CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2022-20791

CVE-2022-20791 affects Cisco Unified Communications Manager (CUCM), Unified CM SME, and Unified CM IM&P. Root cause: insufficient file permission restrictions that allow an authenticated remote attacker to read arbitrary files on the underlying OS by sending a crafted command via the application ...

CVE-2019-1887

CVE-2019-1887 affects Cisco Unified Communications Manager (CUCM): the DoS stems from insufficient validation of input SIP traffic in the SIP protocol implementation. An unauthenticated, remote attacker can send malformed SIP packets to trigger a new registration process on all connected phones, ...

CVE-2026-20045

Cisco CVE-2026-20045 affects Cisco Unified Communications Manager (including Unified CM SME, IM&P), Unity Connection, and Webex Calling Dedicated Instance. The flaw stems from improper validation of user-supplied input in HTTP requests to the web-based management interface, allowing an unauthenti...

CVE-2026-20230

CVE-2026-20230 affects Cisco Unified Communications Manager (CUCM) and Unified CM SME. The issue is due to improper input validation in specific HTTP requests, enabling an unauthenticated attacker to perform server-side request forgery (SSRF) and, if exploited, write files on the OS that could be...

CVE-2023-20211

CVE-2023-20211 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). A vulnerability arises from improper validation of user-supplied input in the web-based management interface, enabling an authenticated remote attacker to perform S...

CVE-2022-20787

CVE-2022-20787 affects the web-based management interfaces of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The root cause is insufficient CSRF protections, allowing an authenticated, remote attacker to entice a user to click a malicious link a...

CVE-2022-20788

The CVE-2022-20788 issue affects Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition (Unified CM SME), and Cisco Unity Connection. It is a cross-site scripting (XSS) vulnerability in the web-based management interface caused by insufficient validation of user-...

CVE-2024-20253

CVE-2024-20253 affects Cisco Unified Communications Manager and related UC/Contact Center products. The root cause is improper processing of user-supplied data read into memory, enabling an unauthenticated, remote attacker to send a crafted message to a listening port and execute arbitrary comman...

CVE-2021-1362

CVE-2021-1362 affects Cisco Unified Communications Manager family (CUCM, IM&P, Session Management Edition, Unity Connection, Prime License Manager). The vulnerability is due to improper sanitization of user-supplied input in the SOAP API endpoint, allowing an authenticated, remote attacker to sen...

CVE-2022-20859

CVE-2022-20859 affects Cisco Unified Communications Manager (CUCM), Unified CM IM&P, and Cisco Unity Connection in the Disaster Recovery framework. Root cause: insufficient access control checks allowing an authenticated, read-only user to run a vulnerable command and perform administrative actio...

CVE-2022-20789

Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) are affected by an Arbitrary File Write vulnerability in the upgrade process. The issue arises from improper restrictions on a system script, enabling an authenticated, remote attacker to ...

CVE-2022-20816

CVE-2022-20816 involves Cisco Unified Communications Manager (CUCM) and Unified CM Session Management Edition (Unified CM SME). The issue is in the web-based management interface where requests are not properly validated, allowing an authenticated, remote attacker to delete arbitrary files by sen...

CVE-2023-20259

CVE-2023-20259 concerns Cisco Unified Communications products exposing an unauthenticated API that can be abused to cause high CPU utilization and DoS, potentially impacting web management access and call processing. The issue arises from improper API authentication and incomplete validation of A...

CVE-2015-6360

CVE-2015-6360 affects libsrtp/libSRTP, with several advisories noting that the encryption-processing feature allows remote DoS via crafted SRTP packets. The root cause in the reports is improper handling of CSRC count and extension header length in RTP headers, leading to vulnerable RTP processin...

CVE-2022-20804

The CVE-2022-20804 vulnerability affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) via the Cisco Discovery Protocol (CDP). The issue stems from incorrect processing of certain CDP packets, allowing an unauthenticated, adjacent att...

CVE-2023-20116

CVE-2023-20116 affects Cisco Unified Communications Manager (CUCM) and CVM Session Management Edition (Unified CM SME). The issue is an input-validation vulnerability in the Administrative XML Web Service (AXL) API’s Self Care Portal UI, where crafted HTTP input sent by an authenticated remote at...

CVE-2018-0120

CVE-2018-0120 affects Cisco Unified Communications Manager (CUCM) web framework. The vulnerability arises from inadequate validation of user-supplied input in certain SQL queries, enabling an authenticated, remote attacker to perform SQL injection via crafted HTTP requests. Successful exploitatio...

CVE-2021-1380

CVE-2021-1380 covers multiple Cisco products (CUCM, CUCM IM&P, CUCM SME, Unity Connection) with web-based management interface XSS vulnerabilities caused by improper input validation. An unauthenticated, remote attacker could lure a user to click a crafted link and trigger arbitrary script execut...

CVE-2023-20010

CVE-2023-20010 affects Cisco Unified Communications Manager (CUCM) and CUCM Session Management Edition (SME). The issue is a web interface input-validation flaw that enables an SQL injection when an authenticated, low-privileged user sends crafted queries. Impact shown in sources: read/modify dat...

CVE-2025-20309

CVE-2025-20309 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The root cause is static, hardcoded root credentials that cannot be changed or deleted, enabling an unauthenticated, remote attacker to log in using the root accoun...

CVE-2024-20375

CVE-2024-20375 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The issue is in SIP call processing due to improper parsing of SIP messages, allowing an unauthenticated, remote attacker to cause a denial-of-service by sending a ...

CVE-2015-0749

Cisco Unified Communications Manager is affected by a cross-site scripting (XSS) vulnerability due to improper input validation of certain parameters. An unauthenticated, remote attacker could lure a user to follow a malicious link, potentially allowing the attacker to execute arbitrary script co...

CVE-2019-15972

CVE-2019-15972 affects Cisco Unified Communications Manager (CUCM) Web Management Interface. The issue stems from improper validation of SQL values, enabling an authenticated, remote attacker to perform SQL injection and modify or retrieve data from the underlying database. Cisco indicates softwa...

CVE-2021-1408

CVE-2021-1408 covers multiple XSS flaws in Cisco Unified Communications products (CUCM, Unified CM IM&P, Unified CM SME, Unity Connection). Root cause: web-based management interfaces fail to properly validate user input, enabling unauthenticated remote attackers to entice users to click crafted ...

CVE-2023-20266

CVE-2023-20266 affects Cisco Emergency Responder, Unified CM, Unified CM SME, and Cisco Unity Connection. The issue stems from improper restrictions on upgrade files, where a crafted upgrade package could enable an authenticated attacker with platform administrator credentials to elevate privileg...

CVE-2021-1406

Cisco UC Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) have an information disclosure vulnerability where downloadable files may inappropriately contain sensitive data. An authenticated attacker with elevated privileges can exploit via a targeted command sequence...

CVE-2022-20790

Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) suffer an arbitrary file read vulnerability in the web-based management interface due to insufficient input validation that allows directory traversal. An authenticated, remote attacker co...

CVE-2022-20800

Summary: CVE-2022-20800 describes a cross-site scripting (XSS) vulnerability in Cisco Unified Communications Manager family web interfaces (CUCM, Unified CM SME, Unified CM IM&P, and Unity Connection). The issue stems from improper validation of user-supplied input in the web-based management int...

CVE-2022-20815

Cisco CUCM family (Unified CM, Unified CM Session Management Edition, and Unified CM IM&P) web-based management interface contains an XSS vulnerability due to improper validation of user input. An unauthenticated, remote attacker could trick a user into clicking a crafted link, allowing execution...

CVE-2021-1399

Cisco CVE-2021-1399 affects the Self Care Portal in Cisco Unified Communications Manager (CUCM) and CUCM Session Management Edition (CUCM SME). Root cause: insufficient validation of user-supplied data in the Self Care Portal, enabling an authenticated, remote attacker to modify data via a crafte...

CVE-2021-1409

Summary: CVE-2021-1409 covers multiple cross-site scripting (XSS) flaws in Cisco Unified Communications Manager (CUCM), including the web-based management interfaces of CUCM, CUCM IM&P, CUCM SME, and Cisco Unity Connection. What’s affected: Web-based management interfaces in CUCM family prior to ...

CVE-2020-3135

CVE-2020-3135 affects Cisco Unified Communications Manager (UCM) web-based management interface. Root cause: insufficient CSRF protections in the UI allow an unauthenticated, remote attacker to lure a user into a malicious link, enabling arbitrary actions with the targeted user’s privileges. Impa...

CVE-2021-1282

CVE-2021-1282 affects Cisco Unified Communications Manager IM&P, Unified CM, and Unified CM SME via multiple vulnerabilities that enable path traversal and SQL injection in the web interface. The SQL injection vulnerability also impacts the other CM products. Cisco’s advisory notes improper valid...

CVE-2023-20242

Cisco reports a cross-site scripting (XSS) vulnerability in the web-based management interfaces of Cisco Unified Communications Manager (CUCM), Unified CM Session Management Edition (SME), and Unified Communications Manager IM&P. The issue arises from inadequate validation of user-supplied input ...

CVE-2018-0411

Summary: CVE-2018-0411 describes a reflected cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM). The root cause is insufficient validation of user-supplied input in the interface, enabling an unauthenticated, remote attacke...

CVE-2022-20752

CVE-2022-20752 affects Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition (Unified CM SME), and Cisco Unity Connection. The issue is a timing attack caused by insufficient protection of a system password, enabling an unauthenticated remote attacker to infer a...

CVE-2021-1407

CVE-2021-1407 affects Cisco Unified Communications Manager (CUCM), Unified CM IM&P, Unified CM SME, and Cisco Unity Connection. The issue is cross-site scripting in the web-based management interface caused by improper validation of user-supplied input. An unauthenticated, remote attacker could l...

CVE-2025-20278

CVE-2025-20278 affects Cisco Unified Communications products. The vulnerability is a command-injection flaw in the CLI due to insufficient validation of command arguments, allowing an authenticated local attacker to execute arbitrary OS commands as root on an affected device. Exploitation require...

CVE-2008-3800

CVE-2008-3800 affects Cisco IOS 12.2–12.4 with VoIP and Cisco Unified Communications Manager 4.1–6.1. A DoS can be triggered by processing specific valid SIP messages, causing a reload of the device or main CCM process. The vulnerability is tied to Cisco bug CSCsu38644. Affected CUCM/IOS versions...

CVE-2017-12258

CVE-2017-12258 affects Cisco Unified Communications Manager (CUCM) Web UI. The flaw stems from insufficient protections for HTML inline frames (iframes), enabling an unauthenticated, remote attacker to direct a user to a page containing a malicious iframe to perform a click-jacking/XSF-style brow...

CVE-2017-6654

CVE-2017-6654 affects Cisco Unified Communications Manager (CUCM) web-based management interface versions 10.5–11.5. The issue is an XSS flaw caused by insufficient validation of user-supplied input, allowing an unauthenticated, remote attacker to entice a user to click a crafted link and execute...

CVE-2019-1837

CVE-2019-1837 affects Cisco Unified Communications Manager (Unified CM) via the User Data Services (UDS) API. The issue is improper validation of input parameters in UDS API requests, allowing an unauthenticated, remote attacker to trigger a DoS condition on the management GUI by sending crafted ...

CVE-2007-4633

Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) affect versions before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1. The issue allows remote attackers to inject arbitrary web script or HTML via ...

CVE-2020-3177

Cisco UCS CUCM and SME TAPS path traversal (CVE-2020-3177) is due to insufficient validation of input to the TAPS interface, enabling an unauthenticated attacker to trigger directory traversal and read arbitrary files. Affected components include the Tool for Auto-Registered Phones Support (TAPS)...

CVE-2011-3315

CVE-2011-3315 describes a directory-traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x/6.x up to 6.1(5)SU2, CUCM 7.x up to 7.1(5b)SU2, CUCM 8.x up to 8.0(3), and in Cisco Unified Contact Center Express (UCCX) and Cisco Unified IP IVR up to specified revisions. The flaw all...

CVE-2018-0206

The CVE affects Cisco Unified Communications Manager (CUCM) web-based management interface. It stems from insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to trigger a reflected cross-site scripting (XSS) attack by guiding a user to click a crafted link...

CVE-2018-0355

Cisco CUCM Web UI is affected by a Cross-Frame Scripting (XFS) vulnerability due to insufficient iframe protections. An unauthenticated, remote attacker could lure a user to an attacker-controlled page containing a malicious iframe, enabling clickjacking or other client-side browser attacks on th...

CVE-2021-1355

Cisco Unified Communications Manager IM&P is affected by multiple vulnerabilities enabling path traversal and SQL injection. The SQL injection issue also affects Unified CM and Unified CM SME. Root cause involves input handling flaws in affected components. Impact is partial confidentiality loss ...

CVE-2019-12710

CVE-2019-12710 is a SQL injection flaw in Cisco Unified Communications Manager (and Session Management Edition). An authenticated, remote attacker can exploit improper validation of input in SQL queries by sending crafted requests to the web-based interface, potentially revealing data from the da...