CVE-2018-0110

CVE-2018-0110 affects Cisco WebEx Meetings Server. A design flaw prevents disabling access to configured remote support accounts after web-admin action, enabling an authenticated, remote attacker to connect to the remote support account, modify server configuration and gain access to customer dat...

CVE-2018-15411

The CVE-2018-15411 issue affects Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows. The root cause is improper validation of ARF/WRF files, allowing arbitrary code execution when a user opens a malicious ARF/WRF file (via link or email attachment). Exploitation r...

CVE-2020-3501

Cisco Webex Meetings Desktop App has CVE-2020-3501 describing information disclosure due to improper input validation of parameters returned from a website. An authenticated, remote attacker could lure a user to a crafted URL to access restricted information from other Webex users. Multiple sourc...

CVE-2013-5529

CVE-2013-5529 affects the deployment module of Cisco WebEx Meeting Center. The vulnerability is a validation flaw in the passphrase check, enabling an unauthenticated, remote attacker to either start a deployment or interrupt an existing deployment via a direct request. The issue is tied to CSCuf...

CVE-2014-3296

Cisco WebEx Meeting Server 1.5(.1.131) and earlier contains an XML PI vulnerability that allows remote authenticated users to obtain sensitive meeting information via a crafted URL (Bug CSCum03527). The issue is an information disclosure in the XML programmatic interface, exploitable by an authen...

CVE-2015-0596

A CSRF vulnerability (CVE-2015-0596) affects Cisco WebEx Meetings Server 1.5(.1.131) and earlier, allowing remote attackers to hijack user authentication under Bug ID CSCuj67163. Cisco released a security advisory; exploitation details are not fully provided in the initial documents, but multiple...

CVE-2016-1484

Cisco WebEx Meetings Server 2.6 is affected by CVE-2016-1484, a remote information-disclosure vulnerability caused by lack of proper authentication controls that allows unauthenticated remote attackers to bypass access restrictions and obtain sensitive application information. CVSS scores in the ...

CVE-2017-6651

Cisco WebEx Meetings Server suffers an information-disclosure vulnerability due to an incomplete robots.txt configuration when Short URL is not activated. Affected releases are 2.5, 2.6, 2.7, and 2.8; later than 2.5MR4 includes Short URL functionality, which mitigates the exposed parameter path u...

CVE-2018-15412

CVE-2018-15412 affects Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows. The issue arises from improper validation of ARF/WRF files, enabling an attacker to execute arbitrary code by delivering a malicious ARF/WRF file via link or email and convincing a user to ...

CVE-2019-1641

Cisco Webex Network Recording Player and Webex Player for Windows are affected by CVE-2019-1641. The issue stems from improper validation of ARF/WRF files, enabling arbitrary code execution when a user opens a malicious ARF/WRF file delivered via link or email attachment. Exploitation is describe...

CVE-2014-3304

Cisco WebEx Meetings Server’s OutlookAction Class is vulnerable to unauthenticated remote enumeration of valid user accounts through crafted URL requests due to improper sanitization of returned messages (Bug ID CSCuj81722). The Cisco advisory notes that software updates are not available to fix ...

CVE-2014-3311

Cisco WebEx Meetings Client vulnerability CVE-2014-3311 is a heap-based buffer overflow in the file-sharing feature of the WebEx Meetings Client used with WebEx Meetings Server and WebEx Meeting Center. The root cause is improper bounds checking during data transfer, allowing an unauthenticated r...

CVE-2014-8030

Cisco WebEx Meetings Server contains a Cross-Site Scripting (XSS) vulnerability in the sendPwMail.do page that allows an unauthenticated, remote attacker to inject arbitrary script/HTML via the email parameter. Root cause is improper sanitization of the email parameter. The CVE is CVE-2014-8030. ...

CVE-2014-8032

CVE-2014-8032 concerns Cisco WebEx Meetings Server where the OutlookAction LI may disclose a user’s encrypted password to an authenticated remote attacker. The Cisco advisory states the issue arises from the server returning encrypted password values and that authenticated access (potentially on ...

CVE-2015-0595

CVE-2015-0595 affects Cisco WebEx Meetings Server: the XMLAPI interface allows remote attackers to disclose sensitive information by reading crafted GET return messages. Root cause is improper sanitization of return messages in the XMLAPI (Bug CSCuj67079). Affected are 1.5(.1.131) and earlier rel...

CVE-2017-3794

CVE-2017-3794 – Cisco WebEx Meetings Server CSRF vulnerability : An unauthenticated, remote attacker could exploit CSRF to perform actions in the Admin interface of Cisco WebEx Meetings Server. Affected release information indicates vulnerable 2.6 with a fix in 2.7.1.12. The issue stems from insu...

CVE-2018-15416

CVE-2018-15416 affects Cisco Webex Network Recording Player and Cisco Webex Player for Windows. The root cause is improper validation of ARF/WRF files, enabling a crafted file to trigger arbitrary code execution when a user opens it with the affected software. Attacks require user interaction (ph...

CVE-2016-1447

Cisco WebEx Meetings Server 2.6 is affected by a reflected XSS in the administrator interface (Bug ID CSCuy83194). The issue stems from insufficient input sanitization, allowing an unauthenticated, remote attacker to craft a URL that injects arbitrary script/HTML in an administrator session. Expl...

CVE-2020-3502

Cisco Webex Meetings Desktop App contains information disclosure vulnerabilities in its user interface due to improper input validation of parameters returned from a website. An authenticated remote attacker could lure a user via a crafted URL to extract restricted information from other Webex us...

CVE-2016-1483

CVE-2016-1483 affects Cisco WebEx Meetings Server 2.6. The issue allows unauthenticated remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service (Bug CSCuy92704). Cisco’s advisory cites improper validation o...

CVE-2014-2186

CVE-2014-2186 concerns Cisco WebEx Meetings Server and is described in Cisco’s advisory as a Cross-Site Request Forgery (CSRF) vulnerability arising from insufficient CSRF protections in the web framework. An unauthenticated, remote attacker could entice a logged-in user to follow a malicious lin...

CVE-2019-1639

Cisco Webex Network Recording Player and Webex Player for Windows are affected by a vulnerability in ARF/WRF file parsing that can lead to remote code execution via a crafted ARF/WRF file or link. The ZDI advisory specifies an ARF file out-of-bounds write vulnerability that allows code execution ...

CVE-2014-3286

CVE-2014-3286 affects Cisco WebEx Meetings Server. The vulnerability resides in the web framework’s handling of reply messages, where improper sanitization allows an unauthenticated, remote attacker to enumerate valid user accounts by sending crafted URLs. Cisco's advisory confirms the issue and ...

CVE-2014-3302

CVE-2014-3302 affects Cisco WebEx Meetings Server (1.5(.1.131) and earlier) in the user.php script. The root cause is an invalid token timer for authenticated encryption, allowing unauthenticated, remote attackers to view sensitive information via crafted URL requests. Exploitation described as u...

CVE-2014-3400

CVE-2014-3400 affects Cisco WebEx Meetings Server. Remote authenticated users can obtain sensitive information by reading logs. The description ties the issue to Bug IDs CSCuq36417 and CSCuq40344. No specific root cause, affected versions, exploit details, or remediation are provided in the conne...

CVE-2014-8031

CVE-2014-8031 affects Cisco WebEx Meetings Server and is linked to a CSRF in the web framework due to insufficient CSRF protections. An unauthenticated, remote attacker could trick an authenticated user into following a malicious link to perform the action on behalf of that user, effectively hija...

CVE-2014-8033

The CVE-2014-8033 issue affects Cisco WebEx Meetings Server, specifically the play/modules component. It enables an unauthenticated, remote attacker to gain administrator privileges by sending crafted API requests to a vulnerable device, due to an exposed API. Impact described as administrator ac...

CVE-2015-0597

Cisco WebEx Meetings Server vulnerability CVE-2015-0597 allows remote attackers to enumerate administrator accounts via crafted packets in the Forgot Password process. Affected are Cisco WebEx Meetings Server 1.5(.1.131) and earlier. The root cause is insufficient input validation, enabling unaut...

CVE-2016-1449

Cisco WebEx Meetings Server 2.6 is affected by CVE-2016-1449: a reflected XSS caused by insufficient validation of user-supplied input, exploitable via a crafted URL to inject arbitrary script in a user’s context. Cisco’s advisory (Cisco Security Advisory cisco-sa-20160714-wms3) notes that softwa...

CVE-2018-15409

Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows are affected by a vulnerability in ARF/WRF file processing that could allow remote code execution. The root cause is improper validation of ARF/WRF data, enabling an attacker to craft a malicious file or link sent...

CVE-2013-6687

The Cisco WebEx Meetings Server Enterprise License Manager web portal contains a vulnerability where an authenticated, remote attacker can view the cleartext administrator password by reading the page source (Bug CSCul33876). Root cause: the password is included in the source code of the Enterpri...

CVE-2014-3301

The CVE-2014-3301 issue affects Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier, where the ProfileAction controller could disclose sensitive information by inadvertently returning stack traces in responses. Root cause: improper sanitization of returned messages, enabling an unauthentic...

CVE-2015-0634

Cisco WebEx Meetings Server vulnerable to a cross‑site scripting (XSS) in the administrative interface for versions 2.5 and 2.5.0.997. The issue enables remote attackers to inject arbitrary script/HTML via a crafted URL (Bug ID CSCuq86310). Impact is authenticated user impact within the browser c...

CVE-2018-15419

The CVE-2018-15419 issue affects Cisco Webex Network Recording Player and Cisco Webex Player for Windows. The root cause is improper validation of ARF and WRF files, enabling remote code execution when a user opens a malicious ARF/WRF file delivered via a link or email attachment. Impact is arbit...

CVE-2014-8036

CVE-2014-8036 affects the outlookpa component in Cisco WebEx Meetings Server, where improper sanitization/validation of API input enables an unauthenticated, remote attacker to modify the invite list of scheduled meetings via crafted URL requests. The vulnerability stems from insufficient input v...

CVE-2014-3305

CVE-2014-3305 concerns a CSRF vulnerability in the Cisco WebEx Meetings Server web framework (affecting 1.5(.1.131) and earlier). The issue allows remote attackers to hijack the authentication of unspecified victims via unknown vectors (Bug ID CSCuj81735). The core impact is that user sessions co...