Cisco Unified Meetingplace vulnerabilities

25 CVEs affecting Cisco Unified Meetingplace, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-4233, published 2015-07-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0702, published 2015-04-21. High severity, CVSS 9.0. EPSS: 2.9% chance of exploitation in the next 30 days. Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the…
CVE-2010-0140, published 2010-01-28. High severity, CVSS 10.0. EPSS: 2.6% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create (1) user or (2)…
CVE-2012-5416, published 2012-11-02. High severity, CVSS 7.8. EPSS: 2% chance of exploitation in the next 30 days. Buffer overflow in Cisco Unified MeetingPlace Web Conferencing before 7.1MR1 Patch 1, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 allows remote attackers to cause a denial of service (daemon…
CVE-2010-0139, published 2010-01-28. High severity, CVSS 9.0. EPSS: 2% chance of exploitation in the next 30 days. Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.2, and possibly 5 does not properly validate SQL commands, which allows remote attackers to create, modify, or delete data in…
CVE-2015-4214, published 2015-06-24. Medium severity, CVSS 4.0. EPSS: 2% chance of exploitation in the next 30 days. Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050.
CVE-2010-0142, published 2010-01-28. High severity, CVSS 8.5. EPSS: 2% chance of exploitation in the next 30 days. MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote authenticated users to gain privileges via a modified authentication sequence, aka Bug ID CSCsv66530.
CVE-2015-4233, published 2015-07-02. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.
CVE-2015-0764, published 2015-06-04. Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days. Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to read arbitrary files via a crafted resource request, aka Bug ID CSCus95603.
CVE-2015-0763, published 2015-06-04. Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days. Cisco Unified MeetingPlace 8.6(1.2) does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338.
CVE-2015-0758, published 2015-05-30. Medium severity, CVSS 4.0. EPSS: 1.6% chance of exploitation in the next 30 days. The web-based user interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with…

Latest

CVE-2015-0762, published 2015-06-04. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) for Microsoft Outlook allows remote attackers to inject arbitrary web script…
CVE-2015-0705, published 2015-04-22. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of…
CVE-2015-0704, published 2015-04-22. Medium severity, CVSS 6.8. EPSS: 1% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in API features in Cisco Unified MeetingPlace 8.6(1.9) allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID…
CVE-2015-0703, published 2015-04-21. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified…