CVSS: 7.8EPSS: 2%CPEs: 46EXPL: 0CVE-2009-2864
https://notcve.org/view.php?id=CVE-2009-2864
Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7.0.x before 7.0(2a)su1, and 7.1.x before 7.1(2) allows remote attackers to cause a denial of service (service restart) via malformed SIP messages, aka Bug ID CSCsz95423. Cisco Unified Communications Manager (también conocido como CUCM, antiguamente como CallManager) v5.x anterior a v5.1(3g), v6.x anterior a v6.1(4), v7.0.x anterior a v7.0(2a)su1 y v7.1.x anterior a v7.1(2) permite a usuarios remotos provocar una denegación del servicio (reinicio del servicio) a través de mensajes SIP malformados. También conocido como Bug ID CSCsz95423. • http://osvdb.org/58344 http://secunia.com/advisories/36836 http://tools.cisco.com/security/center/viewAlert.x?alertId=18883 http://www.cisco.com/en/US/products/products_security_advisory09186a0080af8118.shtml http://www.securityfocus.com/bid/36496 http://www.securitytracker.com/id?1022931 http://www.vupen.com/english/advisories/2009/2757 https://exchange.xforce.ibmcloud.com/vulnerabilities/53447 •
CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 1CVE-2008-0026 – Cisco Unified Communications Manager 6.1 - 'key' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0026
SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages. Una vulnerabilidad de la inyección SQL en Cisco Unified CallManager/Communications Manager (CUCM) versiones 5.0/5.1 anteriores a 5.1(3a) y versiones 6.0/6.1 anteriores a 6.1(1a), permite a los usuarios autenticados remotos ejecutar comandos SQL arbitrarios por medio del parámetro key en las páginas de interfaz de (1) administrador y (2) usuario. • https://www.exploit-db.com/exploits/31189 http://secunia.com/advisories/28932 http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml http://www.securityfocus.com/bid/27775 http://www.securitytracker.com/id?1019404 http://www.vupen.com/english/advisories/2008/0542 https://exchange.xforce.ibmcloud.com/vulnerabilities/40484 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 5%CPEs: 6EXPL: 0CVE-2006-5278
https://notcve.org/view.php?id=CVE-2006-5278
Integer overflow in the Real-Time Information Server (RIS) Data Collector service (RisDC.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via crafted packets, resulting in a heap-based buffer overflow. Desbordamiento de entero en Real-Time Information Server (RIS) Data Collector service (RisDC.exe) de Cisco Unified Communications Manager (CUCM, anteriormente denominado CallManager) versiones anteriores a 20070711 permite a atacantes remotos ejecutar código de su elección mediante paquetes manipulados, resultando en un desbordamiento de búfer basado en montículo. • http://secunia.com/advisories/26043 http://securitytracker.com/id?1018369 http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml http://www.iss.net/threats/271.html http://www.osvdb.org/36121 http://www.securityfocus.com/bid/24868 http://www.vupen.com/english/advisories/2007/2512 https://exchange.xforce.ibmcloud.com/vulnerabilities/19057 •