Unscored severity · published May 20, 2011
CVE-2011-0960
Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to execute arbitrary SQL commands via (1) the CCMs parameter to…
–
CVSS
3.8%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to execute arbitrary SQL commands via (1) the CCMs parameter to iptm/PRTestCreation.do or (2) the ccm parameter to iptm/TelePresenceReportAction.do, aka Bug ID CSCtn61716.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UO
Unified Operations Manager · Cisco
through 8.5; 1.1; 2.0; 2.0.1; 2.0.2; 2.0.3; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0960
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=23086
Exploit
http://www.exploit-db.com/exploits/17304
www.securityfocus.com
http://www.securityfocus.com/bid/47898
Exploit
http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/67522
More from Unified Operations Manager
–
CVE-2013-5488
Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS), Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager, does not…
–
CVE-2013-3440
Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote attackers to inject arbitrary web script…
–
CVE-2013-3439
Cross-site scripting (XSS) vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML via a crafted URL in an unspecified…
–
CVE-2013-3437
SQL injection vulnerability in the management application in Cisco Unified Operations Manager allows remote authenticated users to execute arbitrary SQL commands via an entry…
–
CVE-2013-3416
Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified Operations Manager and Unified Service…