Cisco Telepresence Video Communication Server vulnerabilities

CVE-2022-20806 [HIGH] CWE-532 CVE-2022-20806: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series a Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of thi

CVE-2022-20813 [MEDIUM] CWE-158 CVE-2022-20813: Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Se Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expre

CVE-2016-1400 [HIGH] CWE-20 CVE-2016-1400: Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to c Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header, aka Bug ID CSCuy43258.

CVE-2019-1721 [MEDIUM] CWE-20 CVE-2019-1721: A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Co A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An

CVE-2024-20492 [MEDIUM] CWE-77 CVE-2024-20492: A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, loc A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credentials with read-write privileges on an affected device.

CVE-2022-20807 [MEDIUM] CWE-532 CVE-2022-20807: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series a Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of t

CVE-2022-20809 [MEDIUM] CWE-532 CVE-2022-20809: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series a Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of t

CVE-2019-1872 [MEDIUM] CWE-918 CVE-2019-1872: A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series s A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on network services in the affected software. An attacker could exploit this vulner

CVE-2017-6790 [MEDIUM] CVE-2017-6790: A vulnerability in the Session Initiation Protocol (SIP) on the Cisco TelePresence Video Communicati A vulnerability in the Session Initiation Protocol (SIP) on the Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the targeted appliance. The vulnerability is due to excessive SIP traffic sent to the device. An attacker could exploit this vulnerability by transmi

CVE-2019-1722 [MEDIUM] CWE-352 CVE-2019-1722: A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Commun A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based m

CVE-2019-1679 [MEDIUM] CWE-918 CVE-2019-1679: A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and C A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack is commonly referred to as server-side request forgery

CVE-2019-1854 [MEDIUM] CWE-22 CVE-2019-1854: A vulnerability in the management web interface of Cisco Expressway Series could allow an authentica A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the

CVE-2019-12705 [MEDIUM] CWE-79 CVE-2019-12705: A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePrese A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient val

CVE-2019-1720 [MEDIUM] CWE-20 CVE-2019-1720: A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker c

CVE-2024-20400 [MEDIUM] CWE-601 CVE-2024-20400: A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unau A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from

CVE-2015-0752 [MEDIUM] CWE-79 CVE-2015-0752: Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5 Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635.