 issue affects Cisco VOSS CDM 9.0(.1) and earlier, in the Administration GUI of the web framework. The vulnerability is an improper access control flaw that lets remote attackers enumerate account names via a crafted URL . This is supported by the NVD/CVE entries which consistent...

CVE-2014-3320

Cisco Unified Communications Domain Manager (CDM) admin HTTP redirect vulnerability (CVE-2014-3320) affects CDM 8.1(.4) and earlier. The issue stems from insufficient validation of input when invoking scripts via the admin web interface, allowing unauthenticated, remote attackers to redirect user...

CVE-2014-3283

CVE-2014-3283 describes an open redirect vulnerability in the Self‑Care Client Portal web framework of Cisco VOSS CDM (Cisco Unified Communications Domain Manager) 9.0(.1) and earlier. A crafted URL can redirect users to arbitrary sites, enabling phishing. The documents confirm the affected produ...

CVE-2014-3339

The CVE-2014-3339 issue affects Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS). The root cause is insufficient sanitization of user-supplied input in the administrative web interface, enabling an authenticated, remote attacker to perform SQL injection on unspec...

CVE-2014-8020

CVE-2014-8020 affects Cisco Unified Communications Domain Manager Platform Software. The issue allows unauthenticated remote attackers to cause high CPU utilization and degraded performance or service outage by sending a flood of malformed TCP/UDP packets (Bug ID CSCup25276). Cisco’s advisory not...

CVE-2017-6668

CVE-2017-6668 affects the web-based GUI of Cisco Unified Communications Domain Manager (CUCDM). The issue is an SQL Injection caused by insufficient validation of user-supplied input in HTTP request parameters, allowing an authenticated, remote attacker to impact confidentiality by executing arbi...

CVE-2014-2198

Cisco CDM in Unified CDM Platform Software prior to 4.4.2 contains a default SSH private key, enabling remote attackers to access support/root accounts by extracting the key from a binary in another installation (Bug CSCud41130). The Cisco advisory confirms multiple vulnerabilities, including a D...

CVE-2015-0682

Cisco Unified Communications Domain Manager 8.1(4) is affected by CVE-2015-0682 (Bug CSCup90168). The issue allows an authenticated, remote attacker to execute arbitrary code by visiting a deprecated page, as described in Cisco’s advisory Cisco-SA-20150331-CVE-2015-0682. Connected documents corro...

CVE-2015-0684

CVE-2015-0684 affects Cisco Unified Communications Domain Manager (Image Management) 8.1(4). A SQL injection vulnerability allows an authenticated, remote attacker to execute arbitrary SQL via unspecified vectors. The issue stems from insufficient validation of user input. Cisco Advisory Cisco-SA...

CVE-2014-3278

Technical details about CVE-2014-3278 are not publicly provided in the supplied connected documents; no specific affected product, version, impact, or fix is described. Monitor for updates.

CVE-2014-3282

CVE-2014-3282 affects the Cisco Unified Communications Domain Manager (CDM) with VOSS, specifically the Administration GUI in the web framework of CDM 9.0(.1) and earlier. The root cause is an improper access-control implementation in the Admin GUI, allowing remote authenticated users with Locati...

CVE-2015-0588

Cisco Unified Communications Domain Manager (UCDM) version 10 contains a CSRF vulnerability (Bug ID CSCuo77055) that could allow an unauthenticated, remote attacker to hijack the authentication of arbitrary users. The issue arises from insufficient CSRF protections in the web framework, enabling ...

CVE-2013-5517

Cisco Unified Communications Domain Manager’s web framework is affected by a SQL injection via a crafted URL. The root cause is failure to validate user-supplied input in SQL queries, allowing an authenticated, remote attacker to execute arbitrary SQL commands and potentially modify or delete dat...

CVE-2014-3337

CVE-2014-3337 affects the SIP subsystem in Cisco Unified Communications Manager (CM) 8.6(.2) and earlier. A remote authenticated attacker can trigger a denial of service (process crash) by sending a crafted SIP message that exploits improper handling during XML processing, due to a failure to san...

CVE-2015-6422

The CVE-2015-6422 entry concerns Cisco Unified Communications Domain Manager (CUCDM) self-service application in version 10.6(1). The vulnerability arises from improper handling of malformed requests by the self-service component, allowing an authenticated remote user to cause a denial of service...

CVE-2017-6670

CVE-2017-6670 affects Cisco Unified Communications Domain Manager (CUCM) web-based GUI. The issue is an Open Redirect vulnerability caused by improper input validation of HTTP request parameters, allowing an unauthenticated, remote attacker to redirect users to a malicious web page. Affected rele...

CVE-2013-1113

CVE-2013-1113 affects Cisco’s Unified Communications Domain Manager with a Cross-site scripting (XSS) vulnerability. A remote attacker can inject arbitrary web script or HTML through a crafted parameter value, referenced as Bug ID CSCue21042 . The connected documents confirm the affected product ...

CVE-2013-1227

Technical details for CVE-2013-1227 are not publicly available in the provided documents. No affected versions, vectors, or fixes are specified here; monitor for updates from official advisories and suppliers.

CVE-2014-3280

CVE-2014-3280 affects Cisco VOSS CDM (Cisco Unified Communications Domain Manager) versions 9.0(.1) and earlier. The issue is an improper access-control enforcement in the web framework, allowing remote authenticated users to access potentially sensitive user information by visiting an unspecifie...

CVE-2015-0591

Cisco UC Domain Manager (UCDM) Application Software 10 is affected by CVE-2015-0591. A remote, unauthenticated attacker can cause a denial of service by sending a flood of malformed TCP packets to the web server, exploiting insufficient flood-control. Impact is that the UCDM GUI becomes unavailab...

CVE-2013-1230

Cisco Unified Communications Domain Manager is affected by a denial-of-service vulnerability caused by a flood of malformed UDP packets (Bug ID CSCug47057). The available records state that remote attackers can trigger CPU consumption leading to DoS. No vendor patch/version details or remediation...

CVE-2014-3277

CVE-2014-3277 concerns Cisco Unified Communications Domain Manager (CDM) using Cisco VOSS. The issue is improper access control in the CDM Admin GUI (web framework) for version 9.0(.1) and earlier, allowing remote authenticated users with Location Administrator privileges to obtain sensitive user...

CVE-2014-3281

CVE-2014-3281 affects Cisco’s VOSS web framework in the Unified Communications Domain Manager (CDM). The issue is an improper access control vulnerability that could allow remote attackers to view potentially sensitive user information by accessing an unspecified BVSMWeb page (Bug IDs CSCun46071/...

CVE-2014-8010

The Cisco Unified Communications Domain Manager web framework (Application Software, version 8) is affected by CVE-2014-8010. The root cause is insufficient input validation when the user sets certain values in the UI, allowing an authenticated, remote attacker to inject and execute OS commands w...

CVE-2015-0683

Cisco Unified Communications Domain Manager 8.1(4) is affected by CVE-2015-0683, where an authenticated, remote attacker can disclose sensitive information via a file-inclusion attack. The root cause is described as an unspecified condition enabling local file inclusion. Impact is information dis...

CVE-2015-6352

Cisco Unified Communications Domain Manager (UCD) before version 10.6(1) is affected by an information-disclosure vulnerability where error messages for pathname access differ depending on whether the path exists. This enables remote attackers to map the filesystem by issuing a sequence of reques...