Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Unified_communications_manager_im_and_presence_service
(Cisco)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 35 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2021-12-10 | CVE-2021-44228 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along... | Log4j, Xcode, Synchro, Synchro_4d, Advanced_malware_protection_virtual_private_cloud_appliance, Automated_subsea_tuning, Broadworks, Business_process_automation, Cloud_connect, Cloudcenter, Cloudcenter_cost_optimizer, Cloudcenter_suite, Cloudcenter_suite_admin, Cloudcenter_workload_manager, Common_services_platform_collector, Connected_analytics_for_network_deployment, Connected_mobile_experiences, Contact_center_domain_manager, Contact_center_management_portal, Crosswork_data_gateway, Crosswork_network_automation, Crosswork_network_controller, Crosswork_optimization_engine, Crosswork_platform_infrastructure, Crosswork_zero_touch_provisioning, Customer_experience_cloud_agent, Cx_cloud_agent, Cyber_vision, Cyber_vision_sensor_management_extension, Data_center_network_manager, Dna_center, Dna_spaces, Dna_spaces\:_connector, Dna_spaces_connector, Emergency_responder, Enterprise_chat_and_email, Evolved_programmable_network_manager, Finesse, Firepower_threat_defense, Fog_director, Fxos, Identity_services_engine, Integrated_management_controller_supervisor, Intersight_virtual_appliance, Iot_operations_dashboard, Mobility_services_engine, Network_assurance_engine, Network_dashboard_fabric_controller, Network_insights_for_data_center, Network_services_orchestrator, Nexus_dashboard, Nexus_insights, Optical_network_controller, Packaged_contact_center_enterprise, Paging_server, Prime_service_catalog, Sd\-Wan_vmanage, Smart_phy, Ucs_central, Ucs_central_software, Ucs_director, Unified_communications_manager, Unified_communications_manager_im_\&_presence_service, Unified_communications_manager_im_and_presence_service, Unified_computing_system, Unified_contact_center_enterprise, Unified_contact_center_express, Unified_contact_center_management_portal, Unified_customer_voice_portal, Unified_intelligence_center, Unified_sip_proxy, Unified_workforce_optimization, Unity_connection, Video_surveillance_manager, Video_surveillance_operations_manager, Virtual_topology_system, Virtualized_infrastructure_manager, Virtualized_voice_browser, Wan_automation_engine, Webex_meetings_server, Workload_optimization_manager, Debian_linux, Fedora, Audio_development_kit, Computer_vision_annotation_tool, Data_center_manager, Genomics_kernel_library, Oneapi_sample_browser, Secure_device_onboard, Sensor_solution_firmware_development_kit, System_debugger, System_studio, Active_iq_unified_manager, Cloud_insights, Cloud_manager, Cloud_secure_agent, Oncommand_insight, Ontap_tools, Snapcenter, Rhythmyx, Captial, Comos, Desigo_cc_advanced_reports, Desigo_cc_info_center, E\-Car_operation_center, Energy_engage, Energyip, Energyip_prepay, Gma\-Manager, Head\-End_system_universal_device_integration_system, Industrial_edge_management, Industrial_edge_management_hub, Logo\!_soft_comfort, Mendix, Mindsphere, Navigator, Nx, Opcenter_intelligence, Operation_scheduler, Sentron_powermanager, Siguard_dsa, Sipass_integrated, Siveillance_command, Siveillance_control_pro, Siveillance_identity, Siveillance_vantage, Siveillance_viewpoint, Solid_edge_cam_pro, Solid_edge_harness_design, Spectrum_power_4, Spectrum_power_7, Sppa\-T3000_ses3000_firmware, Teamcenter, Vesys, Xpedition_enterprise, Xpedition_package_integrator, Snow_commander, Vm_access_proxy, Email_security | 10.0 | ||
| 2024-01-26 | CVE-2024-20253 | A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on... | Unified_communications_manager, Unified_communications_manager_im_and_presence_service, Unified_contact_center_express, Unity_connection, Virtualized_voice_browser | 10.0 | ||
| 2023-06-28 | CVE-2023-20108 | A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to cause a temporary service outage for all Cisco Unified CM IM&P users who are attempting to authenticate to the service, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by... | Unified_communications_manager_im_and_presence_service | 7.5 | ||
| 2023-08-16 | CVE-2023-20242 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate... | Unified_communications_manager, Unified_communications_manager_im_and_presence_service | 6.1 | ||
| 2020-11-06 | CVE-2020-27121 | A vulnerability in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Software could allow an authenticated, remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of login requests. An attacker could exploit this vulnerability by sending a crafted client login request to an affected device. A successful exploit could allow... | Unified_communications_manager_im_and_presence_service | 6.5 | ||
| 2021-01-20 | CVE-2021-1282 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection... | Unified_communications_manager, Unified_communications_manager_im_and_presence_service | 4.9 | ||
| 2021-01-20 | CVE-2021-1355 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection... | Unified_communications_manager, Unified_communications_manager_im_and_presence_service | 6.5 | ||
| 2021-01-20 | CVE-2021-1357 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection... | Unified_communications_manager, Unified_communications_manager_im_and_presence_service | 6.5 | ||
| 2021-01-20 | CVE-2021-1364 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL injection attacks on an affected system. One of the SQL injection vulnerabilities that affects Unified CM IM&P also affects Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and could allow an attacker to conduct SQL injection... | Unified_communications_manager, Unified_communications_manager_im_and_presence_service | 4.9 | ||
| 2021-05-06 | CVE-2021-1363 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the... | Unified_communications_manager_im_and_presence_service | 8.1 |