Cisco Unified Communications Manager vulnerabilities, page 5
211 vulnerabilities
Known vulnerabilities in Cisco Unified Communications Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2014-0657cisco · unified_communications_managercisco unified_communications_managerThe administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.EPSS2.13%HighCVE-2014-0728cisco · unified_communications_managercisco unified_communications_managerSQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05313.EPSS2.03%MediumCVE-2014-0732cisco · unified_communications_managercisco unified_communications_managerThe Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495.EPSS1.80%MediumCVE-2014-0742cisco · unified_communications_managercisco unified_communications_managerThe Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464.EPSS0.25%MediumCVE-2014-0747cisco · unified_communications_managercisco unified_communications_managerThe Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493.EPSS0.25%MediumCVE-2014-0686cisco · unified_communications_managercisco unified_communications_managerCisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file permissions, aka Bug IDs CSCul24917 and CSCul24908.EPSS0.31%HighCVE-2014-0734cisco · unified_communications_managercisco unified_communications_managerSQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483.EPSS1.17%MediumCVE-2014-0724cisco · unified_communications_managercisco unified_communications_managerThe bulk administration interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to bypass authentication and read arbitrary files by using an unspecified prompt, aka Bug ID CSCum05340.EPSS1.03%HighCVE-2014-0726cisco · unified_communications_managercisco unified_communications_managerSQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum05326.EPSS1.22%MediumCVE-2014-0735cisco · unified_communications_managercisco unified_communications_managerCross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum46470.EPSS1.79%MediumCVE-2014-7991cisco · unified_communications_managercisco unified_communications_managerThe Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376.EPSS0.68%MediumCVE-2014-3317cisco · unified_communications_managercisco unified_communications_managerDirectory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314.EPSS2.56%MediumCVE-2014-3319cisco · unified_communications_managercisco unified_communications_managerDirectory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676.EPSS2.75%HighCVE-2014-3338cisco · unified_communications_managercisco unified_communications_managerThe CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491.EPSS3.12%MediumCVE-2014-3332cisco · unified_communications_managercisco unified_communications_managerCisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent logins via unspecified vectors, aka Bug ID CSCup98029.EPSS1.64%MediumCVE-2014-3318cisco · unified_communications_managercisco unified_communications_managerDirectory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318.EPSS2.98%MediumCVE-2014-3316cisco · unified_communications_managercisco unified_communications_managerThe Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297.EPSS1.80%LowCVE-2014-3363cisco · unified_communications_managercisco unified_communications_managerCross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443.EPSS1.54%MediumCVE-2014-3315cisco · unified_communications_managercisco unified_communications_managerCross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.EPSS1.16%HighCVE-2008-2061cisco · unified_communications_managercisco unified_communications_managerThe Computer Telephony Integration (CTI) Manager service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3c) and 6.x before 6.1(2) allows remote attackers to cause a denial of service (TSP crash) via malformed network traffic to TCP port 2748.EPSS2.45%