CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2018-0124
https://notcve.org/view.php?id=CVE-2018-0124
A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). • http://www.securityfocus.com/bid/103114 http://www.securitytracker.com/id/1040405 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdm • CWE-320: Key Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1354
https://notcve.org/view.php?id=CVE-2016-1354
Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 8.x before 8.1.1 allows remote attackers to inject arbitrary web script or HTML via crafted markup data, aka Bug ID CSCud41176. Vulnerabilidad de XSS en Cisco Unified Communications Domain Manager (UCDM) 8.x en versiones anteriores a 8.1.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de datos markup manipulados, también conocida como Bug ID CSCud41176. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-cucdm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8018
https://notcve.org/view.php?id=CVE-2014-8018
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur19630, and CSCur19661. Múltiples vulnerabilidades XSS en BetkQ Access Manager (NAM) 4.x anterior a 4.1 permite a atacantes remotos inyectar scripts o HTML arbitrario mediante (1) un parámetro arbitrario hacia roma/jsp/debug/debug.jsp o (2) un parámetro arbitrario en la acción debug.DumpAll hacia nps/servlet/webacc, un problema distinto de CVE-2014-5216. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8018 http://www.securityfocus.com/bid/71771 http://www.securitytracker.com/id/1031424 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8010
https://notcve.org/view.php?id=CVE-2014-8010
The web framework in Cisco Unified Communications Domain Manager 8 allows remote authenticated administrators to execute arbitrary OS commands via crafted values, aka Bug ID CSCuq50205. El Framework web en Cisco Unified Communications Domain Manager 8 permite a administradores remotos autenticados ejecutar comandos OS arbitrarios a través de valores manipulados, también conocido como Bug ID CSCuq50205. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8010 http://www.securitytracker.com/id/1031339 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2014-3337
https://notcve.org/view.php?id=CVE-2014-3337
The SIP implementation in Cisco Unified Communications Manager (CM) 8.6(.2) and earlier allows remote authenticated users to cause a denial of service (process crash) via a crafted SIP message that is not properly handled during processing of an XML document, aka Bug ID CSCtq76428. La implementación SIP en Cisco Unified Communications Manager (CM) 8.6(.2) y anteriores permite a usuarios remotos autenticados causar una denegación de servicio (caída del proceso) a través de un mensaje SIP manipulado que no se maneja debidamente durante el procesamiento de un documento XML, también conocido como Bug ID CSCtq76428. • http://secunia.com/advisories/60088 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3337 http://tools.cisco.com/security/center/viewAlert.x?alertId=35257 http://www.securityfocus.com/bid/69177 http://www.securitytracker.com/id/1030709 https://exchange.xforce.ibmcloud.com/vulnerabilities/95245 • CWE-20: Improper Input Validation •