CVE-2013-1168

CVE-2013-1168 affects Cisco Unified MeetingPlace Application Server. The web server components for 7.x (before 7.1MR1 Patch 2), 8.0 (before 8.0MR1 Patch 1), and 8.5 (before 8.5MR3 Patch 1) fail to invalidate a user session on logout, enabling potential session hijacking through knowledge of a val...

CVE-2007-1467

The CVE-2007-1467 entry describes multiple cross-site scripting (XSS) vulnerabilities affecting Cisco Secure Access Control Server and related Cisco products. The root issue is insufficient input filtering in the search form used by PreSearch.html and PreSearch.class, allowing remote attackers to...

CVE-2010-0142

CVE-2010-0142 concerns a privilege-escalation flaw in Cisco Unified MeetingPlace’s MeetingTime component. According to Cisco’s advisory, remote authenticated users could alter the MeetingTime authentication sequence to elevate privileges to administrator via manipulated packets, enabling access t...

CVE-2012-0337

CVE-2012-0337 affects Cisco Unified MeetingPlace Web Conferencing (7.1) where the web component is vulnerable to a SQL injection via crafted input. The root cause is insufficient validation of user-supplied input to the web interface (notably an HTTP POST path per Cisco advisory), enabling an att...

CVE-2009-0743

The CVE-2009-0743 issue is an XSS vulnerability in Cisco Unified MeetingPlace Web Conferencing’s Web Server, specifically on the edit account page. The flaw allows remote authenticated users to inject arbitrary web script or HTML via the E-mail Address field in versions 6.0 prior to 6.0(517.0) (6...

CVE-2010-0141

This CVE-2010-0141 affects Cisco Unified MeetingPlace, where MeetingTime authentication weaknesses allow remote attackers to enumerate usernames and passwords from the user database via a manipulated authentication sequence to the Audio Server (Bug CSCsv76935). The Red Hat and NVD entries corrobo...

CVE-2013-1128

CVE-2013-1128 affects Cisco Unified MeetingPlace Server prior to version 7.1(2.2000). The issue is a set of cross-site request forgery (CSRF) vulnerabilities caused by insufficient sanitization of user-supplied input, allowing an unauthenticated, remote attacker to hijack the authentication of vi...

CVE-2010-0139

Cisco CVE-2010-0139 affects Cisco Unified MeetingPlace versions 5, 6, and 7. The root cause is insufficient validation of SQL commands, allowing unauthenticated remote attackers to create, modify, or delete data in the MeetingPlace database via unspecified vectors. In practice, Cisco’s advisory l...

CVE-2015-4214

Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) are affected by an information-disclosure vulnerability that lets an authenticated remote user read HTML source to obtain plaintext passwords (Bug CSCuu33050). The issue arises from how passwords are exposed in page source, enabling plaintext discl...

CVE-2010-0140

CVE-2010-0140 concerns Cisco Unified MeetingPlace web server vulnerabilities that allow an unauthenticated attacker to create a regular user or an administrator account via a crafted URL to the internal interface. The vulnerability is documented as part of Cisco Bug IDs CSCtc59231 and CSCtd40661....

CVE-2013-5494

Cisco CVE-2013-5494 concerns a CSRF vulnerability in the Cisco Unified MeetingPlace Solution web framework (used by Unified MeetingPlace Web Conferencing and Unified MeetingPlace). The root cause is insufficient CSRF protections in the web framework code, enabling an unauthenticated, remote attac...

CVE-2015-0705

CVE-2015-0705 is a CSRF vulnerability in the SOAP API endpoints of the Cisco Unified MeetingPlace web-services directory, version 8.6(1.9). An attacker could hijack administrator authentication to create new admin accounts (Bug ID CSCus97494). Public details in the provided documents confirm the ...

CVE-2015-4233

Cisco Unified MeetingPlace 8.6(1.2) is affected by CVE-2015-4233: an authenticated remote attacker can exploit a SQL injection by sending crafted SQL statements due to improper input sanitization, potentially reading/modifying/deleting database data. The root cause is failure to properly validate...

CVE-2015-0758

Cisco Unified MeetingPlace 8.6(1.9) is affected by CVE-2015-0758 via an XML External Entity (XXE) processing flaw that allows authenticated, remote attackers to read arbitrary files from the server. The vulnerability stems from improper handling of XML entities in the web-based user interface, as...

CVE-2015-0763

CVE-2015-0763 affects Cisco Unified MeetingPlace 8.6(1.2). The vulnerability arises because the product does not properly validate session IDs in HTTP URLs, enabling a remote attacker to obtain sensitive session information via a crafted URL. The issue is an information-disclosure flaw (not a den...

CVE-2015-0703

Cisco Unified MeetingPlace 8.6(1.9) admin web interface is affected by a reflected cross-site scripting (XSS) vulnerability. The issue stems from improper validation of user-supplied input, allowing an unauthenticated, remote attacker to craft a malicious link that executes arbitrary JavaScript/H...

CVE-2015-0762

Cisco Unified MeetingPlace for Microsoft Outlook is vulnerable to a reflected XSS in the management interface for versions 8.6(1.2) and 8.6(1.9) due to insufficient input validation of a URL parameter. An unauthenticated, remote attacker could entice a user to click a crafted link to execute arbi...

CVE-2013-5495

Cisco Unified MeetingPlace Application Server Web Framework contains a cross-site scripting (XSS) vulnerability (CVE-2013-5495) that lets remote attackers inject arbitrary script/HTML via an unspecified parameter. Affects the web framework component of the Application Server; root cause is insuff...

CVE-2015-0702

The CVE-2015-0702 issue affects Cisco Unified MeetingPlace 8.6(1.9). The vulnerability stems from an unrestricted file upload in the Custom Prompts upload, where the languageShortName parameter can be abused by an authenticated remote user to upload a file that provides shell access, enabling arb...

CVE-2015-0704

CVE-2015-0704 affects Cisco Unified MeetingPlace Server (8.6(1.9)) with CSRF vulnerabilities in API features that allow remote attackers to hijack user authentication. The root cause is insufficient CSRF protections in multiple-state-changing URL API functionalities. Impact, as documented, is use...

CVE-2013-1123

Cisco Unified MeetingPlace Server 7.0 is affected by CVE-2013-1123, a cross-site scripting (XSS) vulnerability caused by insufficient sanitization of user-supplied input. An unauthenticated, remote attacker could entice a user to follow a malicious link that submits crafted requests, allowing exe...

CVE-2015-0764

Cisco Unified MeetingPlace 8.6(1.9) is affected by CVE-2015-0764, where an unauthenticated, remote attacker can read arbitrary files through a crafted resource request. The root cause is improper handling of resource requests by the affected device, enabling arbitrary file download. The vulnerabi...

CVE-2007-5581

Summary: CVE-2007-5581 affects Cisco Unified MeetingPlace (mpweb/scripts/mpx.dll). The vulnerability is a cross-site scripting flaw caused by insufficient validation of the FirstName and LastName parameters, allowing remote attackers to inject script/HTML into a user’s browser session in MeetingP...

CVE-2012-5416

CVE-2012-5416 affects Cisco Unified MeetingPlace Web Conferencing prior to 7.1MR1 Patch 1, 8.0 prior to 8.0MR1 Patch 1, and 8.5 prior to 8.5MR3. The issue is a buffer overflow leading to a denial of service (daemon hang) when processing unspecified parameters in a POST request. CVSSv2 base score ...

CVE-2011-4232

Cisco Unified MeetingPlace 6.1 and 8.5 contain a directory enumeration vulnerability where the web server returns different responses for directory queries depending on existence. This allows unauthenticated, remote attackers to enumerate directory names. The root cause is described as an unspeci...