Page 30 of 188 results (0.018 seconds)

CVSS: 7.5EPSS: 91%CPEs: 48EXPL: 0

CVE-2011-1610 – Cisco Unified CallManager xmldirectorylist.jsp SQL Injection Vulnerability

https://notcve.org/view.php?id=CVE-2011-1610

Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064. Múltiples vulnerabilidades de inyección SQL en xmldirectorylist.jsp incrustado en el componente del Servidor Apache HTTP en Cisco Unified Communications Manager (también conocido como CUCM o CallManager) v6.x antes de v6.1(5)su3, v7.x antes de 7.1(5)su4, v8.0 antes de v8.0(3a)su2, y v8.5 antes de v8.5(1)su1 permite a atacantes remotos ejecutar comandos SQL a través de los parámetros (1) f, (2) l, o (3) n, también conocido como ID de error CSCtj42064. This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Cisco Unified CM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Call Manager component. The system exposes an Apache webserver which contains a JSP script vulnerable to SQL injection. • http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0051.html http://secunia.com/advisories/44331 http://www.cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtml http://www.securityfocus.com/archive/1/517727/100/0/threaded http://www.securityfocus.com/bid/47607 http://www.securitytracker.com/id?1025449 http://www.vupen.com/english/advisories/2011/1122 http://zerodayinitiative.com/advisories/ZDI-11-143 https://exchange.xforce.ibmcloud.com/vulnerabilities/67126 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.8EPSS: 0%CPEs: 43EXPL: 4

CVE-2010-3039 – Cisco Unified Communications Manager 8.0 - Invalid Argument Privilege Escalation

https://notcve.org/view.php?id=CVE-2010-3039

/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930. /usr/local/cm/bin/pktCap_protectData en Cisco Unified Communications Manager (también conocido como CUCM, formerly CallManager) v6, v7, y v8 permite a adminitradores autenticados remotamente ejecutar código de su elección a través de metacaracteres shell en una petición al interfaz administrativo, también conocido como Bug IDs CSCti52041 y CSCti74930. • https://www.exploit-db.com/exploits/34954 http://seclists.org/fulldisclosure/2010/Nov/40 http://secunia.com/advisories/42129 http://tools.cisco.com/security/center/viewAlert.x?alertId=21656 http://www.nsense.fi/advisories/nsense_2010_003.txt http://www.securityfocus.com/archive/1/514668/100/0/threaded http://www.securityfocus.com/bid/44672 http://www.securitytracker.com/id?1024694 http://www.vupen.com/english/advisories/2010/2915 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 7.8EPSS: 0%CPEs: 235EXPL: 0

CVE-2010-2834

https://notcve.org/view.php?id=CVE-2010-2834

Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)SU1, 7.x before 7.1(5), and 8.0 before 8.0(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via crafted SIP registration traffic over UDP, aka Bug IDs CSCtf72678 and CSCtf14987. Cisco IOS v12.2 hasta v12.4 y v15.0 hasta v15.1, Cisco IOS XE v2.5.x y v2.6.x anterior a v2.6.1, y Cisco Unified Communications Manager (también conocido como CUCM, anteriormente CallManager) v6.x anterior a 6.1(5)SU1, v7.x anterior a v7.1(5) y v8.0 anterior a v8.0(2) permite a atacantes remotos provocar una denegación de servicio (recarga de dispositivo o interrupción de los servicios de voz) mediante tráfico SIP manipulado sobre UDP, también conocido como fallo IDs CSCtf72678 y CSCtf14987. • http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a313.shtml •

CVSS: 7.8EPSS: 0%CPEs: 232EXPL: 0

CVE-2010-2835

https://notcve.org/view.php?id=CVE-2010-2835

Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.0 before 7.0(2a)su3, 7.1su before 7.1(3b)su2, 7.1 before 7.1(5), and 8.0 before 8.0(1) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a SIP REFER request with an invalid Refer-To header, aka Bug IDs CSCta20040 and CSCta31358. Cisco IOS v12.2 hasta v12.4 y v15.0 hasta v15.1, Cisco IOS XE v2.5.x y v2.6.x anterior a v2.6.1, y Cisco Unified Communications Manager (también conocido como CUCM, anteriormente CallManager) v6.x anterior a v6.1(5), v7.0 anterior a v7.0(2a)su3, v7.1su anterior a v7.1 (3b)su2, v7.1 anterior a v7.1(5) y v8.0 anterior a v8.0(1) permite a atacantes remotos provocar una denegación de servicio (recarga de dispositivo o interrupción de los servicios de voz) a través de una solicitud SIP REFER con un cabecera Refer-To inválida, también conocido como fallo ID CSCta20040 y CSCta31358. • http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a313.shtml •

CVSS: 7.8EPSS: 0%CPEs: 40EXPL: 0

CVE-2010-2837

https://notcve.org/view.php?id=CVE-2010-2837

The SIPStationInit implementation in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.1SU before 6.1(5)SU1, 7.0SU before 7.0(2a)SU3, 7.1SU before 7.1(3b)SU2, 7.1 before 7.1(5), and 8.0 before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP message, aka Bug ID CSCtd17310. La implementación SIPStationInit en Cisco Unified Communications Manager (también conocida como CUCM, anteriormente CallManager) v6.1SU anterior a v6.1(5)SU1, v7.0SU anterior a v7.0(2a)SU3, v7.1SU anterior a v7.1(3b)SU2, v7.1 anterior a v7.1(5), y v8.0 anterior a v8.0(1), permite a atacantes remotos provocar una denegación de servicio (fallo de proceso) a través de un mensaje SIP mal formado, también conocido como Bug ID CSCtd17310. • http://www.cisco.com/en/US/products/products_security_advisory09186a0080b43908.shtml http://www.vupen.com/english/advisories/2010/2187 •