CVSS: 9.3EPSS: 0%CPEs: 21EXPL: 0CVE-2018-15422 – Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-15422
21 Sep 2018 — A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the ... • http://www.securityfocus.com/bid/105374 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 7.3EPSS: 0%CPEs: 13EXPL: 0CVE-2018-0422 – Cisco WebEx Network Recording Player Improper Access Control Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-0422
06 Sep 2018 — A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user. The vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targe... • http://www.securityfocus.com/bid/105281 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.0EPSS: 1%CPEs: 7EXPL: 0CVE-2018-0112
https://notcve.org/view.php?id=CVE-2018-0112
19 Apr 2018 — A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability is due to insufficient input validation by the Cisco WebEx clients. An attacker could exploit this vulnerability by providing meeting attendees with a malicious Flash (.swf) file via the file-sharing capabilities of the client. Exploitation of this vulnerability could allow arbitrary code e... • http://www.securityfocus.com/bid/103920 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2017-12359
https://notcve.org/view.php?id=CVE-2017-12359
30 Nov 2017 — A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker to execute arbitrary code on a system. An attacker could exploit this vulnerability by providing a user with a malicious .arf file via email or URL and convincing the user to launch the file. Exploitation of this vulnerability could allow arbitrary code execution on the system of the targeted user. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisc... • http://www.securityfocus.com/bid/102186 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12363
https://notcve.org/view.php?id=CVE-2017-12363
30 Nov 2017 — A vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to modify the welcome message of a meeting on an affected system. The vulnerability is due to insufficient security settings on meetings. An attacker could exploit this vulnerability by modifying the welcome message to a meeting. A successful exploit could allow the attacker to modify the welcome message of any known meeting. Cisco Bug IDs: CSCvf68695. • http://www.securityfocus.com/bid/102000 • CWE-264: Permissions, Privileges, and Access Controls CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.6EPSS: 2%CPEs: 6EXPL: 0CVE-2017-12368 – Cisco WebEx Network Recording Player DoS / Code Execution
https://notcve.org/view.php?id=CVE-2017-12368
30 Nov 2017 — A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and, in some cases, could allow arbitrary code execution on the system of a targeted user. Cisco Bug... • http://www.securityfocus.com/bid/102017 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.6EPSS: 2%CPEs: 5EXPL: 0CVE-2017-12372 – Cisco WebEx Network Recording Player Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-12372
30 Nov 2017 — A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and, in some cases, could allow arbitrary code execution on the system of a targeted user. Cisco Bug... • http://www.securityfocus.com/bid/102017 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.6EPSS: 1%CPEs: 1EXPL: 0CVE-2017-12293
https://notcve.org/view.php?id=CVE-2017-12293
19 Oct 2017 — A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient limitations on the number of connections that can be made to the affected software. An attacker could exploit this vulnerability by opening multiple connections to the server and exhausting server resources. A successful exploit could cause the server to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf41006. • http://www.securityfocus.com/bid/101492 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-12296
https://notcve.org/view.php?id=CVE-2017-12296
19 Oct 2017 — A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit c... • http://www.securityfocus.com/bid/101489 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 16%CPEs: 63EXPL: 0CVE-2017-6753
https://notcve.org/view.php?id=CVE-2017-6753
25 Jul 2017 — A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows. The vulnerability is due to a design defec... • http://www.securityfocus.com/bid/99614 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •