CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15968 – Cisco Unified Communications Domain Manager Persistent Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2019-15968
26 Nov 2019 — A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click ... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-ucdm-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1911 – Cisco Unified Communications Domain Manager Restricted Shell Escape Vulnerability
https://notcve.org/view.php?id=CVE-2019-1911
06 Jul 2019 — A vulnerability in the CLI of Cisco Unified Communications Domain Manager (Cisco Unified CDM) Software could allow an authenticated, local attacker to escape the restricted shell. The vulnerability is due to insufficient input validation of shell commands. An attacker could exploit this vulnerability by executing crafted commands in the shell. A successful exploit could allow the attacker to escape the restricted shell and access commands in the context of the restricted shell user, which does not have root... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-cucdm-rsh • CWE-216: DEPRECATED: Containment Errors (Container Errors) •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-0386
https://notcve.org/view.php?id=CVE-2018-0386
15 Aug 2018 — A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to improper validation of input that is passed to the affected software. An attacker could exploit this vulnerability by persuading a user of the affected software to access a malicious URL. A successful exploit could allow the attacker to access sensitive, browser-based information on the affect... • http://www.securityfocus.com/bid/105113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 12%CPEs: 12EXPL: 0CVE-2017-12337
https://notcve.org/view.php?id=CVE-2017-12337
16 Nov 2017 — A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access ... • http://www.securityfocus.com/bid/101865 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6404
https://notcve.org/view.php?id=CVE-2015-6404
15 Dec 2015 — Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374. Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) no usa RBAC, lo que permite a usuarios remotos autenticados obtener información sensible de credenciales mediante el aprovechamiento de acceso de administrador y hacer solicitudes API de SOAP, también conocido como B... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-hcm • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-6352
https://notcve.org/view.php?id=CVE-2015-6352
30 Oct 2015 — Cisco Unified Communications Domain Manager before 10.6(1) provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to map a filesystem via a series of requests, aka Bug ID CSCut67891. Cisco Unified Communications Domain Manager en versiones anteriores a 10.6(1) proporciona diferentes mensajes de error para intentos de acceso al nombre de ruta dependiendo de si el nombre de ruta existe, lo que permite a atacantes remotos mapear un... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151027-ucd • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-4292
https://notcve.org/view.php?id=CVE-2015-4292
01 Aug 2015 — Cross-site scripting (XSS) vulnerability in the management interface in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuv45818. Vulnerabilidad XSS en la interfaz de administración de Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(2), permite a atacantes remotosinyectar secuencias de comandos web o HTML arbitrarios a través de un valor no especificado, también co... • http://tools.cisco.com/security/center/viewAlert.x?alertId=40214 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-4260
https://notcve.org/view.php?id=CVE-2015-4260
10 Jul 2015 — Cross-site scripting (XSS) vulnerability in Cisco Hosted Collaboration Solution 10.6(1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu14862. Vulnerabilidad de XSS en Cisco Hosted Collaboration Solution, permite a atacantes inyectar secuencias de comandos web arbitrarios o HTML a través de la manipulación de un valor en una Url, también conocido como Bug ID CSCuu14862 • http://tools.cisco.com/security/center/viewAlert.x?alertId=39804 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 0CVE-2015-0750
https://notcve.org/view.php?id=CVE-2015-0750
23 May 2015 — The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786. La interfaz web administrativa en Cisco Hosted Collaboration Solution (HCS) 10.6(1) y anteriores permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través de entradas manipuladas en campos no especificados, también conocido como Bug ID CSCut02786. • http://tools.cisco.com/security/center/viewAlert.x?alertId=38969 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0741
https://notcve.org/view.php?id=CVE-2015-0741
21 May 2015 — Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596. Múltiples vulnerabilidades de CSRF en Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) y anteriores permiten a atacantes remotos secuestrar la autenticación de usuarios arbitrarios, también conocido como Bug ID CSCut04596. • http://tools.cisco.com/security/center/viewAlert.x?alertId=38927 • CWE-352: Cross-Site Request Forgery (CSRF) •