CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2019-16017

CVE-2019-16017 affects Cisco Unified CVP OAMP OpsConsole Server. The issue arises from insufficient input validation on specific OAMP pages, allowing an authenticated attacker to perform Insecure Direct Object Reference actions. Impact in documented details includes information disclosure beyond ...

CVE-2018-0086

CVE-2018-0086 affects Cisco Unified CVP (Cisco Unified Customer Voice Portal). The issue is triggered by malformed SIP INVITE traffic during CVP communications with the Cisco Virtualized Voice Browser (VVB), allowing an unauthenticated remote attacker to cause a denial of service on the affected ...

CVE-2014-3325

CVE-2014-3325 concerns multiple cross-site scripting (XSS) vulnerabilities in the Cisco Unified Customer Voice Portal (CVP) web interface. The root cause is insufficient input validation of a parameter used by web pages, enabling remote attackers to inject arbitrary script/HTML via crafted input....

CVE-2020-3402

Cisco CVP CVE-2020-3402 affects the Java RMI interface of the Cisco Unified Customer Voice Portal. The root cause is that certain RMI listeners are not properly authenticated, allowing an unauthenticated, remote attacker to access sensitive information on an affected device by sending a crafted r...

CVE-2013-1220

CVE-2013-1220 affects Cisco Unified CVP (CallServer) prior to 9.0.1 ES 11, where remote attackers can trigger a denial of service (call-acceptance outage) by sending malformed SIP INVITE messages. The vulnerability is documented in Cisco advisory cisco-sa-20130508-cvp and is confirmed in multiple...

CVE-2013-1225

The CVE-2013-1225 issue affects Cisco Unified CVP Software prior to 9.0.1 ES 11. It is an XML External Entity (XXE) vulnerability in the Resource Manager reachable via HTTP/HTTPS, allowing remote attackers to read arbitrary files. The root cause is an XXE processing flaw in the file/HTTP(S) reque...

CVE-2015-0735

CVE-2015-0735 affects Cisco Unified CVP 10.5(1). The vulnerability is a Cross-Site Request Forgery (CSRF) flaw caused by insufficient CSRF protections, enabling an unauthenticated, remote attacker to coerce a logged-in user to perform actions in the browser (in the context of that user). No softw...

CVE-2017-12214

CVE-2017-12214 describes an elevation-of-privilege flaw in the Cisco Unified CVP OAMP credential reset, arising from insufficient input validation. An authenticated, remote attacker could exploit a crafted HTTP request to gain administrator privileges on CVP systems running 10.5, 11.0, or 11.5. E...

CVE-2013-1223

The CVE-2013-1223 issue affects Cisco Unified CVP Software prior to 9.0.1 ES 11, where the log viewer does not properly validate an unspecified parameter, enabling remote attackers to read arbitrary files via a crafted HTTP or HTTPS request. The vulnerability arises from improper input validation...

CVE-2021-1599

Cisco CVP's web-based management interface is affected by CVE-2021-1599 via insufficient input validation of a parameter, enabling an authenticated remote attacker to perform cross-site scripting. Exploitation could lead to arbitrary code execution in the interface, access to browser-based data, ...

CVE-2018-0139

The CVE-2018-0139 issue affects Cisco Unified Customer Voice Portal (CVP) IVR management connection interface. An unauthenticated remote attacker can cause the IVR-CVP connection to disconnect, resulting in a system-wide DoS by disrupting new call handling. Root cause: improper handling of TCP co...

CVE-2008-2053

CVE-2008-2053 affects Cisco Unified Customer Voice Portal (CVP) software. A vulnerability allows an administrator-level user to create, modify, or delete a superuser account, effectively gaining full system control. Affected CVP releases are 4.0.x before 4.0(2)_ES14, 4.1.x before 4.1(1)_ES11, and...

CVE-2013-1222

The CVE-2013-1222 issue affects Cisco Unified Customer Voice Portal (CVP) Software prior to 9.0.1 ES 11, where the Tomcat Web Management feature does not properly configure Tomcat components. This allows remote attackers to launch arbitrary custom web applications via a crafted HTTP or HTTPS requ...

CVE-2013-1224

CVE-2013-1224 affects Cisco Unified CVP (Resource Manager) prior to 9.0.1 ES 11. A directory traversal flaw allows remote attackers to overwrite arbitrary files by sending crafted HTTP or HTTPS requests that bypass parameter validation (Bug CSCub38369). The issue is tied to the Resource Manager c...

CVE-2013-1221

CVE-2013-1221 affects Cisco Unified CVP (Tomcat Web Management) prior to 9.0.1 ES 11. The vulnerability arises from improper Tomcat component configuration, enabling remote code execution via crafted HTTP or HTTPS requests. Impact is consistent with a full compromise of affected CVP deployments. ...