UC
Product
Unified Communications Manager
On CISA KEVExploited in the wild
238
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 24Medium 75Low 0
Watch
Add Unified Communications Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-0120 | 4.3 | Feb 8 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection attack against an affected… Affected: 11.5(1.13900.52) |
| CVE-2017-6785 | 4.3 | Aug 17 | A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform a horizontal… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6) |
| CVE-2017-3836 | 4.3 | Feb 22 | A vulnerability in the web framework Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data Affected: 11.5(1.11007.2) |
| CVE-2015-6425 | – | Dec 16 | The WebApplications Identity Management subsystem in Cisco Unified Communications Manager 10.5(0.98000.88) allows remote attackers to cause a denial of service (subsystem outage)… Affected: 10.5(0.98000.88) |
| CVE-2015-4206 | – | Dec 15 | Cisco Unified Communications Manager (UCM) 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266 Affected: 8.0(2c); 8.0(3); 8.0_base; 8.5.1; 8.5_base; 8.6.1; +2 more |
| CVE-2015-4295 | – | Aug 1 | The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.5(3.10000.9) allows remote authenticated users to discover root credentials via a direct… Affected: 10.5(3.10000.9) |
| CVE-2015-4272 | – | Jul 14 | Multiple cross-site scripting (XSS) vulnerabilities in the ccmivr page in Cisco Unified Communications Manager (formerly CallManager) 10.5(2.10000.5) allow remote attackers to… Affected: 10.5(2.10000.5) |
| CVE-2015-4269 | – | Jul 14 | The Tomcat throttling feature in Cisco Unified Communications Manager 10.5(1.99995.9) allows remote authenticated users to cause a denial of service (management outage) by sending… Affected: 10.5(1.99995.9) |
| CVE-2015-0751 | – | May 29 | Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID… Affected: 10.3(1) |
| CVE-2015-0717 | – | May 16 | Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546 Affected: 10.0(1.10000.12) |
| CVE-2014-8008 | – | Jan 22 | Absolute path traversal vulnerability in the Real-Time Monitoring Tool (RTMT) API in Cisco Unified Communications Manager (CUCM) allows remote authenticated users to read… Affected: All versions, or not specified |
| CVE-2014-7991 | – | Nov 14 | The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509… Affected: through 10.0\(1\); 10.0 |
| CVE-2014-3375 | – | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary… Affected: All versions, or not specified |
| CVE-2014-3374 | – | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web… Affected: All versions, or not specified |
| CVE-2014-3373 | – | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to… Affected: All versions, or not specified |
| CVE-2014-3372 | – | Oct 31 | Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary… Affected: All versions, or not specified |
| CVE-2014-3366 | – | Oct 31 | SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a… Affected: All versions, or not specified |
| CVE-2014-3363 | – | Sep 12 | Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary… Affected: 9.1(2.10000.28) |
| CVE-2014-3338 | – | Aug 12 | The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote… Affected: 10.0(1) |
| CVE-2014-3332 | – | Aug 11 | Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent… Affected: through 8.6\(2\) |
| CVE-2014-3319 | – | Jul 14 | Directory traversal vulnerability in the Real-Time Monitoring Tool (RTMT) in Cisco Unified Communications Manager (CM) 10.0(1) allows remote authenticated users to read arbitrary… Affected: 10.0(1) |
| CVE-2014-3317 | – | Jul 14 | Directory traversal vulnerability in the Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager 10.0(1) allows remote… Affected: 10.0(1) |
| CVE-2014-3318 | – | Jul 10 | Directory traversal vulnerability in dna/viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated… Affected: 10.0(1)_base |
| CVE-2014-3316 | – | Jul 10 | The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload… Affected: 10.0(1)_base |
| CVE-2014-3315 | – | Jul 10 | Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to… Affected: 10.0(1)_base |
| CVE-2014-3292 | – | Jun 10 | The Real Time Monitoring Tool (RTMT) implementation in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to (1) read or (2) delete arbitrary… Affected: All versions, or not specified |
| CVE-2014-3287 | – | Jun 10 | SQL injection vulnerability in BulkViewFileContentsAction.java in the Java interface in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to… Affected: All versions, or not specified |
| CVE-2014-2185 | – | Apr 29 | The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by… Affected: All versions, or not specified |
| CVE-2014-2184 | – | Apr 29 | The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug… Affected: All versions, or not specified |
| CVE-2014-0747 | – | Feb 27 | The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0743 | – | Feb 27 | The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0742 | – | Feb 27 | The Certificate Authority Proxy Function (CAPF) CLI implementation in the CSR management feature in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0741 | – | Feb 27 | The certificate-import feature in the Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0740 | – | Feb 27 | Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) interface in the OS Administration component in Cisco Unified… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0731 | – | Feb 22 | The administration interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and read Java class files… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0733 | – | Feb 20 | The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements,… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0736 | – | Feb 20 | Cross-site request forgery (CSRF) vulnerability in the Call Detail Records Analysis and Reporting (CAR) page in Cisco Unified Communications Manager (Unified CM) 10.0(1) and… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0735 | – | Feb 20 | Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0734 | – | Feb 20 | SQL injection vulnerability in the Certificate Authority Proxy Function (CAPF) implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0732 | – | Feb 20 | The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication… Affected: through 10.0\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +12 more |
| CVE-2014-0729 | – | Feb 13 | SQL injection vulnerability in the Enterprise Mobility Application (EMApp) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute arbitrary SQL… Affected: All versions, or not specified |
| CVE-2014-0728 | – | Feb 13 | SQL injection vulnerability in the Java database interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute arbitrary SQL… Affected: through 10.0\(1\); 10.0 |
| CVE-2014-0727 | – | Feb 13 | SQL injection vulnerability in the CallManager Interactive Voice Response (CMIVR) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2014-0726 | – | Feb 13 | SQL injection vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to execute… Affected: through 10.0\(1\); 10.0 |
| CVE-2014-0725 | – | Feb 13 | Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified… Affected: All versions, or not specified |
| CVE-2014-0724 | – | Feb 13 | The bulk administration interface in Cisco Unified Communications Manager (UCM) 10.0(1) and earlier allows remote attackers to bypass authentication and read arbitrary files by… Affected: through 10.0\(1\); 10.0 |
| CVE-2014-0723 | – | Feb 13 | Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to inject arbitrary web… Affected: All versions, or not specified |
| CVE-2014-0722 | – | Feb 13 | The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service… Affected: All versions, or not specified |
| CVE-2014-0686 | – | Feb 4 | Cisco Unified Communications Manager (aka Unified CM) 9.1 (2.10000.28) and earlier allows local users to gain privileges by leveraging incorrect file permissions, aka Bug IDs… Affected: through 9.1\(2.10000.28\); 9.1(1); 9.1(2) |
| CVE-2014-0657 | – | Jan 8 | The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated… Affected: through 9.1\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +34 more |