NotCVE - vendor:"Cisco" product:"Unified Communications Manager Im And Presence Service" version:"9.1\(1\)"

14 results (0.003 seconds)

CVSS: 10.0EPSS: 1%CPEs: 12EXPL: 0

CVE-2024-20253

https://notcve.org/view.php?id=CVE-2024-20253

26 Jan 2024 — A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying op... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm • CWE-502: Deserialization of Untrusted Data •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2022-20791 – Cisco Unified Communications Products Arbitrary File Read Vulnerability

https://notcve.org/view.php?id=CVE-2022-20791

06 Jul 2022 — A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. This vulnerability is due to insufficient file permission restrictions. An attacker could exploit this vulnerab... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imp-afr-YBFLNyzd • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-36: Absolute Path Traversal •

CVSS: 10.0EPSS: 94%CPEs: 398EXPL: 413

CVE-2021-44228 – Apache Log4j2 Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2021-44228

10 Dec 2021 — Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.... • https://packetstorm.news/files/id/171626 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption CWE-502: Deserialization of Untrusted Data CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-34701 – Cisco Unified Communications Products Path Traversal Vulnerability

https://notcve.org/view.php?id=CVE-2021-34701

04 Nov 2021 — A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity Connection could allow an authenticated, remote attacker to access sensitive data on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-path-trav-dKCvktvO • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2021-1355 – Cisco Unified Communications Products Vulnerabilities

https://notcve.org/view.php?id=CVE-2021-1355

20 Jan 2021 — Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an aff... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-trav-inj-dM687ZD6 • CWE-35: Path Traversal: '.../...//' CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2021-1357 – Cisco Unified Communications Products Vulnerabilities

https://notcve.org/view.php?id=CVE-2021-1357

20 Jan 2021 — Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection attacks on an aff... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-trav-inj-dM687ZD6 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-35: Path Traversal: '.../ •

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2021-1364 – Cisco Unified Communications Products Vulnerabilities

https://notcve.org/view.php?id=CVE-2021-1364

CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0

CVE-2021-1282 – Cisco Unified Communications Products Vulnerabilities

https://notcve.org/view.php?id=CVE-2021-1282

CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 0

CVE-2018-15403 – Multiple Cisco Unified Communications Products Open Redirect Vulnerability

https://notcve.org/view.php?id=CVE-2018-15403

05 Oct 2018 — A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific... • http://www.securitytracker.com/id/1041780 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 7.8EPSS: 1%CPEs: 4EXPL: 0

CVE-2016-1466

https://notcve.org/view.php?id=CVE-2016-1466

08 Aug 2016 — Cisco Unified Communications Manager IM and Presence Service 9.1(1) SU6, 9.1(1) SU6a, 9.1(1) SU7, 10.5(2) SU2, 10.5(2) SU2a, 11.0(1) SU1, and 11.5(1) allows remote attackers to cause a denial of service (sipd process restart) via crafted headers in a SIP packet, aka Bug ID CSCva39072. Cisco Unified Communications Manager IM y Presence Service 9.1(1) SU6, 9.1(1) SU6a, 9.1(1) SU7, 10.5(2) SU2, 10.5(2) SU2a, 11.0(1) SU1 y 11.5(1) permite a atacantes remotos provocar una denegación de servicio (reinicio del pro... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-ucm • CWE-399: Resource Management Errors •

1 2