Cisco Unified Communications Manager vulnerabilities
207 known vulnerabilities affecting cisco/unified_communications_manager.
Total CVEs
207
CISA KEV
2
actively exploited
Public exploits
6
Exploited in wild
1
Severity breakdown
CRITICAL12HIGH76MEDIUM117LOW1
Vulnerabilities
Page 6 of 11
CVE-2015-4272MEDIUMCVSS 4.3v10.5\(2.10000.5\)2015-07-14
CVE-2015-4272 [MEDIUM] CWE-79 CVE-2015-4272: Multiple cross-site scripting (XSS) vulnerabilities in the ccmivr page in Cisco Unified Communicatio
Multiple cross-site scripting (XSS) vulnerabilities in the ccmivr page in Cisco Unified Communications Manager (formerly CallManager) 10.5(2.10000.5) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCut19580.
nvd
CVE-2015-0751HIGHCVSS 7.8v10.3\(1\)2015-05-29
CVE-2015-0751 [HIGH] CWE-20 CVE-2015-0751: Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows
Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800.
nvd
CVE-2015-0717MEDIUMCVSS 6.9v10.0\(1.10000.12\)2015-05-16
CVE-2015-0717 [MEDIUM] CWE-20 CVE-2015-0717: Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a co
Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.
nvd
CVE-2014-7991MEDIUMCVSS 4.3≤ 10.0\(1\)v10.02014-11-14
CVE-2014-7991 [MEDIUM] CWE-310 CVE-2014-7991: The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier
The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq8637
nvd
CVE-2014-3363LOWCVSS 3.5v9.1\(2.10000.28\)2014-09-12
CVE-2014-3363 [LOW] CWE-79 CVE-2014-3363: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manage
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443.
nvd
CVE-2014-3338HIGHCVSS 8.5v10.0\(1\)2014-08-12
CVE-2014-3338 [HIGH] CWE-20 CVE-2014-3338: The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is e
The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491.
nvd
CVE-2014-3332MEDIUMCVSS 4.0≤ 8.6\(2\)2014-08-11
CVE-2014-3332 [MEDIUM] CVE-2014-3332: Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions sett
Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent logins via unspecified vectors, aka Bug ID CSCup98029.
nvd
CVE-2014-3317MEDIUMCVSS 5.5v10.0\(1\)2014-07-14
CVE-2014-3317 [MEDIUM] CWE-22 CVE-2014-3317: Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) compo
Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote authenticated users to delete arbitrary files via a crafted URL, aka Bug ID CSCup76314.
nvd
CVE-2014-3319MEDIUMCVSS 6.8v10.0\(1\)2014-07-14
CVE-2014-3319 [MEDIUM] CWE-22 CVE-2014-3319: Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communica
Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup57676.
nvd
CVE-2014-3316MEDIUMCVSS 4.0v10.0\(1\)_base2014-07-10
CVE-2014-3316 [MEDIUM] CWE-20 CVE-2014-3316: The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications
The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297.
nvd
CVE-2014-3318MEDIUMCVSS 4.0v10.0\(1\)_base2014-07-10
CVE-2014-3318 [MEDIUM] CWE-20 CVE-2014-3318: Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) com
Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via a crafted URL, aka Bug ID CSCup76318.
nvd
CVE-2014-3315MEDIUMCVSS 4.3v10.0\(1\)_base2014-07-10
CVE-2014-3315 [MEDIUM] CWE-79 CVE-2014-3315: Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA)
Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.
nvd
CVE-2014-0740MEDIUMCVSS 6.8≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-27
CVE-2014-0740 [MEDIUM] CWE-352 CVE-2014-0740: Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (C
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of administrators for requests that make administrative changes, aka Bug ID CS
nvd
CVE-2014-0742MEDIUMCVSS 6.2≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-27
CVE-2014-0742 [MEDIUM] CWE-20 CVE-2014-0742: The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in
The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via unspecified vectors, aka Bug ID CSCum95464.
nvd
CVE-2014-0741MEDIUMCVSS 6.2≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-27
CVE-2014-0741 [MEDIUM] CWE-310 CVE-2014-0741: The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation
The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to read or modify arbitrary files via a crafted command, aka Bug ID CSCum95461.
nvd
CVE-2014-0747MEDIUMCVSS 6.8≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-27
CVE-2014-0747 [MEDIUM] CWE-20 CVE-2014-0747: The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications M
The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493.
nvd
CVE-2014-0743MEDIUMCVSS 5.0≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-27
CVE-2014-0743 [MEDIUM] CWE-287 CVE-2014-0743: The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (U
The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468.
nvd
CVE-2014-0731MEDIUMCVSS 5.0≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-22
CVE-2014-0731 [MEDIUM] CWE-264 CVE-2014-0731: The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlie
The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and read Java class files via a direct request, aka Bug ID CSCum46497.
nvd
CVE-2014-0734HIGHCVSS 7.5≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-20
CVE-2014-0734 [HIGH] CWE-89 CVE-2014-0734: SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cis
SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCum46483.
nvd
CVE-2014-0736MEDIUMCVSS 6.8≤ 10.0\(1\)v3.3\(5\)+16 more2014-02-20
CVE-2014-0736 [MEDIUM] CWE-352 CVE-2014-0736: Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (C
Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug ID CSCum46468.
nvd