NotCVE - vendor:"Cisco" product:"Unified Communications Manager" version:"12.5\(1\)su7"

Page 3 of 38 results (0.005 seconds)

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-1408 – Cisco Unified Communications Products Cross-Site Scripting Vulnerabilities

https://notcve.org/view.php?id=CVE-2021-1408

08 Apr 2021 — Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does no... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-Q4PZcNzJ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-1407 – Cisco Unified Communications Products Cross-Site Scripting Vulnerabilities

https://notcve.org/view.php?id=CVE-2021-1407

CVSS: 4.9EPSS: 0%CPEs: 61EXPL: 0

CVE-2021-1406 – Cisco Unified Communications Manager Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2021-1406

08 Apr 2021 — A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the ... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-inf-disc-wCxZNjL2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-1380 – Cisco Unified Communications Products Cross-Site Scripting Vulnerabilities

https://notcve.org/view.php?id=CVE-2021-1380

CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2019-15963 – Cisco Unified Communications Manager Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2019-15963

23 Sep 2020 — A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the web-based management interface of the affected software. The vulnerability is due to insufficient protection of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by accessing the interface and viewing restricted portions of the software configuration. A suc... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-cuc-info-disclosure • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0

CVE-2020-3346 – Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

https://notcve.org/view.php?id=CVE-2020-3346

17 Aug 2020 — A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exp... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-selfcare-drASc7sr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0

CVE-2020-3282 – Cisco Unified Communications Products Cross-Site Scripting Vulnerability

https://notcve.org/view.php?id=CVE-2020-3282

02 Jul 2020 — A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected soft... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-cuc-imp-xss-OWuSYAp • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0

CVE-2020-3177 – Cisco Unified Communications Manager Path Traversal Vulnerability

https://notcve.org/view.php?id=CVE-2020-3177

15 Apr 2020 — A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the TAPS interface of the affected device. An attacker could exploit this vulnerability by sending a crafted request to the TAPS inter... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-taps-path-trav-pfsFO93r • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 8.8EPSS: 4%CPEs: 4EXPL: 1

CVE-2019-15972 – Cisco Unified Communications Manager SQL Injection Vulnerability

https://notcve.org/view.php?id=CVE-2019-15972

26 Nov 2019 — A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to modify values on or return val... • https://github.com/FSecureLABS/Cisco-UCM-SQLi-Scripts • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0

CVE-2019-1915 – Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability

https://notcve.org/view.php?id=CVE-2019-1915

02 Oct 2019 — A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulner... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •

1 2 3 4