CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1773 – Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2019-1773
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system. Una vulnerabilidad en Cisco Webex Network Recording Player y Cisco Webex Player para Microsoft Windows podría permitir que un atacante ejecute código arbitrario en un sistema afectado. • http://www.securityfocus.com/bid/108373 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-webex-player • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.3EPSS: 0%CPEs: 13EXPL: 0CVE-2018-0422 – Cisco WebEx Network Recording Player Improper Access Control Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-0422
A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user. The vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges. Attacks on single-user systems are less likely to occur, as the attack must be carried out by the user on the user's own system. • http://www.securityfocus.com/bid/105281 http://www.securitytracker.com/id/1041681 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.3EPSS: 3%CPEs: 63EXPL: 0CVE-2017-6753
https://notcve.org/view.php?id=CVE-2017-6753
A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows. The vulnerability is due to a design defect in the extension. An attacker who can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser. • http://www.securityfocus.com/bid/99614 http://www.securitytracker.com/id/1038909 http://www.securitytracker.com/id/1038910 http://www.securitytracker.com/id/1038911 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170717-webex • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0589
https://notcve.org/view.php?id=CVE-2015-0589
The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460. La interfaz web administrativa en Cisco WebEx Meetings Server 1.0 hasta 1.5 permite a usuarios remotos autenticados ejecutar comandos del sistema operativo arbitrarios con privilegios root a través de campos especificados, también conocido como Bug ID CSCuj40460. • http://secunia.com/advisories/62799 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150204-wbx http://www.securityfocus.com/bid/72493 http://www.securitytracker.com/id/1031692 https://exchange.xforce.ibmcloud.com/vulnerabilities/100719 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0597
https://notcve.org/view.php?id=CVE-2015-0597
The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159. La característica Forgot Password en Cisco WebEx Meetings Server 1.5(.1.131) y anteriores permite a atacantes remotos enumerar las cuentas administrativas a través de paquetes manipulados, también conocido como Bug IDs CSCuj67166 y CSCuj67159. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0597 http://tools.cisco.com/security/center/viewAlert.x?alertId=37240 http://www.securityfocus.com/bid/72373 http://www.securitytracker.com/id/1031678 https://exchange.xforce.ibmcloud.com/vulnerabilities/100658 • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •