Cisco Webex Meetings Server vulnerabilities, page 4

132 vulnerabilities

Known vulnerabilities in Cisco Webex Meetings Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5MediumCVE-2020-3471cisco · cisco webex meetings server +1 moreCisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure VulnerabilityA vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to maintain bidirectional audio despite being expelled from an active Webex session. The vulnerability is due to a synchronization issue between meeting and media services on a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit could allow the attacker to maintain the audio connection of a Webex session despite being expelled.EPSS1.76%4.1MediumCVE-2020-3501cisco · cisco webex meetings +2 moreCisco Webex Meetings Desktop App Information Disclosure VulnerabilitiesMultiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted information from other Webex users. These vulnerabilities are due to improper input validation of parameters returned to the application from a web site. An attacker with a valid Webex account could exploit these vulnerabilities by persuading a user to follow a URL that is designed to return malicious path parameters to the affected software. A successful exploit could allow the attacker to obtain restricted information from other Webex users.EPSS1.02%9.1CriticalCVE-2020-3419cisco · cisco webex meetings server +1 moreCisco Webex Meetings and Cisco Webex Meetings Server Ghost Join VulnerabilityA vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens by a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit requires the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. The attacker could then exploit this vulnerability to join meetings, without appearing in the participant list, while having full access to audio, video, chat, and screen sharing capabilities.EPSS1.76%3.5LowCVE-2020-3126cisco · cisco webex meetings multimedia viewer +1 moreCisco Webex Meetings Multimedia Viewer Vulnerabilityvulnerability within the Multimedia Viewer feature of Cisco Webex Meetings could allow an authenticated, remote attacker to bypass security protections. The vulnerability is due to missing security warning dialog boxes when a room host views shared multimedia files. An authenticated, remote attacker could exploit this vulnerability by using the host role to share files within the Multimedia sharing feature and convincing a former room host to view that file. A warning dialog normally appears cautioning users before the file is displayed; however, the former host would not see that warning dialog, and any shared multimedia would be rendered within the user's browser. The attacker could leverage this behavior to conduct additional attacks by including malicious files within a targeted room host's browser window.EPSS0.86%9.3CriticalCVE-2020-3128cisco · cisco webex wrf player +4 moreCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesMultiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements within a Webex recording that is stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a malicious ARF or WRF file to a user through a link or email attachment and persuading the user to open the file on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.EPSS1.93%4.1MediumCVE-2020-3502cisco · cisco webex meetings +2 moreCisco Webex Meetings Desktop App Information Disclosure VulnerabilitiesMultiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted information from other Webex users. These vulnerabilities are due to improper input validation of parameters returned to the application from a web site. An attacker with a valid Webex account could exploit these vulnerabilities by persuading a user to follow a URL that is designed to return malicious path parameters to the affected software. A successful exploit could allow the attacker to obtain restricted information from other Webex users.EPSS1.02%5.3MediumCVE-2020-3441cisco · cisco webex meetings server +2 moreCisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure VulnerabilityA vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to view sensitive information from the meeting room lobby. This vulnerability is due to insufficient protection of sensitive participant information. An attacker could exploit this vulnerability by browsing the Webex roster. A successful exploit could allow the attacker to gather information about other Webex participants, such as email address and IP address, while waiting in the lobby.EPSS1.57%5MediumCVE-2014-2199cisco · webex_business_suite +5 morecisco webex_business_suitemeetinginfo.do in Cisco WebEx Event Center, WebEx Meeting Center, WebEx Sales Center, WebEx Training Center, WebEx Meetings Server 1.5(.1.131) and earlier, and WebEx Business Suite (WBS) 27 before 27.32.31.16, 28 before 28.12.13.18, and 29 before 29.5.1.12 allows remote attackers to obtain sensitive meeting information by leveraging knowledge of a meeting identifier, aka Bug IDs CSCuo68624 and CSCue46738.EPSS1.65%6.8MediumCVE-2014-2186cisco · webex_meetings_servercisco webex_meetings_serverCross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777.EPSS0.57%7.3HighCVE-2014-0691cisco · webex_meetings_servercisco webex_meetings_serverCisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643.EPSS1.02%4.9MediumCVE-2014-0682cisco · webex_meetings_servercisco webex_meetings_serverCisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346.EPSS1.94%6.8MediumCVE-2014-8031cisco · webex_meetings_servercisco webex_meetings_serverCross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456.EPSS0.64%5MediumCVE-2014-8033cisco · webex_meetings_servercisco webex_meetings_serverThe play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421.EPSS1.37%5MediumCVE-2014-8035cisco · webex_meetings_servercisco webex_meetings_serverThe web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCuj40247.EPSS1.35%4MediumCVE-2014-8032cisco · webex_meetings_servercisco webex_meetings_serverThe OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information via unspecified vectors, aka Bug IDs CSCuj40453 and CSCuj40449.EPSS1.09%4.3MediumCVE-2014-8030cisco · webex_meetings_servercisco webex_meetings_serverCross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote attackers to inject arbitrary web script or HTML via the email parameter, aka Bug ID CSCuj40381.EPSS1.16%5MediumCVE-2014-8036cisco · webex_meetings_servercisco webex_meetings_serverThe outlookpa component in Cisco WebEx Meetings Server does not properly validate API input, which allows remote attackers to modify a meeting's invite list via a crafted URL, aka Bug ID CSCuj40254.EPSS1.33%5MediumCVE-2014-8034cisco · webex_meetings_servercisco webex_meetings_serverCisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it easier for remote attackers to obtain access via a brute-force approach of guessing usernames, aka Bug ID CSCuj40321.EPSS1.37%4MediumCVE-2014-3400cisco · webex_meetings_servercisco webex_meetings_serverCisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344.EPSS0.95%4MediumCVE-2014-3296cisco · webex_meetings_servercisco webex_meetings_serverThe XML programmatic interface (XML PI) in Cisco WebEx Meeting Server 1.5(.1.131) and earlier allows remote authenticated users to obtain sensitive meeting information via a crafted URL, aka Bug ID CSCum03527.EPSS1.30%