Vulnerabilities > Polycom

DATE CVE VULNERABILITY TITLE RISK
2020-03-12 CVE-2019-11355 OS Command Injection vulnerability in Polycom HDX System Software
An issue was discovered in Poly (formerly Polycom) HDX 3.1.13.
network
low complexity
polycom CWE-78
critical
9.0
2020-02-10 CVE-2012-6611 USE of Hard-Coded Credentials vulnerability in Polycom HDX System Software
An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Development Platform 2.14.g3.
network
low complexity
polycom CWE-798
critical
10.0
2020-01-28 CVE-2012-6610 OS Command Injection vulnerability in Polycom HDX Video END Points and UC APL
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (semicolon) to the ping command feature.
network
low complexity
polycom CWE-78
critical
9.0
2020-01-28 CVE-2012-6609 Path Traversal vulnerability in Polycom HDX Video END Points and UC APL
Directory traversal vulnerability in a_getlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a ..
network
low complexity
polycom CWE-22
5.0
2019-08-01 CVE-2019-14259 OS Command Injection vulnerability in Polycom Obihai Obi1022 Firmware 5.1.11
On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
low complexity
polycom CWE-78
7.7
2019-07-29 CVE-2019-12948 Exposed Dangerous Method OR Function vulnerability in Polycom products
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
network
low complexity
polycom CWE-749
6.5
2019-06-24 CVE-2019-10689 Improper Authentication vulnerability in Polycom products
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.
low complexity
polycom CWE-287
3.3
2019-06-13 CVE-2018-10947 Improper Input Validation vulnerability in Polycom Realpresence Debut Firmware
An issue was discovered in versions earlier than 1.3.2 for Polycom RealPresence Debut where the admin cookie is reset only after a Debut is rebooted.
2.9
2019-06-13 CVE-2018-10946 Information Exposure vulnerability in Polycom Realpresence Debut Firmware
An issue was discovered in versions earlier than 1.3.0-66872 for Polycom RealPresence Debut that allows attackers to arbitrarily read the admin user's password via the admin web UI.
low complexity
polycom CWE-200
2.7
2019-05-13 CVE-2018-15128 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Polycom Group Series, HDX and Pano
An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier.
network
low complexity
polycom CWE-119
critical
10.0