CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6757
https://notcve.org/view.php?id=CVE-2017-6757
A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to modify or delete entries in some database tables, affecting the integrity of the data. Cisco Bug IDs: CSCve13786. • http://www.securityfocus.com/bid/100121 http://www.securitytracker.com/id/1039063 https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13786 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6758
https://notcve.org/view.php?id=CVE-2017-6758
A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem. Cisco Bug IDs: CSCve13796. Una vulnerabilidad en el framework web de Cisco Unified Communications Manager 11.5(1.10000.6) podría permitir que un atacante remoto autenticado acceda a archivos arbitrarios dentro de la estructura del directorio root web en un dispositivo afectado. • http://www.securityfocus.com/bid/100119 http://www.securitytracker.com/id/1039064 https://quickview.cloudapps.cisco.com/quickview/bug/CSCve13796 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ucm1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6670
https://notcve.org/view.php?id=CVE-2017-6670
A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.1(7)ER1. Una vulnerabilidad en la GUI basada en web de Cisco Unified Communications Domain Manager, podría permitir a un atacante remoto no autenticado redireccionar a un usuario hacia una página web maliciosa, también se conoce como un problema de Redireccionamiento Abierto. Más información: CSCvc54813. • http://www.securityfocus.com/bid/98946 http://www.securitytracker.com/id/1038631 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-cucm1 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6668
https://notcve.org/view.php?id=CVE-2017-6668
Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager (CUCDM) could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc52784 CSCvc97648. Known Affected Releases: 8.1(7)ER1. Vulnerabilidades en la GUI basada en web de Cisco Unified Communications Domain Manager (CUCDM), podrían permitir a un atacante autenticado y remoto afectar la confidencialidad del sistema mediante la ejecución de interrogaciones SQL arbitrarias, también se conoce como Inyección SQL. Más información: CSCvc52784 CSCvc97648. • http://www.securityfocus.com/bid/98947 http://www.securitytracker.com/id/1038632 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-cucm2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6654
https://notcve.org/view.php?id=CVE-2017-6654
A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvc06608. • http://www.securityfocus.com/bid/98527 http://www.securitytracker.com/id/1038512 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-ucm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •