Page 6 of 68 results (0.006 seconds)

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2017-6785

https://notcve.org/view.php?id=CVE-2017-6785

17 Aug 2017 — A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform a horizontal privilege escalation where one user can modify another user's configuration. The vulnerability is due to lack of proper Role Based Access Control (RBAC) when certain user configuration changes are requested. An attacker could exploit this vulnerability by sending an authenticated, crafted HTTP request to the targeted application. ... • http://www.securityfocus.com/bid/100375 • CWE-20: Improper Input Validation •

CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2017-6757

https://notcve.org/view.php?id=CVE-2017-6757

07 Aug 2017 — A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to modify or delete entries in some database tables, affec... • http://www.securityfocus.com/bid/100121 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-6758

https://notcve.org/view.php?id=CVE-2017-6758

07 Aug 2017 — A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context of the web root directory structure on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by using directory traversal techniques to read files in the web root directory structure on the Cisco Unified Communications Manager filesystem... • http://www.securityfocus.com/bid/100119 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2017-6654

https://notcve.org/view.php?id=CVE-2017-6654

22 May 2017 — A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a... • http://www.securityfocus.com/bid/98527 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0

CVE-2017-3808

https://notcve.org/view.php?id=CVE-2017-3808

20 Apr 2017 — A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate limiting protection. An attacker could exploit this vulnerability by sending the affected device a high rate of SIP messages. An exploit could allow the attacker to cause the device to reload unexpectedly. The d... • http://www.securityfocus.com/bid/97922 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0

CVE-2017-3886

https://notcve.org/view.php?id=CVE-2017-3886

07 Apr 2017 — A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The attacker must be authenticated as an administrative user to execute SQL database queries. More Information: CSCvc74291. Known Affected Releases: 1.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 12.0(0.98000.619) 12.0(0.98000.485) 12.0(0.98000.212) 11.5(1.13035.1) 11.0(1.23900.5) 11.... • http://www.securityfocus.com/bid/97432 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-3877

https://notcve.org/view.php?id=CVE-2017-3877

17 Mar 2017 — A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web interface of the affected software. More Information: CSCvb70021. Known Affected Releases: 11.5(1.11007.2). Una vulnerabilidad en el marco web de Cisco Unified Communications Manager (CallManager) podría permitir que un atacante remoto no autenticado lleve a cabo un ataque de falsificación de... • http://www.securityfocus.com/bid/96915 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-3874

https://notcve.org/view.php?id=CVE-2017-3874

17 Mar 2017 — A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack. More Information: CSCvb70033. Known Affected Releases: 11.5(1.11007.2). Known Fixed Releases: 12.0(0.98000.507) 11.0(1.23900.5) 11.0(1.23900.3) 10.5(2.15900.2). Una vulnerabilidad en el marco web de Cisco Unified Communications Manager (CallManager) podría permitir que un atacante remoto autenticado realice un ataque XSS. • http://www.securityfocus.com/bid/96914 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2017-3872

https://notcve.org/view.php?id=CVE-2017-3872

17 Mar 2017 — A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct XSS attacks against a user of an affected device. More Information: CSCvc21620. Known Affected Releases: 10.5(2.14076.1). Known Fixed Releases: 12.0(0.98000.641) 12.0(0.98000.500) 12.0(0.98000.219). Una vulnerabilidad de desviación del filtro XSS en la interfaz de administración basada en web de Cisco Unified Communi... • http://www.securityfocus.com/bid/96916 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-3836

https://notcve.org/view.php?id=CVE-2017-3836

22 Feb 2017 — A vulnerability in the web framework Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. More Information: CSCvb61689. Known Affected Releases: 11.5(1.11007.2). Known Fixed Releases: 12.0(0.98000.162) 12.0(0.98000.178) 12.0(0.98000.383) 12.0(0.98000.488) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.6). Una vulnerabilidad en el marco web Cisco Unified Communications Manager podría permitir a un atacante remoto no autenticado visualizar datos sensible... • http://www.securityfocus.com/bid/96251 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •