CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1623 – Cisco Meeting Server CLI Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-1623
A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root user. The vulnerability is due to insufficient input validation during the execution of a vulnerable CLI command. An attacker with administrator-level credentials could exploit this vulnerability by injecting crafted arguments during command execution. A successful exploit could allow the attacker to perform arbitrary code execution as root on an affected product. Una vulnerabilidad en la shell de configuración de la CLI de Meeting Server de Cisco, podría permitir que un atacante local autenticado inyecte comandos arbitrarios como usuario root. • http://www.securityfocus.com/bid/108840 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-cms-codex • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1794 – Cisco Directory Connector Search Order Hijacking Vulnerability
https://notcve.org/view.php?id=CVE-2019-1794
A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated, local attacker to load a binary of their choosing. The vulnerability is due to uncontrolled search path elements. An attacker could exploit this vulnerability by placing a binary of their choosing earlier in the search path utilized by Cisco Directory Connector to locate and load required resources. Una vulnerabilidad en el proceso de búsqueda de ruta (search path) de Directory Connector de Cisco, podría permitir a un atacante local autorizado cargar un binario de su elección. La vulnerabilidad es debido a elementos de la ruta de búsqueda no controlada. • http://www.securityfocus.com/bid/108032 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-cdc-hijack • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1676 – Cisco Meeting Server SIP Processing Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1676
A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition of the Cisco Meeting Server. The vulnerability is due to insufficient validation of Session Description Protocol (SDP) messages. An attacker could exploit this vulnerability by sending a crafted SDP message to the CMS call bridge. An exploit could allow the attacker to cause the CMS to reload, causing a DoS condition for all connected clients. Versions prior to 2.3.9 are affected. • http://www.securityfocus.com/bid/106909 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-meeting-sipdos • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1678 – Cisco Meeting Server Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1678
A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Meetings application users who are paired with a Session Initiation Protocol (SIP) endpoint. The vulnerability is due to improper validation of coSpaces configuration parameters. An attacker could exploit this vulnerability by inserting crafted strings in specific coSpace parameters. An exploit could allow the attacker to prevent clients from joining a conference call in the affected coSpace. Versions prior to 2.4.3 are affected. • http://www.securityfocus.com/bid/106943 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-cms-dos • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15446 – Cisco Meeting Server Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2018-15446
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper protections on data that is returned from user meeting requests when the Guest access via ID and passcode option is set to Legacy mode. An attacker could exploit this vulnerability by sending meeting requests to an affected system. A successful exploit could allow the attacker to determine the values of meeting room unique identifiers, possibly allowing the attacker to conduct further exploits. Una vulnerabilidad en Cisco Meeting Server podría permitir que un atacante remoto no autenticado acceda a información sensible. • http://www.securityfocus.com/bid/105856 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-meeting-server • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •