CVSS: 7.2EPSS: 0%CPEs: 30EXPL: 0CVE-2017-6794
https://notcve.org/view.php?id=CVE-2017-6794
07 Sep 2017 — A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injection and escalate their privileges to root. The attacker must first authenticate to the application with valid administrator credentials. The vulnerability is due to insufficient validation of user-supplied input at the CLI for certain commands. An attacker could exploit this vulnerability by authenticating to the affected application and submitting a crafted CLI comma... • http://www.securityfocus.com/bid/100464 • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.1EPSS: 0%CPEs: 11EXPL: 0CVE-2017-3837
https://notcve.org/view.php?id=CVE-2017-3837
22 Feb 2017 — An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affec... • http://www.securityfocus.com/bid/96243 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 6%CPEs: 9EXPL: 0CVE-2016-6448
https://notcve.org/view.php?id=CVE-2016-6448
03 Nov 2016 — A vulnerability in the Session Description Protocol (SDP) parser of Cisco Meeting Server could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to Release 2.0.3, Acano Server releases 1.9.x prior to Release 1.9.5, Acano Server releases 1.8.x prior to Release 1.8.17. More Information: CSCva76004. Known Affected Releases: 1.8.x 1.92.0. Una vulnerabilidad en el analizador de Session ... • http://www.securityfocus.com/bid/94076 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2016-6444
https://notcve.org/view.php?id=CVE-2016-6444
27 Oct 2016 — A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0. Una vulnerabilidad en Cisco Meeting Server podría permitir a un atacante remoto no autenticado llevar a cabo un ataque de CSRF contra un usuario Web Bridge. Más información: CSCvb03308. • http://www.securityfocus.com/bid/93785 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.1EPSS: 0%CPEs: 9EXPL: 0CVE-2016-6445
https://notcve.org/view.php?id=CVE-2016-6445
27 Oct 2016 — A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user. Una vulnerabilidad en el servicio Extensible Messaging y P... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2016-6446
https://notcve.org/view.php?id=CVE-2016-6446
27 Oct 2016 — A vulnerability in Web Bridge for Cisco Meeting Server could allow an unauthenticated, remote attacker to retrieve memory from a connected server. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0. Una vulnerabilidad en Web Bridge for Cisco Meeting Server podría permitir a un atacante remoto no autenticado recuperar memoria de un servidor conectado. Más información: CSCvb03308. • http://www.securityfocus.com/bid/93782 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •