Cisco Unified Communications Domain Manager vulnerabilities

41 CVEs affecting Cisco Unified Communications Domain Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-15968, published 2019-11-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-3300, published 2014-07-07. High severity, CVSS 7.5. EPSS: 21.9% chance of exploitation in the next 30 days. The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 10 does not properly implement access control, which allows…
CVE-2018-0124, published 2018-02-22. Critical severity, CVSS 9.8. EPSS: 5.1% chance of exploitation in the next 30 days. A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code.…
CVE-2014-2198, published 2014-07-07. High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days. Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the…
CVE-2014-2197, published 2014-07-07. High severity, CVSS 9.0. EPSS: 2.9% chance of exploitation in the next 30 days. The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 8.1.4 does not properly implement access control, which…
CVE-2015-4229, published 2015-06-30. Medium severity, CVSS 5.0. EPSS: 2.6% chance of exploitation in the next 30 days. The web framework in Cisco Unified Communications Domain Manager 8.1(4)ER1 allows remote attackers to obtain sensitive information by visiting a bvsmweb URL, aka Bug ID CSCuq22589.
CVE-2014-3337, published 2014-08-12. Medium severity, CVSS 6.8. EPSS: 2.4% chance of exploitation in the next 30 days. The SIP implementation in Cisco Unified Communications Manager (CM) 8.6(.2) and earlier allows remote authenticated users to cause a denial of service (process crash) via a crafted SIP message that…
CVE-2014-8020, published 2015-01-10. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. Cisco Unified Communication Domain Manager Platform Software allows remote attackers to cause a denial of service (CPU consumption, and performance degradation or service outage) via a flood of…
CVE-2014-3279, published 2014-05-29. Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days. The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier does not properly implement access control, which allows remote attackers…
CVE-2014-3320, published 2014-07-18. Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days. Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager (CDM) 8.1(.4) and earlier allow remote attackers to redirect…
CVE-2014-3283, published 2014-05-29. Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days. Open redirect vulnerability in Self-Care Client Portal applications in the web framework in VOSS in Cisco Unified Communications Domain Manager (CDM) 9.0(.1) and earlier allows remote attackers to…

Latest

CVE-2019-15968, published 2019-11-26. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated, remote attacker to conduct a cross-site scripting…
CVE-2018-0386, published 2018-08-15. Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The…
CVE-2018-0364, published 2018-06-21. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF)…
CVE-2017-12302, published 2017-11-16. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL…
CVE-2017-6670, published 2017-06-13. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect…
CVE-2017-6668, published 2017-06-13. Medium severity, CVSS 4.9. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager (CUCDM) could allow an authenticated, remote attacker to impact the confidentiality of the system by executing…
CVE-2016-1354, published 2016-03-03. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 8.x before 8.1.1 allows remote attackers to inject arbitrary web script or HTML via crafted markup data,…
CVE-2015-6422, published 2015-12-14. Medium severity, CVSS 4.0. EPSS: 1.9% chance of exploitation in the next 30 days. The self-service application in Cisco Unified Communications Domain Manager (CUCDM) 10.6(1) allows remote authenticated users to cause a denial of service (subapplication outage) via malformed…
CVE-2015-6352, published 2015-10-30. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cisco Unified Communications Domain Manager before 10.6(1) provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to…