CVE-2017-3880

CVE-2017-3880 – Cisco WebEx Meetings Server Authentication Bypass . Affected CWMS versions: 2.6, 2.7, 2.8, CWMS-2.5MR1, Orion1.1.2.patch, T29_orion_merge. Description in the connected records confirms an authentication bypass that could let an unauthenticated, remote attacker access limited meeti...

CVE-2018-0111

CVE-2018-0111 concerns Cisco WebEx Meetings Server and is described in multiple sources as an information-disclosure vulnerability that could allow an unauthenticated, remote attacker to access sensitive data about the application. The root cause is a design flaw that could expose internal networ...

CVE-2019-1638

CVE-2019-1638 refers to multiple Cisco Webex-related RCE issues in the Windows players. The root cause is improper validation of ARF/WRF files in the Cisco Webex Network Recording Player and Webex Player for Windows, allowing arbitrary code execution when a user opens a crafted ARF/WRF file or vi...

CVE-2019-1771

CVE-2019-1771 affects Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows. The issue arises from improper validation of ARF/WRF files, enabling an attacker to execute arbitrary code when a user opens a malicious ARF/WRF file delivered via link or email attachment. ...

CVE-2021-1221

The CVE-2021-1221 issue affects Cisco Webex Meetings and Webex Meetings Server UI. It arises from insufficient input validation that lets an authenticated, remote attacker inject a hyperlink into a meeting invitation email by entering a URL into a UI field. A successful exploit could generate an ...

CVE-2015-4281

The CVE-2015-4281 issue affects Cisco WebEx Meetings Server 2.5 MR1 and is caused by insufficient CSRF protections, enabling a remote attacker to hijack user authentication by coercing a logged-in user to visit a malicious page or link. Documents in the connected set (including Cisco advisory Cis...

CVE-2017-12359

Converging sources confirm CVE-2017-12359 is a buffer overflow in the Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files. The vulnerability allows an attacker to achieve arbitrary code execution on a target system by convincing a user to open a malicious .arf file del...

CVE-2018-15410

Cisco Webex Network Recording Player and Cisco Webex Player for Windows are affected by a vulnerability where ARF/WRF file validation is faulty, allowing an attacker who persuades a user to open a malicious file to execute arbitrary code with the user’s privileges. Root cause cited across sources...

CVE-2019-1637

The CVE-2019-1637 issue affects Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows, caused by improper validation of ARF/WRF files. A malicious ARF/WRF file delivered via link or email and opened by the user could allow arbitrary code execution on the affected sys...

CVE-2014-8035

Cisco WebEx Meetings Server’s web framework exposes user enumeration via crafted URL requests. The vulnerability stems from improper sanitization of the returned message, causing different responses depending on whether a username exists. An unauthenticated, remote attacker could enumerate valid ...

CVE-2017-12367

CVE-2017-12367 is a Cisco WebEx Network Recording Player vulnerability in ARF/WRF playback. A remote attacker can deliver a malicious ARF/WRF file (via email or URL) and convince a user to open it, causing the player to crash and, in some cases, potentially allowing arbitrary code execution on th...

CVE-2018-15421

Cisco Webex Network Recording Player and Cisco Webex Player for Windows are affected by CVE-2018-15421 due to improper validation of ARF/WRF files. An attacker can deliver a malicious ARF/WRF file via a link or email attachment and persuade a user to open it, potentially allowing arbitrary code e...

CVE-2018-15422

Cisco Webex Network Recording Player (Windows) and Cisco Webex Player for Windows are affected by ARF/WRF file validation flaws that allow remote code execution when a user opens a malicious ARF/WRF file sent via link or email attachment. The root cause is improper validation of WebEx recording f...

CVE-2014-3303

The Cisco WebEx Meetings Server vulnerability CVE-2014-3303 affects the web framework component, where sensitive data can be exposed via query strings. An unauthenticated, remote attacker could view information such as contents of web-server access logs, Referer logs, or browser history by crafti...

CVE-2014-8034

Cisco WebEx Meetings Server 1.5 is affected by CVE-2014-8034 due to a login CAPTCHA that does not refresh between attempts, enabling unauthenticated remote attackers to perform brute-force username guessing and enumerate valid accounts. Cisco’s advisory confirms the vulnerability and that updated...

CVE-2017-12368

The CVE-2017-12368 entry covers a vulnerability in Cisco WebEx Network Recording Player for ARF/WRF files that enables remote code execution. The flaw is triggered when a user opens a malicious ARF or WRF file delivered via email or a URL, potentially leading to arbitrary code execution on the ta...

CVE-2018-15415

CVE-2018-15415 affects the Cisco Webex Network Recording Player and Cisco Webex Player for Windows. The issue stems from improper validation in ARF/WRF file parsing, allowing an attacker to execute arbitrary code on a vulnerable system. ZDI describes a remote code execution via a crafted ARF file...

CVE-2019-1655

CVE-2019-1655 affects Cisco Webex Meetings Server, specifically the web-based management interface. The vulnerability stems from insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to induce a user to click a malicious link and execute arbitrary script cod...

CVE-2015-0668

CVE-2015-0668 is an XSS vulnerability in the Cisco WebEx Meetings Server administration portal affecting versions 2.5 and 2.5.99.2. The issue arises from insufficient validation of user-supplied input in the admin portal, enabling an unauthenticated, remote attacker to inject arbitrary scripts/HT...

CVE-2015-4276

CVE-2015-4276 affects Cisco WebEx Meetings Server 2.5MR1. The vulnerability arises from insufficient sanitization of user-supplied input, allowing an authenticated, remote attacker to craft a command parameter to execute arbitrary code on the target system. Impact per sources: remote code executi...

CVE-2013-1232

The CVE-2013-1232 vulnerability affects Cisco WebEx Node for MCS, WebEx Meetings Server, and WebEx Node for ASR 1000 Series. The issue arises in the HTTP implementation, where unauthenticated remote attackers can trigger reading of uninitialized memory by sending crafted HTTP requests. Impact is ...

CVE-2014-3294

Cisco WebEx Meeting Server is affected by CVE-2014-3294, a vulnerability where sensitive information is exposed in URLs due to improper URL content restrictions. An authenticated remote attacker can view the values in URLs, enabling access to sensitive data via web-server access logs, Referer log...

CVE-2017-12294

Cisco WebEx Meetings Server is affected by CVE-2017-12294, a cross-site scripting (XSS) vulnerability caused by insufficient input validation in certain web-server parameters. An authenticated, remote attacker could lure a user to a crafted link or intercept a request to inject malicious script, ...

CVE-2017-12363

CVE-2017-12363 affects Cisco WebEx Meeting Server. The vulnerability allows an unauthenticated, remote attacker to modify the welcome message of a meeting due to insufficient security settings on meetings. Connected documents confirm the impact is via modification of meeting welcome messages and ...

CVE-2018-15431

Cisco Webex Network Recording Player and Webex Player for Windows are affected by CVE-2018-15431. The vulnerability arises from improper validation of ARF/WRF files, allowing an attacker to execute arbitrary code on an affected system when a user opens a malicious ARF/WRF file delivered via a lin...

CVE-2019-1772

CVE-2019-1772 affects Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows. Root cause: improper validation of ARF/WRF files, enabling a crafted file to cause arbitrary code execution on the affected system when a user opens it. Exploit path: attacker emails or link...

CVE-2016-1450

Cisco WebEx Meetings Server 2.6 is affected by a remote authenticated command-injection vulnerability tied to file-type handling during uploads (CVE-2016-1450, Bug ID CSCuy92715). The issue allows an authenticated attacker to craft upload content that leads to arbitrary command execution on the s...

CVE-2018-0108

Cisco WebEx Meetings Server is affected by an XML External Entity (XXE) injection allowing an unauthenticated, remote attacker to perform out-of-band data exfiltration. The vulnerability enables disclosure of customer files and can be leveraged to gather information for reconnaissance, with the a...

CVE-2018-15408

CVE-2018-15408 affects Cisco Webex Network Recording Player and Webex Player for Windows. The root cause is improper validation of ARF/WRF files, enabling arbitrary code execution when a user opens a crafted file received via link or email attachment. ZDI details indicate remote code execution wi...

CVE-2013-1231

The CVE-2013-1231 issue affects Cisco WebEx Node for MCS and WebEx Meetings Server where the HTTP implementation allows remote attackers to read cache files via a crafted request. The root cause is insufficient input validation that enables reading cache directory files. Cisco’s Cisco Security Ad...

CVE-2013-3448

Summary: CVE-2013-3448 affects Cisco WebEx Meetings Server. The vulnerability arises because the product does not verify whether a user account is still active, allowing a remote, authenticated attacker to continue performing meeting operations after the user account has been deactivated, effecti...

CVE-2014-0682

Cisco WebEx Meetings Server is affected by CVE-2014-0682. The issue allows remote authenticated users to bypass authorization and either join arbitrary meetings or terminate a meeting without a host role by sending a crafted URL. Root cause: insufficient validation of user-supplied input. Impact:...

CVE-2014-3395

Cisco WebEx Meetings Server (WMS) 2.5 has an unauthenticated remote arbitrary file-download vulnerability (CVE-2014-3395) due to insufficient user-input validation on crafted URLs. Impact: allows downloading arbitrary files to the affected device. Cisco advisory confirms the issue and software up...

CVE-2016-1309

Cisco WebEx Meetings Server 2.5.1.5 is affected by multiple cross-site scripting (XSS) vulnerabilities due to insufficient input validation in the web framework code. An unauthenticated, remote attacker could exploit these flaws by enticing a user to a malicious link or intercepting requests, ena...

CVE-2016-1446

Cisco WebEx Meetings Server 2.6 contains a SQL injection vulnerability exploitable by remote, authenticated users to execute arbitrary SQL commands via unspecified vectors (Bug CSCuy83200). Root cause is lack of input validation in SQL queries. Cisco has released software updates addressing the i...

CVE-2016-1448

CVE-2016-1448 affects Cisco WebEx Meetings Server 2.7. A CSRF vulnerability in the administrator/web interface could allow a remote attacker to submit arbitrary requests and hijack the user’s authenticated session, enabling unauthorized operations. Cisco advisory CISCO-SA-20160714-WMS2 notes upda...

CVE-2016-1482

CVE-2016-1482 affects Cisco WebEx Meetings Server 2.6. The issue is a command-injection vulnerability arising from insufficient sanitization of user-supplied data in existing application scripts (Bug ID CSCuy83130). Exploitation allows a remote, unauthenticated attacker to inject and execute arbi...

CVE-2018-0422

Summary: CVE-2018-0422 affects Cisco Webex Meetings Client for Windows. The vulnerability stems from folder permissions that allow a user to read, write, and execute files in the Webex user directories, enabling an authenticated, local attacker to modify locally stored files and execute code with...

CVE-2018-15414

Cisco Webex Network Recording Player (Windows) and Cisco Webex Player are affected by ARF/WRF file validation flaws that can lead to remote code execution when a user opens a malicious ARF/WRF file sent via link or email attachment. The root cause is improper validation of ARF/WRF files. Impact: ...

CVE-2018-15420

Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows are affected by CVE-2018-15420. The root cause is improper validation of ARF/WRF files, enabling an attacker to execute arbitrary code when a user opens a malicious ARF/WRF file delivered via link or email attachm...

CVE-2013-1205

CVE-2013-1205 affects the Event Center module of Cisco WebEx Meetings Server. The issue is that certain requests are not authenticated, enabling remote attackers to discover host keys and event passwords via crafted URLs. The vulnerability is described in Cisco’s advisory and related CVE records,...

CVE-2017-3796

CVE-2017-3796 affects Cisco WebEx Meetings Server (CWMS). The issue enables an authenticated, remote attacker to trigger predetermined shell commands on other CWMS hosts. The root cause stems from insufficient security configurations of bash in interactive mode, allowing an attacker to execute co...

CVE-2017-3811

CVE-2017-3811 affects Cisco WebEx Meetings Server (CWMS). It is an XML External Entity (XXE) information-disclosure vulnerability where an authenticated, remote attacker can read part of the information stored on the affected system. The underlying issue occurs during XML parsing. Affected releas...

CVE-2018-15417

Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows are affected by a vulnerability where ARF/WRF file validation is improper, enabling arbitrary code execution when a user opens a malicious ARF/WRF file sent via link or attachment. The flaw allows remote code exec...

CVE-2018-15418

CVE-2018-15418 affects Cisco Webex Network Recording Player and Webex Player for Windows. The root cause is improper validation of ARF/WRF files, enabling remote code execution when a user opens a malicious ARF/WRF file delivered via link or email attachment. Impact is arbitrary code execution wi...

CVE-2013-5529

CVE-2013-5529 affects the deployment module of Cisco WebEx Meeting Center. The vulnerability is a validation flaw in the passphrase check, enabling an unauthenticated, remote attacker to either start a deployment or interrupt an existing deployment via a direct request. The issue is tied to CSCuf...

CVE-2014-2199

CVE-2014-2199 affects Cisco WebEx components (Event Center, Meeting Center, Sales Center, Training Center, WebEx Meetings Server 1.5(.1.131) and earlier) and WebEx Business Suite; vulnerable are versions before 27.32.31.16 (27.x), before 28.12.13.18 (28.x), and before 29.5.1.12 (29.x). The vulner...

CVE-2016-1389

Cisco WebEx Meetings Server (CWMS) 2.6 is affected by an Open Redirect vulnerability in the web interface caused by improper input validation. Exploitation could allow remote attackers to redirect users to arbitrary external sites, enabling phishing attacks. The CVE-2016-1389 entry corresponds to...

CVE-2018-0110

CVE-2018-0110 affects Cisco WebEx Meetings Server. A design flaw prevents disabling access to configured remote support accounts after web-admin action, enabling an authenticated, remote attacker to connect to the remote support account, modify server configuration and gain access to customer dat...

CVE-2018-15411

The CVE-2018-15411 issue affects Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows. The root cause is improper validation of ARF/WRF files, allowing arbitrary code execution when a user opens a malicious ARF/WRF file (via link or email attachment). Exploitation r...