CVSS: 7.8EPSS: 2%CPEs: 20EXPL: 0CVE-2008-1744
https://notcve.org/view.php?id=CVE-2008-1744
The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to cause a denial of service (service crash) via malformed network traffic, aka Bug ID CSCsk46770. El servicio Certificate Authority Proxy Function (CAPF) service de Cisco Unified Communications Manager (CUCM) 4.1 versiones anteriores a 4.1(3)SR7, 4.2 versiones anteriores a 4.2(3)SR4, y 4.3 versiones anteriores a 4.3(2) permite a atacantes remotos provocar una denegación de servicio (caída del servicio) a través de tráfico de red malformado, también conocido como Bug ID CSCsk46770. • http://secunia.com/advisories/30238 http://securitytracker.com/id?1020022 http://www.cisco.com/en/US/products/products_security_advisory09186a0080995688.shtml http://www.securityfocus.com/bid/29221 http://www.vupen.com/english/advisories/2008/1533 https://exchange.xforce.ibmcloud.com/vulnerabilities/42415 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 11%CPEs: 8EXPL: 0CVE-2008-1154
https://notcve.org/view.php?id=CVE-2008-1154
The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications products, including Unified Communications Manager (CUCM) 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the network, which allows remote attackers to execute arbitrary code via unspecified vectors. El Disaster Recovery Framework (DRF) Master Server en productos Cisco Unified Communications, incluyendo Unified Communications Manager (CUCM) 5.x y 6.x, Unified Presence 1.x y 6.x, Emergency Responder 2.x, y Mobility Manager 2.x, no requiere autenticación para las peticiones recibidas desde la red, lo que permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados. • http://secunia.com/advisories/29670 http://securitytracker.com/id?1019768 http://www.cisco.com/en/US/products/products_security_advisory09186a008096fd9a.shtml http://www.securityfocus.com/bid/28591 http://www.vupen.com/english/advisories/2008/1093 https://exchange.xforce.ibmcloud.com/vulnerabilities/41632 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 1CVE-2008-0026 – Cisco Unified Communications Manager 6.1 - 'key' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0026
SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages. Una vulnerabilidad de la inyección SQL en Cisco Unified CallManager/Communications Manager (CUCM) versiones 5.0/5.1 anteriores a 5.1(3a) y versiones 6.0/6.1 anteriores a 6.1(1a), permite a los usuarios autenticados remotos ejecutar comandos SQL arbitrarios por medio del parámetro key en las páginas de interfaz de (1) administrador y (2) usuario. • https://www.exploit-db.com/exploits/31189 http://secunia.com/advisories/28932 http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml http://www.securityfocus.com/bid/27775 http://www.securitytracker.com/id?1019404 http://www.vupen.com/english/advisories/2008/0542 https://exchange.xforce.ibmcloud.com/vulnerabilities/40484 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 3%CPEs: 2EXPL: 0CVE-2007-5537
https://notcve.org/view.php?id=CVE-2007-5537
Cisco Unified Communications Manager (CUCM, formerly CallManager) 5.1 before 5.1(2), and Unified CallManager 5.0, allow remote attackers to cause a denial of service (kernel panic) via a flood of SIP INVITE messages to UDP port 5060, which triggers resource exhaustion, aka CSCsi75822. Cisco Unified communications Manager (CUCM, anteriormente CallManager) 5.1 anterior a 5.1(2), y Unified CallManager 5.0, permiten a atacantes remotos provocar una denegación de servicio (kernel panic) mediante una inundación de mensajes SIP INVITE al puerto UDP 5060, lo cual dispara un agotamiento de recursos, también conocida como, CSCsi75822. • http://osvdb.org/37941 http://secunia.com/advisories/27296 http://www.cisco.com/en/US/products/products_security_advisory09186a00808dda34.shtml http://www.securityfocus.com/bid/26105 http://www.securitytracker.com/id?1018828 http://www.vupen.com/english/advisories/2007/3532 https://exchange.xforce.ibmcloud.com/vulnerabilities/37246 • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 8%CPEs: 2EXPL: 0CVE-2007-5538
https://notcve.org/view.php?id=CVE-2007-5538
Buffer overflow in the Centralized TFTP File Locator Service in Cisco Unified Communications Manager (CUCM, formerly CallManager) 5.1 before 5.1(3), and Unified CallManager 5.0, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors involving the processing of filenames, aka CSCsh47712. Desbordamiento de búfer en Centralized TFTP File Locator Service de Cisco Unified Communications Manager (CUCM, antes conocido como CallManager) 5.1 anterior a 5.1(3), y Unified CallManager 5.0, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio mediante vectores no especificados que implican el procesamiento de nombres de fichero, también conocido como CSCsh47712. • http://osvdb.org/37940 http://secunia.com/advisories/27296 http://www.cisco.com/en/US/products/products_security_advisory09186a00808dda34.shtml http://www.securityfocus.com/bid/26105 http://www.securitytracker.com/id?1018828 http://www.vupen.com/english/advisories/2007/3532 https://exchange.xforce.ibmcloud.com/vulnerabilities/37247 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •