CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12362
https://notcve.org/view.php?id=CVE-2017-12362
A vulnerability in Cisco Meeting Server versions prior to 2.2.2 could allow an authenticated, remote attacker to cause the system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to video calls being made on systems with a particular configuration. An attacker could exploit this by knowing a valid URI that directs to a Cisco Meeting Server. An attacker could then make a video call and cause the system to reload. Cisco Bug IDs: CSCve65931. • http://www.securityfocus.com/bid/101987 http://www.securitytracker.com/id/1039913 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-cms • CWE-399: Resource Management Errors •
CVSS: 9.1EPSS: 0%CPEs: 18EXPL: 0CVE-2017-12249
https://notcve.org/view.php?id=CVE-2017-12249
A vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to gain unauthenticated or unauthorized access to components of or sensitive information in an affected system. The vulnerability is due to an incorrect default configuration of the TURN server, which could expose internal interfaces and ports on the external interface of an affected system. An attacker could exploit this vulnerability by using a TURN server to perform an unauthorized connection to a Call Bridge, a Web Bridge, or a database cluster in an affected system, depending on the deployment model and CMS services in use. A successful exploit could allow the attacker to gain unauthenticated access to a Call Bridge or database cluster in an affected system or gain unauthorized access to sensitive meeting information in an affected system. To exploit this vulnerability, the attacker must have valid credentials for the TURN server of the affected system. • http://www.securityfocus.com/bid/100821 http://www.securitytracker.com/id/1039357 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170913-cmsturn • CWE-16: Configuration CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.8EPSS: 2%CPEs: 9EXPL: 0CVE-2016-6448
https://notcve.org/view.php?id=CVE-2016-6448
A vulnerability in the Session Description Protocol (SDP) parser of Cisco Meeting Server could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to Release 2.0.3, Acano Server releases 1.9.x prior to Release 1.9.5, Acano Server releases 1.8.x prior to Release 1.8.17. More Information: CSCva76004. Known Affected Releases: 1.8.x 1.92.0. Una vulnerabilidad en el analizador de Session Description Protocol (SDP) de Cisco Meeting Server podría permitir a un atacante remoto no autenticado ejecutar código arbitrario en un sistema afectado. • http://www.securityfocus.com/bid/94076 http://www.securitytracker.com/id/1037181 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-cms1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 0CVE-2016-6447
https://notcve.org/view.php?id=CVE-2016-6447
A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to 2.0.1, Acano Server releases prior to 1.8.16 and prior to 1.9.3, Cisco Meeting App releases prior to 1.9.8, Acano Meeting Apps releases prior to 1.8.35. More Information: CSCva75942 CSCvb67878. Known Affected Releases: 1.81.92.0. Una vulnerabilidad en Cisco Meeting Server y Meeting App podría permitir a un atacante remoto no autenticado ejecutar código arbitrario en un sistema afectado. • http://www.securityfocus.com/bid/94073 http://www.securitytracker.com/id/1037180 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-cms • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2016-6444
https://notcve.org/view.php?id=CVE-2016-6444
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0. Una vulnerabilidad en Cisco Meeting Server podría permitir a un atacante remoto no autenticado llevar a cabo un ataque de CSRF contra un usuario Web Bridge. Más información: CSCvb03308. • http://www.securityfocus.com/bid/93785 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-cms • CWE-352: Cross-Site Request Forgery (CSRF) •