CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3131 – Cisco Webex Teams Adaptive Cards Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-3131
A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability is due to insufficient input validation when processing received adaptive cards. The attacker could exploit this vulnerability by sending an adaptive card with malicious content to an existing user of the Cisco Webex Teams client for Windows. A successful exploit could allow the attacker to cause the targeted user's client to crash continuously. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cards-dos-FWzNcXPq • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-16001 – Cisco Webex Teams for Windows DLL Hijacking Vulnerability
https://notcve.org/view.php?id=CVE-2019-16001
A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the vulnerable application is launched. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-webex-teams-dll • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1939 – Cisco Webex Teams Logging Feature Command Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-1939
A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. This vulnerability is due to improper restrictions on software logging features used by the application on Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to visit a website designed to submit malicious input to the affected application. A successful exploit could allow the attacker to cause the application to modify files and execute arbitrary commands on the system with the privileges of the targeted user. Una vulnerabilidad en el cliente Cisco Webex Teams para Windows, podría permitir a un atacante remoto no autenticado ejecutar comandos arbitrarios sobre un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-webex-teams • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-5922
https://notcve.org/view.php?id=CVE-2019-5922
Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Una vulnerabilidad de ruta de búsqueda no fiable en el instalador de Microsoft Teams permite a un atacante obtener privilegios mediante un troyano DLL en un directorio no especificado. • http://jvn.jp/en/jp/JVN79543573/index.html http://www.securityfocus.com/bid/107200 • CWE-426: Untrusted Search Path •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-0387
https://notcve.org/view.php?id=CVE-2018-0387
A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on the user's device, possibly with elevated privileges. The vulnerability occurs because Cisco Webex Teams does not properly sanitize input. An attacker could exploit the vulnerability by sending a user a malicious link and persuading the user to follow the link. A successful exploit could allow the attacker to execute arbitrary code on the user's system. Cisco Bug IDs: CSCvh66250. • http://www.securityfocus.com/bid/104873 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-webex-teams-rce • CWE-20: Improper Input Validation •