CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1679 – Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server REST API Server-Side Request Forgery Vulnerability
https://notcve.org/view.php?id=CVE-2019-1679
A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack is commonly referred to as server-side request forgery (SSRF). The vulnerability is due to insufficient access controls for the REST API of Cisco Expressway Series and Cisco TelePresence VCS. An attacker could exploit this vulnerability by submitting a crafted HTTP request to the affected server. Versions prior to XC4.3.4 are affected. • http://www.securityfocus.com/bid/106940 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-rest-api-ssrf • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.6EPSS: 0%CPEs: 32EXPL: 0CVE-2017-3790
https://notcve.org/view.php?id=CVE-2017-3790
A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient size validation of user-supplied data. An attacker could exploit this vulnerability by sending crafted H.224 data in Real-Time Transport Protocol (RTP) packets in an H.323 call. An exploit could allow the attacker to overflow a buffer in a cache that belongs to the received packet parser, which will result in a crash of the application, resulting in a DoS condition. All versions of Cisco Expressway Series Software and Cisco TelePresence VCS Software prior to version X8.8.2 are vulnerable. • http://www.securityfocus.com/bid/95786 http://www.securitytracker.com/id/1037697 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-expressway • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 8%CPEs: 1EXPL: 0CVE-2016-1468
https://notcve.org/view.php?id=CVE-2016-1468
The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to execute arbitrary commands via crafted fields, aka Bug ID CSCuv12531. La interfaz web administrativa en Cisco TelePresence Video Communication Server Expressway X8.5.2 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través de campos arbitrarios, también conocido como Bug ID CSCuv12531. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-vcse http://www.securityfocus.com/bid/92274 http://www.securitytracker.com/id/1036529 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 0CVE-2016-1444
https://notcve.org/view.php?id=CVE-2016-1444
The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass authentication via an arbitrary trusted certificate, aka Bug ID CSCuz64601. El componente Mobile and Remote Access (MRA) en Cisco TelePresence Video Communication Server (VCS) X8.1 hasta la versión X8.7 y Expressway X8.1 hasta la versión X8.6 no maneja correctamente los certificados, lo que permite a atacantes remotos eludir la autenticación a través de un certificado confiable manipulado, también conocido como Bug ID CSCuz64601. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160706-vcs http://www.securityfocus.com/bid/91669 http://www.securitytracker.com/id/1036237 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2016-1400
https://notcve.org/view.php?id=CVE-2016-1400
Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header, aka Bug ID CSCuy43258. Cisco TelePresence Video Communications Server (VCS) X8.x en versiones anteriores a X8.7.2 permite a atacantes remotos provocar una denegación de servicio (interrupción de servicio) a través de una URL manipulada en una cabecera SIP, también conocida como Bug ID CSCuy43258. • http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160516-vcs http://www.securitytracker.com/id/1035899 • CWE-20: Improper Input Validation •