CVSS: 10.0EPSS: 12%CPEs: 12EXPL: 0CVE-2017-12337
https://notcve.org/view.php?id=CVE-2017-12337
16 Nov 2017 — A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs when a refresh upgrade (RU) or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access ... • http://www.securityfocus.com/bid/101865 • CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12227
https://notcve.org/view.php?id=CVE-2017-12227
07 Sep 2017 — A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data. Cisco... • http://www.securityfocus.com/bid/100653 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6468
https://notcve.org/view.php?id=CVE-2016-6468
14 Dec 2016 — A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14). Una vulnerabilidad en la interfaz de administración basada en web de Cisco Emergency Responder puede permitir a un atacante remoto no autenticado llevar a cabo un... • http://www.securityfocus.com/bid/94786 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-9208
https://notcve.org/view.php?id=CVE-2016-9208
14 Dec 2016 — A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenticated, remote attacker to access files in arbitrary locations on the file system of an affected device. More Information: CSCva98951 CSCva98954 CSCvb57494. Known Affected Releases: 11.5(2.10000.5). Known Fixed Releases: 12.0(0.98000.14) 12.0(0.98000.16). Una vulnerabilidad en el File Management Utility, el formulario Download File y la aplicación Serv... • http://www.securityfocus.com/bid/94800 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6400
https://notcve.org/view.php?id=CVE-2015-6400
13 Dec 2015 — Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10.5(1a) allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug ID CSCuv25547. Vulnerabilidad de XSS en Cisco Emergency Responder 10.5(1a) permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de campos no especificados, también conocido como Bug ID CSCuv25547. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-cer • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6405
https://notcve.org/view.php?id=CVE-2015-6405
13 Dec 2015 — Cross-site request forgery (CSRF) vulnerability in Cisco Emergency Responder 10.5(1) and 10.5(1a) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv26501. Vulnerabilidad de CSRF en Cisco Emergency Responder 10.5(1) y 10.5(1a) permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios, también conocida como Bug ID CSCuv26501. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-cers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6406
https://notcve.org/view.php?id=CVE-2015-6406
13 Dec 2015 — Directory traversal vulnerability in the Tools menu in Cisco Emergency Responder 10.5(1.10000.5) allows remote authenticated users to write to arbitrary files via a crafted filename, aka Bug ID CSCuv21781. Vulnerabilidad de salto de directorio en el Tools menu en Cisco Emergency Responder 10.5(1.10000.5) permite a usuarios remotos autenticados escribir en archivos arbitrarios a través de un nombre de archivo manipulado, también conocido como Bug ID CSCuv21781. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-ert • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6407
https://notcve.org/view.php?id=CVE-2015-6407
13 Dec 2015 — Cisco Emergency Responder 10.5(3.10000.9) allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501. Cisco Emergency Responder 10.5(3.10000.9) permite a atacantes remotos subir archivos a ubicaciones arbitrarias a través de un parámetro manipulado, también conocido como Bug ID CSCuv25501. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-erw • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2114
https://notcve.org/view.php?id=CVE-2014-2114
04 Apr 2014 — Cross-site scripting (XSS) vulnerability in UserServlet in Cisco Emergency Responder (ER) 8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun24384. Vulnerabilidad de XSS en UserServlet en Cisco Emergency Responder (ER) 8.6 y anteriores permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de un parámetro no especificado, también conocido como Bug ID CSCun24384. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2114 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2115
https://notcve.org/view.php?id=CVE-2014-2115
04 Apr 2014 — Multiple cross-site request forgery (CSRF) vulnerabilities in CERUserServlet pages in Cisco Emergency Responder (ER) 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250. Múltiples vulnerabilidades de CSRF en páginas de CERUserServlet en Cisco Emergency Responder (ER) 8.6 y anteriores permiten a atacantes remotos secuestrar la autenticación de usuarios arbitrarios, también conocido como Bug ID CSCun24250. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2115 • CWE-352: Cross-Site Request Forgery (CSRF) •