Vulnerabilities > Cisco > Unified Communications Manager > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-02-19 CVE-2015-0749 Cross-site Scripting vulnerability in Cisco Unified Communications Manager
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software.
network
low complexity
cisco CWE-79
6.1
2019-10-02 CVE-2019-1915 Cross-Site Request Forgery (CSRF) vulnerability in Cisco products
A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
network
low complexity
cisco CWE-352
6.5
2019-10-02 CVE-2019-15272 HTTP Request Smuggling vulnerability in Cisco Unified Communications Manager
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to bypass security restrictions.
network
low complexity
cisco CWE-444
6.5
2019-10-02 CVE-2019-12716 Cross-site Scripting vulnerability in Cisco Unified Communications Manager
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface.
network
low complexity
cisco CWE-79
6.1
2019-10-02 CVE-2019-12715 Cross-site Scripting vulnerability in Cisco Unified Communications Manager
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software.
network
low complexity
cisco CWE-79
6.1
2019-10-02 CVE-2019-12711 XXE vulnerability in Cisco Unified Communications Manager
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition.
network
low complexity
cisco CWE-611
6.5
2019-10-02 CVE-2019-12710 SQL Injection vulnerability in Cisco Unified Communications Manager
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries.
network
low complexity
cisco CWE-89
4.9
2019-10-02 CVE-2019-12707 Cross-site Scripting vulnerability in Cisco products
A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software.
network
low complexity
cisco CWE-79
6.1
2018-10-05 CVE-2018-15403 Open Redirect vulnerability in Cisco products
A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page.
network
low complexity
cisco CWE-601
5.4
2018-08-01 CVE-2018-0411 Cross-site Scripting vulnerability in Cisco Unified Communications Manager
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.
network
low complexity
cisco CWE-79
6.1