Unified Communications Manager Security Vulnerabilities and Issues — Page 5 of Unified Communications Manager CVE List

Lucene search

CiscoUnified Communications Manager

232 matches found

CVE•added 2014/02/13 5:24 a.m.•35 views

CVE-2014-0729

SQL injection vulnerability in the Enterprise Mobility Application (EMApp) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05302.

7.5CVSS8.5AI score0.00413EPSS

CVE•added 2014/10/31 10:55 a.m.•35 views

CVE-2014-3366

SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

6.5CVSS8.1AI score0.00279EPSS

CVE•added 2008/06/26 5:41 p.m.•34 views

CVE-2008-2061

The Computer Telephony Integration (CTI) Manager service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3c) and 6.x before 6.1(2) allows remote attackers to cause a denial of service (TSP crash) via malformed network traffic to TCP port 2748.

7.8CVSS6.5AI score0.03307EPSS

CVE•added 2011/08/29 3:55 p.m.•34 views

CVE-2011-2560

The Packet Capture Service in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x does not properly handle idle TCP connections, which allows remote attackers to cause a denial of service (memory consumption and restart) by making many connections, aka Bug ID CSCtf97162.

7.8CVSS6.8AI score0.00427EPSS

CVE•added 2013/08/05 1:22 p.m.•34 views

CVE-2013-3442

The web portal in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive stack-trace information via unspecified vectors that trigger a stack exception, aka Bug ID CSCug34854.

4CVSS5.9AI score0.00162EPSS

CVE•added 2014/02/13 5:24 a.m.•34 views

CVE-2014-0728

SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.

7.5CVSS8.6AI score0.00482EPSS

CVE•added 2014/02/27 1:55 a.m.•34 views

CVE-2014-0741

The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461.

6.2CVSS6.4AI score0.00036EPSS

CVE•added 2014/06/10 11:19 a.m.•34 views

CVE-2014-3287

SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to execute arbitrary SQL commands via crafted filename parameters in a URL, aka Bug ID CSCuo17337.

4CVSS8.2AI score0.00242EPSS

CVE•added 2014/06/10 11:19 a.m.•34 views

CVE-2014-3292

The Real Time Monitoring Tool (RTMT) implementation in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to (1) read or (2) delete arbitrary files via a crafted URL, aka Bug IDs CSCuo17302 and CSCuo17199.

5.5CVSS6.4AI score0.00959EPSS

CVE•added 2014/09/12 1:55 a.m.•34 views

CVE-2014-3363

Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443.

3.5CVSS5.5AI score0.00324EPSS

CVE•added 2007/07/15 10:30 p.m.•33 views

CVE-2006-5278

Integer overflow in the Real-Time Information Server (RIS) Data Collector service (RisDC.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via crafted packets, resulting in a heap-based buffer overflow.

10CVSS8AI score0.09727EPSS

CVE•added 2008/05/16 12:54 p.m.•33 views

CVE-2008-1746

The SNMP Trap Agent service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (core dump and service restart) via a series of malformed UDP packe...

7.8CVSS6.5AI score0.01918EPSS

CVE•added 2011/08/29 3:55 p.m.•33 views

CVE-2011-2562

Unspecified vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5 before 8.5(1) allows remote attackers to cause a denial of service (service outage) via a SIP INVITE message, aka Bug ID CSC...

7.8CVSS6.8AI score0.00427EPSS

CVE•added 2014/02/13 5:24 a.m.•33 views

CVE-2014-0726

SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326.

7.5CVSS8.6AI score0.00397EPSS

CVE•added 2014/02/20 5:18 a.m.•33 views

CVE-2014-0732

The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495.

5CVSS6.9AI score0.00214EPSS

CVE•added 2014/10/31 10:55 a.m.•33 views

CVE-2014-3375

Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90597.

4.3CVSS5.9AI score0.00532EPSS

CVE•added 2011/05/03 10:55 p.m.•32 views

CVE-2011-1604

Memory leak in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5b)su3, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1) allows remote attackers to cause a denial of service (memory consumption and process failure) via a malformed SIP message, a...

7.1CVSS6.8AI score0.02018EPSS

CVE•added 2012/03/01 1:55 a.m.•32 views

CVE-2011-4486

Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.6(2a)su1 allow remote attackers to cause a denial of ...

7.8CVSS6.7AI score0.00427EPSS

CVE•added 2014/02/20 3:27 p.m.•32 views

CVE-2014-0733

The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494.

5CVSS6.9AI score0.00301EPSS

CVE•added 2014/07/10 11:6 a.m.•32 views

CVE-2014-3315

Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.

4.3CVSS5.9AI score0.00357EPSS

CVE•added 2014/07/14 9:55 p.m.•32 views

CVE-2014-3317

Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314.

5.5CVSS6.4AI score0.02717EPSS

CVE•added 2007/10/18 12:17 a.m.•31 views

CVE-2007-5537

Cisco Unified Communications Manager (CUCM, formerly CallManager) 5.1 before 5.1(2), and Unified CallManager 5.0, allow remote attackers to cause a denial of service (kernel panic) via a flood of SIP INVITE messages to UDP port 5060, which triggers resource exhaustion, aka CSCsi75822.

7.8CVSS6.7AI score0.01482EPSS

CVE•added 2008/05/16 12:54 p.m.•31 views

CVE-2008-1743

Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed TCP packets, aka Bug I...

7.8CVSS6.5AI score0.01626EPSS

CVE•added 2013/08/05 1:22 p.m.•31 views

CVE-2013-3450

Cross-site request forgery (CSRF) vulnerability in the User WebDialer page in Cisco Unified Communications Manager (Unified CM) allows remote attackers to hijack the authentication of arbitrary users for requests that dial calls, aka Bug ID CSCui13028.

6.8CVSS7.4AI score0.00122EPSS

CVE•added 2008/05/16 12:54 p.m.•30 views

CVE-2008-1747

Unspecified vulnerability in Cisco Unified Communications Manager 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (CCM service restart) via an unspecified SIP INVITE message, aka Bug ID CSCs...

7.8CVSS6.5AI score0.02174EPSS

CVE•added 2013/07/18 12:48 p.m.•30 views

CVE-2013-3412

SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuh81766.

6.5CVSS8.1AI score0.00311EPSS

CVE•added 2013/07/18 12:48 p.m.•30 views

CVE-2013-3433

Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privileges by leveraging unspecified file-permission and environment-variable issues for privileged programs, aka Bug ID CSCui02276.

6.8CVSS6.7AI score0.00098EPSS

CVE•added 2013/12/21 2:22 p.m.•30 views

CVE-2013-6978

The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device information by reading "extraneous information" in HTML source code, aka Bug ID CSCuj39249.

4CVSS5.8AI score0.00501EPSS

CVE•added 2014/02/20 5:18 a.m.•30 views

CVE-2014-0736

Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka...

6.8CVSS7.4AI score0.00126EPSS

CVE•added 2014/02/27 1:55 a.m.•30 views

CVE-2014-0740

Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for re...

6.8CVSS7.4AI score0.00126EPSS

CVE•added 2014/07/14 9:55 p.m.•30 views

CVE-2014-3319

Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676.

6.8CVSS6.3AI score0.00665EPSS

CVE•added 2025/07/02 5:15 p.m.•30 views

CVE-2025-20309

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials tha...

10CVSS7.6AI score0.00173EPSS

Total number of security vulnerabilities232