CVE-2020-3129

CVE-2020-3129 describes a stored cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Unity Connection Software. The issue arises from insufficient input validation in the interface, allowing an authenticated, remote attacker to supply crafted data that can be s...

CVE-2024-20305

Cisco Unity Connection's web-based management interface is affected by an XSS vulnerability due to improper input validation. An authenticated, remote attacker could lure a user into clicking a crafted link, enabling arbitrary script execution in the user’s browser context or access to sensitive ...

CVE-2021-34701

Cisco CVE-2021-34701 affects Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition (SME), Unified CM IM&P, and Cisco Unity Connection. The issue arises from insufficient validation of user-supplied input in the web-based management interface, enabling authentica...

CVE-2018-15426

CVE-2018-15426 affects Cisco Unity Connection’s web-based interface. The issue is a stored XSS vulnerability caused by insufficient validation of user-supplied input, exploitable when a user clicks a crafted link, potentially allowing arbitrary script execution in the interface context or access ...

CVE-2014-2145

Cisco Unity Connection contains a directory traversal vulnerability in its messaging API (CVE-2014-2145). An authenticated, remote attacker can read arbitrary files by exploiting insufficient input filtering and relaxed restrictions on file types beyond .wav, via the audio/x-wav MIME type. Impact...

CVE-2014-7988

CVE-2014-7988 affects the Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier. The vulnerability allows remote authenticated users to obtain sensitive information by reading logs (information disclosure due to sensitive data in logs, Bug CSCur06493). An attacker must authen...

CVE-2015-6390

Cisco Unity Connection 9.1(1.10) management interface vulnerable to cross-site scripting (XSS) via crafted URLs. Root cause: insufficient input validation. Impact: partial integrity exposure; no explicit availability impact. Exploitation details: remote attacker could inject arbitrary script in t...

CVE-2013-5534

CVE-2013-5534 concerns Cisco Unity Connection’s VMWS attachment service. A directory traversal flaw in the VMWS/Nube (Voice Message Web Service) allows an authenticated remote user to craft file names that bypass validation, enabling placement of attacker-controlled files and, in some cases, arbi...

CVE-2014-2125

Cisco Unity Connection Web Inbox v8.6(2a)SU3 and earlier are affected by a cross-site scripting (XSS) vulnerability caused by insufficient input validation on a web inbox parameter. An unauthenticated, remote attacker could lure a user to a crafted link, allowing execution of arbitrary HTML/JavaS...

CVE-2012-3096

Cisco Unity Connection (UC) versions 7.1, 8.0, and 8.5 are affected by CVE-2012-3096. The advisory states that remote authenticated users can trigger a denial of service (resource consumption and administration outage) through extended use of the product, identified as Bug ID CSCtd79132. The avai...

CVE-2026-20060

CVE-2026-20060 affects Cisco Unity Connection’s web-based management interface. It is a open-redirect vulnerability caused by improper input validation of HTTP request parameters, enabling an unauthenticated, remote attacker to persuade a user to click a crafted link and be redirected to a malici...