CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-0403
https://notcve.org/view.php?id=CVE-2018-0403
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password. Cisco Bug IDs: CSCvg71040. Múltiples vulnerabilidades en la interfaz de gestión web de Cisco Unified Contact Center Express (Unified CCX) podrían permitir que un atacante remoto sin autenticar recupere una contraseña en texto claro. Cisco Bug IDs: CSCvg71040. • http://www.securitytracker.com/id/1041352 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-uccx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-0402
https://notcve.org/view.php?id=CVE-2018-0402
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. Cisco Bug IDs: CSCvg70921. Múltiples vulnerabilidades en la interfaz de gestión web de Cisco Unified Contact Center Express (Unified CCX) podrían permitir que un atacante remoto sin autenticar lleve a cabo un ataque de Cross-Site Request Forgery (CSRF). Cisco Bug IDs: CSCvg70921. • http://www.securitytracker.com/id/1041352 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-uccx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 32EXPL: 0CVE-2017-6779
https://notcve.org/view.php?id=CVE-2017-6779
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability occurs because a certain system log file does not have a maximum size restriction. Therefore, the file is allowed to consume the majority of available disk space on the appliance. An attacker could exploit this vulnerability by sending crafted remote connection requests to the appliance. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-diskdos • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6722
https://notcve.org/view.php?id=CVE-2017-6722
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of Cisco Unified Contact Center Express (UCCx) could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affected Releases: 10.6(1). Known Fixed Releases: 11.5(1.10000.61). Una vulnerabilidad en el servicio Extensible Messaging and Presence Protocol (XMPP) de Unified Contact Center Express (UCCx) de Cisco, podría permitir a un atacante remoto no identificado hacerse pasar por un usuario legítimo, también se conoce como una Vulnerabilidad de Autenticación de Texto Sin Cifrar. • http://www.securityfocus.com/bid/99201 http://www.securitytracker.com/id/1038749 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-ucce • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2016-6425
https://notcve.org/view.php?id=CVE-2016-6425
Cross-site scripting (XSS) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuy75020 and CSCuy81652. Vulnerabilidad de XSS en Cisco Unified Intelligence Center (CUIC) 8.5.4 hasta la versión 9.1(1), tal como se utiliza en Unified Contact Center Express 10.0(1) hasta la versión 11.0(1), permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, vulnerabilidad también conocida como IDs CSCuy75020 y CSCuy81652. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ucis1 http://www.securityfocus.com/bid/93422 http://www.securitytracker.com/id/1036951 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •