Cisco Enterprise Chat And Email vulnerabilities

CVE-2025-20310 [MEDIUM] CWE-79 CVE-2025-20310: A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticate A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by pers

CVE-2025-20139 [HIGH] CWE-185 CVE-2025-20139: A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an u A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input to chat entry points. An attacker could exploit this vulnerability by sending malicious requests to a m

CVE-2022-20633 [MEDIUM] CWE-204 CVE-2022-20633: A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticat A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device. This vulnerability is due to differences in authentication responses that are sent back from the application as part of an authentication attempt. An attacker could e

CVE-2022-20634 [MEDIUM] CWE-601 CVE-2022-20634: A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticat A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading

CVE-2022-20631 [MEDIUM] CWE-79 CVE-2022-20631: A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticat A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerabil

CVE-2022-20632 [MEDIUM] CWE-79 CVE-2022-20632: A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticat A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerabil

CVE-2024-20484 [HIGH] CWE-20 CVE-2024-20484: A vulnerability in the External Agent Assignment Service (EAAS) feature of Cisco Enterprise Chat and A vulnerability in the External Agent Assignment Service (EAAS) feature of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of Media Routing Peripheral Interface Manager (MR PIM) traffic that is

CVE-2024-20367 [MEDIUM] CWE-79 CVE-2024-20367: A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a u

CVE-2022-20802 [MEDIUM] CWE-79 CVE-2022-20802: A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authent A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by the web interface. An attacker could exploit this v

CVE-2021-44228 [CRITICAL] CWE-20 CVE-2021-44228: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LD

CVE-2019-1877 [MEDIUM] CWE-200 CVE-2019-1877: A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, r A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to th

CVE-2019-1870 [MEDIUM] CWE-79 CVE-2019-1870: A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Cente A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the

CVE-2019-1702 [MEDIUM] CWE-79 CVE-2019-1702: Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email co Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerabilities are due to insufficient validation of user-supplied input by t