CVE-2017-12257

The CVE-2017-12257 issue is a Cross-Site Scripting (XSS) vulnerability in Cisco WebEx Meetings Server’s web framework caused by insufficient input validation on web parameters. An unauthenticated, remote attacker could lure a user to a malicious link or intercept and modify a request, potentially...

CVE-2017-12295

Cisco WebEx Meetings Server is affected by an information-disclosure vulnerability (CVE-2017-12295) where the HTTP header replies can reveal internal network data to unauthenticated remote attackers. The root cause is exposure of sensitive information in HTTP responses, enabling reconnaissance. T...

CVE-2018-0104

The CVE-2018-0104 issue concerns Cisco WebEx Network Recording Player for ARF files. A remote attacker can trigger arbitrary code execution by sending a user a link or email attachment containing a malicious ARF file and convincing them to open it. Affected products include Cisco WebEx Business S...

CVE-2018-0103

CVE-2018-0103 describes a buffer overflow in Cisco WebEx Network Recording Player when parsing ARF files, permitting arbitrary code execution with local access (per NVD) and potentially remote exploitation via crafted ARF content (per ZDI). Affected: Cisco WebEx Network Recording Player and relat...

CVE-2014-8035

Cisco WebEx Meetings Server’s web framework exposes user enumeration via crafted URL requests. The vulnerability stems from improper sanitization of the returned message, causing different responses depending on whether a username exists. An unauthenticated, remote attacker could enumerate valid ...

CVE-2014-3303

The Cisco WebEx Meetings Server vulnerability CVE-2014-3303 affects the web framework component, where sensitive data can be exposed via query strings. An unauthenticated, remote attacker could view information such as contents of web-server access logs, Referer logs, or browser history by crafti...

CVE-2014-3294

Cisco WebEx Meeting Server is affected by CVE-2014-3294, a vulnerability where sensitive information is exposed in URLs due to improper URL content restrictions. An authenticated remote attacker can view the values in URLs, enabling access to sensitive data via web-server access logs, Referer log...

CVE-2013-1232

The CVE-2013-1232 vulnerability affects Cisco WebEx Node for MCS, WebEx Meetings Server, and WebEx Node for ASR 1000 Series. The issue arises in the HTTP implementation, where unauthenticated remote attackers can trigger reading of uninitialized memory by sending crafted HTTP requests. Impact is ...

CVE-2017-12294

Cisco WebEx Meetings Server is affected by CVE-2017-12294, a cross-site scripting (XSS) vulnerability caused by insufficient input validation in certain web-server parameters. An authenticated, remote attacker could lure a user to a crafted link or intercept a request to inject malicious script, ...

CVE-2013-1231

The CVE-2013-1231 issue affects Cisco WebEx Node for MCS and WebEx Meetings Server where the HTTP implementation allows remote attackers to read cache files via a crafted request. The root cause is insufficient input validation that enables reading cache directory files. Cisco’s Cisco Security Ad...

CVE-2013-1205

CVE-2013-1205 affects the Event Center module of Cisco WebEx Meetings Server. The issue is that certain requests are not authenticated, enabling remote attackers to discover host keys and event passwords via crafted URLs. The vulnerability is described in Cisco’s advisory and related CVE records,...

CVE-2013-3448

Summary: CVE-2013-3448 affects Cisco WebEx Meetings Server. The vulnerability arises because the product does not verify whether a user account is still active, allowing a remote, authenticated attacker to continue performing meeting operations after the user account has been deactivated, effecti...

CVE-2014-0682

Cisco WebEx Meetings Server is affected by CVE-2014-0682. The issue allows remote authenticated users to bypass authorization and either join arbitrary meetings or terminate a meeting without a host role by sending a crafted URL. Root cause: insufficient validation of user-supplied input. Impact:...

CVE-2013-5529

CVE-2013-5529 affects the deployment module of Cisco WebEx Meeting Center. The vulnerability is a validation flaw in the passphrase check, enabling an unauthenticated, remote attacker to either start a deployment or interrupt an existing deployment via a direct request. The issue is tied to CSCuf...

CVE-2014-8030

Cisco WebEx Meetings Server contains a Cross-Site Scripting (XSS) vulnerability in the sendPwMail.do page that allows an unauthenticated, remote attacker to inject arbitrary script/HTML via the email parameter. Root cause is improper sanitization of the email parameter. The CVE is CVE-2014-8030. ...

CVE-2014-3311

Cisco WebEx Meetings Client vulnerability CVE-2014-3311 is a heap-based buffer overflow in the file-sharing feature of the WebEx Meetings Client used with WebEx Meetings Server and WebEx Meeting Center. The root cause is improper bounds checking during data transfer, allowing an unauthenticated r...

CVE-2014-8032

CVE-2014-8032 concerns Cisco WebEx Meetings Server where the OutlookAction LI may disclose a user’s encrypted password to an authenticated remote attacker. The Cisco advisory states the issue arises from the server returning encrypted password values and that authenticated access (potentially on ...

CVE-2014-3304

Cisco WebEx Meetings Server’s OutlookAction Class is vulnerable to unauthenticated remote enumeration of valid user accounts through crafted URL requests due to improper sanitization of returned messages (Bug ID CSCuj81722). The Cisco advisory notes that software updates are not available to fix ...

CVE-2014-2186

CVE-2014-2186 concerns Cisco WebEx Meetings Server and is described in Cisco’s advisory as a Cross-Site Request Forgery (CSRF) vulnerability arising from insufficient CSRF protections in the web framework. An unauthenticated, remote attacker could entice a logged-in user to follow a malicious lin...

CVE-2014-3286

CVE-2014-3286 affects Cisco WebEx Meetings Server. The vulnerability resides in the web framework’s handling of reply messages, where improper sanitization allows an unauthenticated, remote attacker to enumerate valid user accounts by sending crafted URLs. Cisco's advisory confirms the issue and ...

CVE-2014-3310

The Cisco advisory for CVE-2014-3310 reports an authentication-free, remote arbitrary file download vulnerability in the File Transfer feature of WebEx Meetings Client/Server/Meeting Center. The issue arises because the receiving client does not verify that the requested file matches the offered ...

CVE-2014-3400

CVE-2014-3400 affects Cisco WebEx Meetings Server. Remote authenticated users can obtain sensitive information by reading logs. The description ties the issue to Bug IDs CSCuq36417 and CSCuq40344. No specific root cause, affected versions, exploit details, or remediation are provided in the conne...

CVE-2014-8033

The CVE-2014-8033 issue affects Cisco WebEx Meetings Server, specifically the play/modules component. It enables an unauthenticated, remote attacker to gain administrator privileges by sending crafted API requests to a vulnerable device, due to an exposed API. Impact described as administrator ac...

CVE-2013-6687

The Cisco WebEx Meetings Server Enterprise License Manager web portal contains a vulnerability where an authenticated, remote attacker can view the cleartext administrator password by reading the page source (Bug CSCul33876). Root cause: the password is included in the source code of the Enterpri...

CVE-2014-8031

CVE-2014-8031 affects Cisco WebEx Meetings Server and is linked to a CSRF in the web framework due to insufficient CSRF protections. An unauthenticated, remote attacker could trick an authenticated user into following a malicious link to perform the action on behalf of that user, effectively hija...

CVE-2014-8036

CVE-2014-8036 affects the outlookpa component in Cisco WebEx Meetings Server, where improper sanitization/validation of API input enables an unauthenticated, remote attacker to modify the invite list of scheduled meetings via crafted URL requests. The vulnerability stems from insufficient input v...