Cisco Unified Customer Voice Portal vulnerabilities

16 CVEs affecting Cisco Unified Customer Voice Portal, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-44228, published 2021-12-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2013-1221, published 2013-05-09. High severity, CVSS 10.0. EPSS: 3.4% chance of exploitation in the next 30 days. The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute…
CVE-2008-2053, published 2008-05-22. High severity, CVSS 9.0. EPSS: 3% chance of exploitation in the next 30 days. Unspecified vulnerability in Cisco Unified Customer Voice Portal (CVP) 4.0.x before 4.0(2)_ES14, 4.1.x before 4.1(1)_ES11, and 7.x before 7.0(1) allows remote authenticated users with administrator…
CVE-2018-0139, published 2018-02-22. High severity, CVSS 8.6. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause the IVR…
CVE-2018-0086, published 2018-01-18. High severity, CVSS 8.6. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected…
CVE-2017-12214, published 2017-09-21. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated,…
CVE-2013-1224, published 2013-05-09. High severity, CVSS 7.8. EPSS: 2.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted…
CVE-2013-1225, published 2013-05-09. High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days. Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager (1) HTTP or (2) HTTPS request containing an external…
CVE-2020-3402, published 2020-07-02. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an…
CVE-2013-1223, published 2013-05-09. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. The log viewer in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly validate an unspecified parameter, which allows remote attackers to read arbitrary files via…

Latest

CVE-2021-1599, published 2021-07-22. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack against…
CVE-2019-16017, published 2020-09-23. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to…
CVE-2015-0735, published 2015-05-17. Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970.
CVE-2014-3325, published 2014-07-19. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Customer Voice Portal (CVP) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug IDs…