CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1679 – Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server REST API Server-Side Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2019-1679
07 Feb 2019 — A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack is commonly referred to as server-side request forgery (SSRF). The vulnerability is due to insufficient access controls for the REST API of Cisco Expressway Series and Cisco TelePresence VCS. An attacker could exp... • http://www.securityfocus.com/bid/106940 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 0CVE-2018-0409
https://notcve.org/view.php?id=CVE-2018-0409
15 Aug 2018 — A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS) and Expressway could allow an unauthenticated, remote attacker to cause a temporary service outage for all IM&P users, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious IPv4 or IPv6 packet to ... • http://www.securityfocus.com/bid/105102 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 8.6EPSS: 0%CPEs: 32EXPL: 0CVE-2017-3790
https://notcve.org/view.php?id=CVE-2017-3790
01 Feb 2017 — A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient size validation of user-supplied data. An attacker could exploit this vulnerability by sending crafted H.224 data in Real-Time Transport Protocol (RTP) packets in an H.323 call. An exploit coul... • http://www.securityfocus.com/bid/95786 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-399: Resource Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 0CVE-2016-1444
https://notcve.org/view.php?id=CVE-2016-1444
07 Jul 2016 — The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass authentication via an arbitrary trusted certificate, aka Bug ID CSCuz64601. El componente Mobile and Remote Access (MRA) en Cisco TelePresence Video Communication Server (VCS) X8.1 hasta la versión X8.7 y Expressway X8.1 hasta la versión X8.6 no maneja correctamente los certificados, lo que perm... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160706-vcs • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 14EXPL: 0CVE-2016-1400
https://notcve.org/view.php?id=CVE-2016-1400
25 May 2016 — Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header, aka Bug ID CSCuy43258. Cisco TelePresence Video Communications Server (VCS) X8.x en versiones anteriores a X8.7.2 permite a atacantes remotos provocar una denegación de servicio (interrupción de servicio) a través de una URL manipulada en una cabecera SIP, también conocida como Bug ID CSCuy43258. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160516-vcs • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6410
https://notcve.org/view.php?id=CVE-2015-6410
14 Dec 2015 — The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypass intended call-reception and call-setup restrictions by spoofing a user, aka Bug ID CSCuu97283. La implementación de servicios Mobile and Remote Access (MRA) en Cisco Unified Communications Manager no maneja correctamente la validación de identidad en dispositivos edge, lo que permite a atacantes remotos eludir las restricciones... • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-ucm • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0772
https://notcve.org/view.php?id=CVE-2015-0772
12 Jun 2015 — Cisco TelePresence Video Communication Server (VCS) X8.5RC4 allows remote attackers to cause a denial of service (CPU consumption or device outage) via a crafted SDP parameter-negotiation request in an SDP session during a SIP connection, aka Bug ID CSCut42422. Cisco TelePresence Video Communication Server (VCS) X8.5RC4 permite a atacantes remotos causar una denegación de servicio (consumo de CPU o interrupción de dispositivo) a través de una solicitud de negociación del parámetro SDP manipulada en una sesi... • http://tools.cisco.com/security/center/viewAlert.x?alertId=39240 • CWE-399: Resource Management Errors •