UC
Product
Unity Connection
On CISA KEVExploited in the wild
64
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 30Low 0
Watch
Add Unity Connection to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-15396 | 6.8 | Oct 5 | A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a… Affected: 12.5 |
| CVE-2025-20278 | 6.7 | Jun 4 | A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating… Affected: 12.5(1); 12.5(1)su1; 12.5(1)su2; 12.5(1)su3; 12.5(1)su4; 12.5(1)su5; +5 more |
| CVE-2026-20061 | 6.5 | Apr 15 | Cisco Unity Connection SQL Injection Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2026-20081 | 6.5 | Apr 15 | Cisco Unity Connection Arbitrary File Download Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2026-20078 | 6.5 | Apr 15 | Cisco Unity Connection Arbitrary File Download Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2021-1226 | 6.5 | Jan 13 | A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 11.5\(1\) before 11.5\(1\)su9; 12.0\(1\) before 12.0\(1\)su4; 12.5\(1\) before 12.5\(1\)su3; 10.5(2) |
| CVE-2020-3130 | 6.5 | Sep 23 | A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying filesystem Affected: 11.0 before 11.5su7; 12.0 before 12.5su2 |
| CVE-2019-1915 | 6.5 | Oct 2 | A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified… Affected: 11.5; 12.0; 12.5; 14.0 |
| CVE-2026-20059 | 6.1 | Apr 15 | Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2022-20800 | 6.1 | Jul 6 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: 11.5\(1\) before 14su2 |
| CVE-2022-20788 | 6.1 | Apr 21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1 |
| CVE-2021-1409 | 6.1 | Apr 8 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14.0 |
| CVE-2021-1380 | 6.1 | Apr 8 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14.0 |
| CVE-2020-3282 | 6.1 | Jul 2 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 10.5\(2\) before 10.5\(2\)su10; 11.5\(1\) before 11.5\(1\)su8; 12.0(1); 12.5(1) |
| CVE-2019-12707 | 6.1 | Oct 2 | A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting… Affected: 11.5; 12.0; 12.5 |
| CVE-2019-1685 | 6.1 | Feb 21 | Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability Affected: 12.5 |
| CVE-2018-0354 | 6.1 | Jun 7 | A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of… Affected: 12.5 |
| CVE-2017-12212 | 6.1 | Sep 7 | A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a… Affected: 10.5(2) |
| CVE-2016-1377 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug… Affected: 10.0.0; 10.0.5; 10.5(2); 10.5(2.3009); 11.0(0.98000.225); 11.0.0 |
| CVE-2016-1304 | 6.1 | Jan 30 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID… Affected: 10.5(2.3009) |
| CVE-2016-1300 | 6.1 | Jan 27 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection (UC) 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID… Affected: 10.5(2.3009) |
| CVE-2018-15403 | 5.4 | Oct 5 | A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco… Affected: 9.1(1)es23 |
| CVE-2022-20752 | 5.3 | Jul 6 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection… Affected: 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1 |
| CVE-2018-0203 | 5.3 | Feb 22 | A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability Affected: All versions, or not specified |
| CVE-2017-6629 | 5.3 | May 3 | A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem… Affected: 10.5(2) |
| CVE-2024-20305 | 4.8 | Jan 26 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack… Affected: before 15.0 |
| CVE-2020-3129 | 4.8 | Jan 26 | A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting… Affected: before 12.5su2 |
| CVE-2018-15426 | 4.8 | Oct 5 | A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a… Affected: vmo-11.5(1) |
| CVE-2026-20060 | 4.7 | Apr 15 | Cisco Unity Connection Open Redirect Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +5 more |
| CVE-2021-34701 | 4.3 | Nov 4 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: before 14su1 |
Showing 30