CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-1478 – Cisco Unified Communications Manager Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-1478
06 May 2021 — A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. This vulnerability is due to an unsecured TCP/IP port. An attacker could exploit this vulnerability by accessing the port and restarting the JMX process. A successful exploit could allow the att... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-dos-OO4SRYEf • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-3124 – Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2020-3124
23 Sep 2020 — A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could change the pas... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-hcm-f-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-3256 – Cisco Hosted Collaboration Mediation Fulfillment XML External Expansion Vulnerability
https://notcve.org/view.php?id=CVE-2020-3256
06 May 2020 — A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administrative privileges on the Cisco HCM-F Software. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability b... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hcmf-xxe-qqCMAUJ2 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-15401 – Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2018-15401
05 Oct 2018 — A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attac... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hcmf-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-6454
https://notcve.org/view.php?id=CVE-2016-6454
03 Nov 2016 — A cross-site request forgery (CSRF) vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an unauthenticated, remote attacker to execute unwanted actions. More Information: CSCva54241. Known Affected Releases: 11.5(1). Known Fixed Releases: 11.5(0.98000.216). Una vulnerabilidad de CSRF en la interfaz web de la aplicación Cisco Hosted Collaboration Mediation Fulfillment podría permitir a un atacante remoto no autenticado ejecutar acciones no desead... • http://www.securityfocus.com/bid/93916 • CWE-352: Cross-Site Request Forgery (CSRF) •