CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2023-20232

Cisco Unified Contact Center Express (Unified CCX) is affected by CVE-2023-20232 due to improper input validation in the Tomcat-based web proxy component exposed via the Finesse Portal. The issue allows an unauthenticated, remote attacker to perform a web cache poisoning attack by sending crafted...

CVE-2022-20658

CVE-2022-20658 affects Cisco Unified Contact Center Management Portal (Unified CCMP) and Unified Contact Center Domain Manager (Unified CCDM). The issue is a privilege-escalation flaw caused by lack of server-side validation of user permissions in the web-based management interface. An authentica...

CVE-2019-12633

CVE-2019-12633 refers to a Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified Contact Center Express (Unified CCX). The root cause is improper validation of user-supplied input on the affected web interface, allowing an unauthenticated, remote attacker to bypass access controls and...

CVE-2024-20253

CVE-2024-20253 affects Cisco Unified Communications Manager and related UC/Contact Center products. The root cause is improper processing of user-supplied data read into memory, enabling an unauthenticated, remote attacker to send a crafted message to a listening port and execute arbitrary comman...

CVE-2019-15278

Cisco Finesse is affected by a cross-site scripting issue in the web-based management interface. The root cause is that URLs are not sanitized, enabling an unauthenticated, remote attacker to craft a URL and potentially bypass authorization to access sensitive device information. The CVE entry no...

CVE-2023-20058

Cisco Unified Intelligence Center is affected by a reflected XSS in its web-based management interface. The issue arises from inadequate input validation, allowing an unauthenticated, remote attacker to lure a user into clicking a crafted link, which could execute arbitrary script code in the int...

CVE-2021-1463

The CVE-2021-1463 issue affects Cisco Unified Intelligence Center Software (web-based management interface). It is a Cross-Site Scripting (XSS) vulnerability caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user to click a crafted link, ex...

CVE-2023-20061

Cisco Unified Intelligence Center (CUIC) is affected by CVE-2023-20061 (and related CVE-2023-20062 per Cisco advisory) where an authenticated, remote attacker could either access sensitive information or perform a server-side request forgery (SSRF) due to deficiencies in REST API output handling ...

CVE-2019-1888

CVE-2019-1888 affects Cisco Unified Contact Center Express (Unified CCX). Vulnerability in the Administration Web Interface allows an authenticated attacker with valid Administrator credentials to upload arbitrary files containing OS commands, which will be executed on the underlying system. The ...

CVE-2025-20113

CVE-2025-20113 – Cisco Unified Intelligence Center Privilege Escalation : A vulnerability due to insufficient server-side validation of user-supplied parameters in API/HTTP requests can allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions. ...

CVE-2025-20278

CVE-2025-20278 affects Cisco Unified Communications products. The vulnerability is a command-injection flaw in the CLI due to insufficient validation of command arguments, allowing an authenticated local attacker to execute arbitrary OS commands as root on an affected device. Exploitation require...

CVE-2020-3177

Cisco UCS CUCM and SME TAPS path traversal (CVE-2020-3177) is due to insufficient validation of input to the TAPS interface, enabling an unauthenticated attacker to trigger directory traversal and read arbitrary files. Affected components include the Tool for Auto-Registered Phones Support (TAPS)...

CVE-2021-1395

CVE-2021-1395 concerns the web-based management interface of Cisco Unified Intelligence Center, where a reflected XSS vulnerability exists due to improper input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, potentially executing arbitrary script in the...

CVE-2023-20062

CVE-2023-20062 concerns Cisco Unified Intelligence Center. The described issues allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) against an affected system. The root cause is described in connected advisories as improper inpu...

CVE-2019-15259

CVE-2019-15259 affects Cisco Unified Contact Center Express (UCCX) and relates to an HTTP response splitting vulnerability caused by insufficient input validation in certain web-server parameters. An unauthenticated, remote attacker could entice a user to follow a malicious link or intercept a re...

CVE-2023-20096

Cisco Unified Contact Center Express (Unified CCX) contains a stored Cross-Site Scripting (XSS) vulnerability in its web-based management interface due to insufficient input validation. An authenticated, remote attacker could inject crafted input into various management fields to execute scripts ...

CVE-2020-3267

Cisco Unified Contact Center Express (Unified CCX) is affected by an improper API authorization vulnerability. An authenticated attacker with valid agent credentials can send a crafted API call to change the availability state of any agent, potentially causing a denial of service. Root cause: ins...

CVE-2025-20114

CVE-2025-20114 concerns Cisco Unified Intelligence Center API security. The published entries indicate an authenticated, remote attacker could exploit insufficient validation of user-supplied API parameters to perform an insecure direct object reference (IDOR) attack, enabling horizontal privileg...

CVE-2025-20276

CVE-2025-20276 affects Cisco Unified CCX web-based management interface. The root cause is insecure deserialization of Java objects, enabling an authenticated attacker with valid administrative credentials to remotely execute arbitrary code on the device’s OS, with potential to escalate to root. ...

CVE-2025-20279

CVE-2025-20279 affects Cisco Unified CCX (Unified Contact Center Express). The issue is a vulnerability in the web-based management interface where improper sanitization of user input allows an authenticated, remote attacker with valid admin credentials to perform a stored XSS attack. The CVE det...

CVE-2017-12337

CVE-2017-12337 affects Cisco Voice Operating System (Voice OS) upgrade mechanisms. A refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration can leave an engineering flag enabled after completion, potentially allowing an unauthenticated attacker to gain root access with a known pas...

CVE-2025-20129

Cisco CCP (Customer Collaboration Platform) Information Disclosure vulnerability affects the web-based chat interface. An unauthenticated, remote attacker can exploit improper sanitization of HTTP requests to the chat interface, potentially persuading targeted users to disclose sensitive data and...

CVE-2025-20354

Cisco CVE-2025-20354 affects Cisco Unified CCX (Cisco Unified Contact Center Express) via the Java RMI process. The issue allows an unauthenticated, remote attacker to upload arbitrary files and execute commands with root privileges, due to improper authentication mechanisms tied to specific CCX ...

CVE-2017-6779

CVE-2017-6779 affects multiple Cisco VOS-based products (Emergency Responder, Finesse, UCM family, Unity Connection, UIC, SME, UCCx, MediaSense, Prime products, and related). Root cause: system log file has no maximum size limit, enabling an unauthenticated, remote attacker to cause high disk uti...

CVE-2010-1570

Cisco UCCX CTI server DoS vulnerability (CVE-2010-1570) affects CTI server in UCCX 7.0 (before 7.0(1)SR4 and 7.0(2)), 6.0 (before 6.0(1)SR1), and 5.0 (before 5.0(2)SR3). A malformed CTI message triggers the CTI server and Node Manager to fail, logging out all active agents and causing temporary s...

CVE-2020-3280

CVE-2020-3280 affects Cisco Unified Contact Center Express (Unified CCX) via insecure deserialization in the Java Remote Management Interface, enabling an unauthenticated, remote attacker to execute code as root by sending a malicious serialized Java object to a specific listener. Cisco’s advisor...

CVE-2018-0403

CVE-2018-0403 affects Cisco Unified Contact Center Express (Unified CCX) through its web-based management interface. The root cause is the web UI pre-populating the login form password field with previously stored passwords from an internal database, enabling an unauthenticated, remote attacker t...

CVE-2025-20275

Cisco Unified Contact Center Express Editor contains a vulnerability due to insecure Java deserialization in the file-opening flow. An attacker could trigger arbitrary-code execution on the host by convincing a local authenticated user to open a crafted .aef file, running with the user’s privileg...

CVE-2019-12626

CVE-2019-12626 concerns Cisco Unified Contact Center Express (Unified CCX) and its web-based management interface. The issue is a stored cross-site scripting (XSS) vulnerability caused by insufficient validation of user-supplied input, exploitable when an authenticated attacker entices an adminis...

CVE-2017-6722

Cisco Unified Contact Center Express (UCCX) is affected by CVE-2017-6722 via its XMPP service. The issue allows an unauthenticated, remote attacker to masquerade as a legitimate user (Clear Text Authentication Vulnerability) due to how the XMPP service handles authentication. Affected release: 10...

CVE-2025-20277

CVE-2025-20277 concerns Cisco Unified CCX. A path traversal flaw in the web-based management interface allows an authenticated, local attacker with valid admin credentials to execute arbitrary code on the device, potentially escalating to root. The root cause is improper restriction of a pathname...

CVE-2016-6426

The CVE-2016-6426 issue affects Cisco Unified Intelligence Center (CUIC) 8.5.4–9.1(1) as deployed in Unified Contact Center Express 10.0(1)–11.0(1). The vulnerability is in the j_spring_security_switch_user function, allowing remote, unauthenticated attackers to create new user accounts by visiti...

CVE-2018-0400

CVE-2018-0400 concerns Cisco Unified Contact Center Express (Unified CCX) and its web-based management interface. The connected documents confirm a cross-site scripting (XSS) vulnerability that could be exploited by an unauthenticated, remote attacker who entices a user to click a crafted link, e...

CVE-2016-1298

CVE-2016-1298 affects Cisco Unified Contact Center Express (UCCE) up to 11.0(1). The issue is a lack of input validation in the HTTP web-based management interface that handles permalinks, enabling remote attackers to perform cross-site scripting (XSS) by crafting a malicious permalink. This requ...

CVE-2018-0402

Cisco Unified Contact Center Express (Unified CCX) web-based management interface is affected by CVE-2018-0402, a CSRF vulnerability in the interface. Exploitation, as described in the connected Cisco advisory and multiple CNVD/PRION/NVD records, could allow an unauthenticated, remote attacker to...

CVE-2010-1571

CVE-2010-1571 describes a directory traversal in the bootstrap service of Cisco Unified Contact Center Express (UCCX). A crafted bootstrap message to TCP port 6295 can allow an unauthenticated attacker to read arbitrary files on affected systems. Cisco’s advisory shows affected releases across UC...

CVE-2016-6427

The Cisco Unified Intelligence Center (CUIC) CSRF issue (CVE-2016-6427) is fixed in Cisco advisory cisco-sa-20161005-ucis3. Affected CUIC versions 8.5.4–9.1(1), as used with Unified Contact Center Express 10.0(1)–11.0(1), are vulnerable due to insufficient CSRF protections, potentially allowing a...

CVE-2018-0401

Cisco Unified Contact Center Express (Unified CCX) web-based management interface contains multiple vulnerabilities, including cross-site scripting (XSS) due to inadequate input validation, and CSRF and cleartext password exposure as described in Cisco advisory Cisco-SA-20180718-UCCX. Exploitatio...

CVE-2025-20274

The CVE-2025-20274 issue affects Cisco Unified Intelligence Center: a vulnerability in the web-based management interface allows an authenticated remote attacker to upload arbitrary files due to improper validation. This could let an attacker store malicious files and execute arbitrary commands o...

CVE-2016-6425

Cisco CUIC is affected by a cross-site scripting (XSS) vulnerability in CUIC versions 8.5.4 through 9.1(1) when used with Unified CCX 10.0(1) through 11.0(1). The issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL, due to insufficient input validation. Cisco’s ...

CVE-2011-2583

Cisco Unified Contact Center Express (CCX) versions 8.0 and 8.5 are affected by CVE-2011-2583, which allows remote attackers to cause a denial of service via crafted network traffic (Bug CSCth33834). The connected sources confirm the affected product family and the DoS impact but do not provide d...

CVE-2025-20288

CVE-2025-20288 describes a SSRF vulnerability in Cisco Unified Intelligence Center’s web-based management interface. The issue stems from improper input validation of specific HTTP requests, allowing an unauthenticated, remote attacker to cause the affected device to issue arbitrary network reque...

CVE-2025-20374

Technical details about CVE-2025-20374 are not publicly provided in the connected documents. Please monitor for updates from Cisco and Red Hat advisories for affected products, impact scope, and remediation.

CVE-2025-20375

The CVE-2025-20375 issue affects Cisco Unified CCX web UI. An authenticated attacker could upload crafted files due to insufficient input validation in specific UI features, enabling arbitrary file upload and execution on the underlying OS. Exploitation requires valid administrative credentials. ...

CVE-2026-20117

CVE-2026-20117 affects Cisco Unified Contact Center Express (Unified CCX) via the web-based management interface. The root cause is insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to perform cross-site scripting (XSS) by injecting malicious code into c...

CVE-2025-20376

The collection shows CVE-2025-20376 affecting Cisco Unified CCX web UI, due to insufficient input validation in the file upload mechanism. An authenticated, remote attacker could upload a malicious file via the web UI and execute arbitrary commands on the underlying system, with potential privile...

CVE-2025-20358

CVE-2025-20358 applies to Cisco Unified CCX: CCX Editor authentication bypass due to improper authentication in the CCX Editor–Unified CCX server communication. An unauthenticated remote attacker could redirect the authentication flow to a malicious server and trick the editor into granting admin...