Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2023-11-21	CVE-2023-20265	Cross-site Scripting vulnerability in Cisco products A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. network low complexity cisco CWE-79	5.4
2022-01-14	CVE-2022-20660	Cleartext Storage of Sensitive Information vulnerability in Cisco products A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. low complexity cisco CWE-312	4.6