Cisco Prime Collaboration Assurance vulnerabilities

CVE-2019-1856 [MEDIUM] CWE-79 CVE-2019-1856: A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance (PCA) c A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance (PCA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to the insufficient validation of data supplied by external

CVE-2019-1662 [HIGH] CWE-287 CVE-2019-1662: A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assura A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote attacker to access the system as a valid user. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the QOVR service with

CVE-2018-15438 [MEDIUM] CWE-352 CVE-2018-15438: A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could a A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the

CVE-2018-0458 [MEDIUM] CWE-79 CVE-2018-0458: A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could a A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-base

CVE-2018-0321 [CRITICAL] CWE-287 CVE-2018-0321: A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remo A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation (RMI) system. The vulnerability is due to an open port in the Network Interface and Configuration Engine (NICE) service. An attacker could exploit this vulnerability by accessing the open RMI sys

CVE-2017-6779 [HIGH] CWE-399 CVE-2017-6779: Multiple Cisco products are affected by a vulnerability in local file management for certain system Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability occurs because a certain system log file does not have a maxi

CVE-2018-0141 [HIGH] CWE-798 CVE-2018-0141: A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthe A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via Secure Shell (SSH)

CVE-2017-6659 [HIGH] CWE-352 CVE-2017-6659: A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could a A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvc91800. Known Affected Releases: 11.5(0) 11.6.

CVE-2017-3844 [MEDIUM] CWE-20 CVE-2017-3844: A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are vulnerable. Cisco Prime Collaboration Assurance software

CVE-2017-3845 [MEDIUM] CWE-79 CVE-2017-3845: A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could a A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 1

CVE-2017-3843 [MEDIUM] CWE-20 CVE-2017-3843: A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow a A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to download system files that should be restricted. More Information: CSCvc99446. Known Affected Releases: 11.5(0).

CVE-2016-9200 [MEDIUM] CWE-79 CVE-2016-9200: A vulnerability in the web framework code of Cisco Prime Collaboration Assurance could allow an unau A vulnerability in the web framework code of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface. More Information: CSCut43268. Known Affected Releases: 10.5(1) 10.6.

CVE-2016-1392 [HIGH] CVE-2016-1392: Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuu34121.

CVE-2015-6389 [CRITICAL] CWE-287 CVE-2015-6389: Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session and leveraging knowledge of this account's password, aka Bug ID CSCus62707.

CVE-2015-6330 [MEDIUM] CWE-352 CVE-2015-6330: Cross-site request forgery (CSRF) vulnerability in Cisco Prime Collaboration Assurance 10.5(1) and 1 Cross-site request forgery (CSRF) vulnerability in Cisco Prime Collaboration Assurance 10.5(1) and 10.6 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus62712.

CVE-2015-6328 [MEDIUM] CWE-200 CVE-2015-6328: The web framework in Cisco Prime Collaboration Assurance (PCA) 10.5(1) allows remote authenticated u The web framework in Cisco Prime Collaboration Assurance (PCA) 10.5(1) allows remote authenticated users to bypass intended access restrictions and read arbitrary files via a crafted URL, aka Bug ID CSCus88380.

CVE-2015-6331 [MEDIUM] CWE-89 CVE-2015-6331: SQL injection vulnerability in the web framework in Cisco Prime Collaboration Assurance 10.5(1) allo SQL injection vulnerability in the web framework in Cisco Prime Collaboration Assurance 10.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCus39887.

CVE-2015-4304 [CRITICAL] CWE-264 CVE-2015-4304: The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authent The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.

CVE-2015-4306 [HIGH] CWE-264 CVE-2015-4306: The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authent The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.

CVE-2015-4305 [MEDIUM] CWE-264 CVE-2015-4305: The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authent The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.