CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0445 – Cisco Packaged Contact Center Enterprise Cross-Site Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2018-0445
A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Una vulnerabilidad en la interfaz de gestión basada en web de Cisco Packaged Contact Center Enterprise podría permitir que un atacante remoto sin autenticar lleve a cabo un ataque de Cross-Site Request Forgery (CSRF) y realice acciones arbitrarias en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-pcce • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0444 – Cisco Packaged Contact Center Enterprise Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-0444
A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Una vulnerabilidad en la interfaz de gestión web de Cisco Packaged Contact Center Enterprise podría permitir que un atacante remoto sin autenticar lleve a cabo un ataque Cross-Site Scripting (XSS) persistente contra un usuario de la interfaz. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-pcce • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •