CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

CVE-2023-20058

Cisco Unified Intelligence Center is affected by a reflected XSS in its web-based management interface. The issue arises from inadequate input validation, allowing an unauthenticated, remote attacker to lure a user into clicking a crafted link, which could execute arbitrary script code in the int...

CVE-2021-1463

The CVE-2021-1463 issue affects Cisco Unified Intelligence Center Software (web-based management interface). It is a Cross-Site Scripting (XSS) vulnerability caused by insufficient validation of user-supplied input. An unauthenticated, remote attacker could lure a user to click a crafted link, ex...

CVE-2023-20061

Cisco Unified Intelligence Center (CUIC) is affected by CVE-2023-20061 (and related CVE-2023-20062 per Cisco advisory) where an authenticated, remote attacker could either access sensitive information or perform a server-side request forgery (SSRF) due to deficiencies in REST API output handling ...

CVE-2025-20113

CVE-2025-20113 – Cisco Unified Intelligence Center Privilege Escalation : A vulnerability due to insufficient server-side validation of user-supplied parameters in API/HTTP requests can allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions. ...

CVE-2025-20278

CVE-2025-20278 affects Cisco Unified Communications products. The vulnerability is a command-injection flaw in the CLI due to insufficient validation of command arguments, allowing an authenticated local attacker to execute arbitrary OS commands as root on an affected device. Exploitation require...

CVE-2021-1395

CVE-2021-1395 concerns the web-based management interface of Cisco Unified Intelligence Center, where a reflected XSS vulnerability exists due to improper input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, potentially executing arbitrary script in the...

CVE-2023-20062

CVE-2023-20062 concerns Cisco Unified Intelligence Center. The described issues allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) against an affected system. The root cause is described in connected advisories as improper inpu...

CVE-2017-6789

CVE-2017-6789 affects Cisco Unified Intelligence Center (CUIC). The vulnerability is a DOM-based, environment or client-side XSS resulting from unvalidated user-supplied data in the DOM input, exploitable by sending crafted URLs to the affected system. A successful exploit could allow an unauthen...

CVE-2024-20325

Cisco’s CVE-2024-20325 affects the Live Data server in Cisco Unified Intelligence Center. The issue arises from insufficient access control on cluster-configuration CLI requests, allowing an unauthenticated, local attacker to send privileged commands to specific directories and read/modify data i...

CVE-2025-20114

CVE-2025-20114 concerns Cisco Unified Intelligence Center API security. The published entries indicate an authenticated, remote attacker could exploit insufficient validation of user-supplied API parameters to perform an insecure direct object reference (IDOR) attack, enabling horizontal privileg...

CVE-2017-12254

CVE-2017-12254 affects Cisco Unified Intelligence Center web interface. Root cause: insufficient input validation of parameters passed to the web server, enabling a DOM-based cross-site scripting attack by unauthenticated remote attackers (via malicious link or intercepted request). Impact descri...

CVE-2017-12337

CVE-2017-12337 affects Cisco Voice Operating System (Voice OS) upgrade mechanisms. A refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration can leave an engineering flag enabled after completion, potentially allowing an unauthenticated attacker to gain root access with a known pas...

CVE-2017-12248

CVE-2017-12248 concerns Cisco Unified Intelligence Center Software. The issue is a cross-site scripting (XSS) vulnerability caused by insufficient input validation in the web framework code, allowing an unauthenticated, remote attacker to craft a malicious link or intercept a user request to inje...

CVE-2017-6779

CVE-2017-6779 affects multiple Cisco VOS-based products (Emergency Responder, Finesse, UCM family, Unity Connection, UIC, SME, UCCx, MediaSense, Prime products, and related). Root cause: system log file has no maximum size limit, enabling an unauthenticated, remote attacker to cause high disk uti...

CVE-2015-0740

CVE-2015-0740 is a CSRF vulnerability in Cisco Unified Intelligence Center 10.6(1) (Bug ID CSCus28826). The issue arises from insufficient validation of user input on the web interface, enabling an unauthenticated, remote attacker to hijack the authentication of arbitrary users. Impact is describ...

CVE-2016-6426

The CVE-2016-6426 issue affects Cisco Unified Intelligence Center (CUIC) 8.5.4–9.1(1) as deployed in Unified Contact Center Express 10.0(1)–11.0(1). The vulnerability is in the j_spring_security_switch_user function, allowing remote, unauthenticated attackers to create new user accounts by visiti...

CVE-2019-1670

Cisco Unified Intelligence Center Software contains a web-interface cross-site scripting (XSS) vulnerability (CVE-2019-1670) due to insufficient input validation. An unauthenticated, remote attacker could lure a user into clicking a link, enabling arbitrary requests to be submitted to the affecte...

CVE-2019-1860

CVE-2019-1860 concerns Cisco Unified Intelligence Center. Affects the dashboard gadget rendering where lack of gadget validation lets an unauthenticated, remote attacker coerce users to load a malicious gadget, enabling access to or manipulation of sensitive information between a user’s browser a...

CVE-2016-6427

The Cisco Unified Intelligence Center (CUIC) CSRF issue (CVE-2016-6427) is fixed in Cisco advisory cisco-sa-20161005-ucis3. Affected CUIC versions 8.5.4–9.1(1), as used with Unified Contact Center Express 10.0(1)–11.0(1), are vulnerable due to insufficient CSRF protections, potentially allowing a...

CVE-2015-4274

Cisco Unified Intelligence Center (UC) web framework versions 10.0(1)–10.6(1) are affected by a Cross-Site Request Forgery (CSRF) vulnerability that can let remote attackers hijack user sessions and perform arbitrary actions within the context of an authenticated user. The root cause is insuffici...

CVE-2017-12253

CVE-2017-12253 affects Cisco Unified Intelligence Center (CUIC). The issue is a cross-site request forgery (CSRF) vulnerability in the CUIC web UI due to missing CSRF protections. An unauthenticated, remote attacker could trick a logged-in user into performing unintended actions in CUIC by visiti...

CVE-2025-20274

The CVE-2025-20274 issue affects Cisco Unified Intelligence Center: a vulnerability in the web-based management interface allows an authenticated remote attacker to upload arbitrary files due to improper validation. This could let an attacker store malicious files and execute arbitrary commands o...

CVE-2016-6425

Cisco CUIC is affected by a cross-site scripting (XSS) vulnerability in CUIC versions 8.5.4 through 9.1(1) when used with Unified CCX 10.0(1) through 11.0(1). The issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL, due to insufficient input validation. Cisco’s ...

CVE-2019-1658

Cisco Unified Intelligence Center suffers CSRF due to insufficient protections in its web-based management interface, allowing unauthenticated, remote attackers to induce victims to perform arbitrary actions via a browser with user privileges. Exploitation requires user interaction (phishing-like...

CVE-2025-20288

CVE-2025-20288 describes a SSRF vulnerability in Cisco Unified Intelligence Center’s web-based management interface. The issue stems from improper input validation of specific HTTP requests, allowing an unauthenticated, remote attacker to cause the affected device to issue arbitrary network reque...