CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-7991
https://notcve.org/view.php?id=CVE-2014-7991
The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376. El subsistema de acceso remoto móvil en Cisco Unified Communications Manager (CM) 10.0(1) y anteriores no valida correctamente el campo 'Subject Alternative Name' (SAN) de un certificado X.509, lo que permite a atacantes man-in.the-middle engañar el núcleo de los dispositivos VCS a través de un certificado manipulado por una Autoridad Certificadora, también conocido como ID CSCuq86376. • http://secunia.com/advisories/62267 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991 http://tools.cisco.com/security/center/viewAlert.x?alertId=36381 http://www.securityfocus.com/bid/71013 http://www.securitytracker.com/id/1031181 https://exchange.xforce.ibmcloud.com/vulnerabilities/98574 • CWE-310: Cryptographic Issues •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3363
https://notcve.org/view.php?id=CVE-2014-3363
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443. Vulnerabilidad de XSS en el Framework web en Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) permite a usuarios remotos autenticados inyectar script web o HTML arbitrarios a través de un parámetro no especificado, también conocido como Bug ID CSCuq68443. • http://secunia.com/advisories/59105 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3363 http://tools.cisco.com/security/center/viewAlert.x?alertId=35672 http://www.securityfocus.com/bid/69739 http://www.securitytracker.com/id/1030836 https://exchange.xforce.ibmcloud.com/vulnerabilities/95882 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 18EXPL: 0CVE-2014-0743
https://notcve.org/view.php?id=CVE-2014-0743
The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468. El componente Certificate Authority Proxy Function (CAPF) en Cisco Unified Communications Manager (Unified CM) 10.0(1) y anteriores permite a atacantes remotos evadir autenticación y modificar información de dispositivo registrado a través de datos manipulados, también conocido como Bug ID CSCum95468. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0743 http://tools.cisco.com/security/center/viewAlert.x?alertId=33044 http://www.securitytracker.com/id/1029843 • CWE-287: Improper Authentication •
CVSS: 6.8EPSS: 0%CPEs: 18EXPL: 0CVE-2014-0740
https://notcve.org/view.php?id=CVE-2014-0740
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CSCun00701. Vulnerabilidad de CSRF en la interfaz Call Detail Records Analysis and Reporting (CAR) en el componente OS Administration en Cisco Unified Communications Manager (Unified CM) 10.0(1) y anteriores permite a atacantes remotos secuestrar la autenticación de administradores para solicitudes que realizan cambios administrativos, también conocido como Bug ID CSCun00701. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0740 http://tools.cisco.com/security/center/viewAlert.x?alertId=33049 http://www.securitytracker.com/id/1029843 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.2EPSS: 0%CPEs: 18EXPL: 0CVE-2014-0741
https://notcve.org/view.php?id=CVE-2014-0741
The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461. La funcionalidad certificate-import en la implementación Certificate Authority Proxy Function (CAPF) CLI en Cisco Unified Communications Manager (Unified CM) 10.0(1) y anteriores permite a usuarios locales leer o modificar archivos arbitrarios a través de un comando manipulado, también conocido como Bug ID CSCum95461. • http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0741 http://tools.cisco.com/security/center/viewAlert.x?alertId=33046 http://www.securitytracker.com/id/1029843 • CWE-310: Cryptographic Issues •