CVE-2011-2738

CVE-2011-2738 is a buffer overflow remote code execution vulnerability affecting Cisco Unified Service Monitor and Cisco Unified Operations Manager (and associated EMC Ionix products). Exploitation occurs by sending crafted packets to TCP port 9002, taking advantage of a flaw in handling SMARTS/ ...

CVE-2009-1161

CVE-2009-1161 describes a directory traversal vulnerability in CiscoWorks Common Services (CWCS) 3.0.x–3.2.x on Windows when the TFTP service is enabled. An unauthenticated remote attacker could access arbitrary files via CWCS TFTP, affecting multiple Cisco products that rely on CWCS (e.g., Unifi...

CVE-2011-0962

Cisco Unified Operations Manager (CUOM) vulnerability CVE-2011-0962 affects the Common Services Device Center, specifically the CSConm/servlet/com.cisco.nm.help.ServerHelpEngine handling the tag parameter. The issue is a cross-site scripting (XSS) flaw that could allow an attacker to inject arbit...

CVE-2011-0960

Cisco Unified Operations Manager (CuOM) before 8.6 is affected by multiple vulnerabilities including blind SQL injection in two endpoints: PRTestCreation.do ( CCMs parameter ) and TelePresenceReportAction.do ( ccm parameter ). Exploitation could allow remote attackers to execute arbitrary SQL com...

CVE-2013-3437

Cisco Unified Operations Manager (UOM) suffers a SQL injection vulnerability in the management application (Bug CSCud80179). An authenticated remote attacker can submit crafted input via an entry field to execute arbitrary SQL commands. The issue stems from improper validation of user-supplied in...

CVE-2011-0959

Cisco Unified Operations Manager (CuOM) prior to v8.6 contains multiple cross-site scripting vulnerabilities (CVE-2011-0959) that allow remote attackers to inject arbitrary scripts via parameters in URLs such as extn (iptm/advancedfind.do), deviceInstanceName (iptm/ddv.do), cmd/group (iptm/eventm...

CVE-2010-3036

CiscoWorks Common Services web server module contains multiple buffer overflows in the Cisco-developed authentication code, enabling remote, unauthenticated code execution with system administrator privileges via sessions on TCP ports 443 or 1741. Affected: CiscoWorks Common Services prior to ver...

CVE-2013-3440

Cisco Unified Operations Manager’s administrative web interface contains multiple XSS vulnerabilities (CVE-2013-3440) due to improper input validation and weak cookie protections. An unauthenticated, remote attacker could lure a user to a crafted URL to execute arbitrary script or hijack sessions...

CVE-2013-5488

Cisco Common Services (used in Cisco Prime LMS, Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager) fails to properly interact with ActiveMQ, allowing an unauthenticated remote attacker to cause memory-based DoS by opening multiple concurrent TCP sessions....

CVE-2013-3439

The CVE-2013-3439 issue affects Cisco Unified Operations Manager and is described as an HTTP header injection vulnerability that permits cross-site scripting (XSS) via a crafted URL. The root cause is improper validation of application URLs in the web interface, enabling an unauthenticated or rem...

CVE-2013-3416

CVE-2013-3416 describes an XSS vulnerability in the web framework of Cisco Unified Operations Manager and Unified Service Monitor. The issue allows an unauthenticated, remote attacker to inject arbitrary web script or HTML via an unspecified parameter in the web interface. Cisco’s advisory confir...