CVSS: 7.2EPSS: 0%CPEs: 30EXPL: 0CVE-2017-6794
https://notcve.org/view.php?id=CVE-2017-6794
A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injection and escalate their privileges to root. The attacker must first authenticate to the application with valid administrator credentials. The vulnerability is due to insufficient validation of user-supplied input at the CLI for certain commands. An attacker could exploit this vulnerability by authenticating to the affected application and submitting a crafted CLI command for execution at the Cisco Meeting Server CLI. An exploit could allow the attacker to perform command injection and escalate their privilege level to root. • http://www.securityfocus.com/bid/100464 http://www.securitytracker.com/id/1039245 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170823-cms • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.1EPSS: 0%CPEs: 11EXPL: 0CVE-2017-3837
https://notcve.org/view.php?id=CVE-2017-3837
An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. • http://www.securityfocus.com/bid/96243 http://www.securitytracker.com/id/1037834 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 2%CPEs: 9EXPL: 0CVE-2016-6448
https://notcve.org/view.php?id=CVE-2016-6448
A vulnerability in the Session Description Protocol (SDP) parser of Cisco Meeting Server could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to Release 2.0.3, Acano Server releases 1.9.x prior to Release 1.9.5, Acano Server releases 1.8.x prior to Release 1.8.17. More Information: CSCva76004. Known Affected Releases: 1.8.x 1.92.0. Una vulnerabilidad en el analizador de Session Description Protocol (SDP) de Cisco Meeting Server podría permitir a un atacante remoto no autenticado ejecutar código arbitrario en un sistema afectado. • http://www.securityfocus.com/bid/94076 http://www.securitytracker.com/id/1037181 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-cms1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 0CVE-2016-6447
https://notcve.org/view.php?id=CVE-2016-6447
A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to 2.0.1, Acano Server releases prior to 1.8.16 and prior to 1.9.3, Cisco Meeting App releases prior to 1.9.8, Acano Meeting Apps releases prior to 1.8.35. More Information: CSCva75942 CSCvb67878. Known Affected Releases: 1.81.92.0. Una vulnerabilidad en Cisco Meeting Server y Meeting App podría permitir a un atacante remoto no autenticado ejecutar código arbitrario en un sistema afectado. • http://www.securityfocus.com/bid/94073 http://www.securitytracker.com/id/1037180 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-cms • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2016-6444
https://notcve.org/view.php?id=CVE-2016-6444
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0. Una vulnerabilidad en Cisco Meeting Server podría permitir a un atacante remoto no autenticado llevar a cabo un ataque de CSRF contra un usuario Web Bridge. Más información: CSCvb03308. • http://www.securityfocus.com/bid/93785 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-cms • CWE-352: Cross-Site Request Forgery (CSRF) •