CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2018-0124
https://notcve.org/view.php?id=CVE-2018-0124
A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). • http://www.securityfocus.com/bid/103114 http://www.securitytracker.com/id/1040405 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdm • CWE-320: Key Management Errors •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6668
https://notcve.org/view.php?id=CVE-2017-6668
Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager (CUCDM) could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc52784 CSCvc97648. Known Affected Releases: 8.1(7)ER1. Vulnerabilidades en la GUI basada en web de Cisco Unified Communications Domain Manager (CUCDM), podrían permitir a un atacante autenticado y remoto afectar la confidencialidad del sistema mediante la ejecución de interrogaciones SQL arbitrarias, también se conoce como Inyección SQL. Más información: CSCvc52784 CSCvc97648. • http://www.securityfocus.com/bid/98947 http://www.securitytracker.com/id/1038632 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-cucm2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6670
https://notcve.org/view.php?id=CVE-2017-6670
A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.1(7)ER1. Una vulnerabilidad en la GUI basada en web de Cisco Unified Communications Domain Manager, podría permitir a un atacante remoto no autenticado redireccionar a un usuario hacia una página web maliciosa, también se conoce como un problema de Redireccionamiento Abierto. Más información: CSCvc54813. • http://www.securityfocus.com/bid/98946 http://www.securitytracker.com/id/1038631 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-cucm1 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0682
https://notcve.org/view.php?id=CVE-2015-0682
Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary code by visiting a "deprecated page," aka Bug ID CSCup90168. Cisco Unified Communications Domain Manager 8.1(4) permite a usuarios remotos autenticados ejecutar código arbitrario mediante la visita a una 'página obsoleta,' también conocido como Bug ID CSCup90168. • http://tools.cisco.com/security/center/viewAlert.x?alertId=38113 http://www.securitytracker.com/id/1032002 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0684
https://notcve.org/view.php?id=CVE-2015-0684
SQL injection vulnerability in the Image Management component in Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq52515. Vulnerabilidad de inyección SQL en el componente Image Management en Cisco Unified Communications Domain Manager 8.1(4) permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de vectores no especificados, también conocido como Bug ID CSCuq52515. • http://tools.cisco.com/security/center/viewAlert.x?alertId=38114 http://www.securitytracker.com/id/1032001 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •