Cisco Unified Presence Server vulnerabilities

16 CVEs affecting Cisco Unified Presence Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-4220, published 2015-06-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-2874, published 2009-10-16. High severity, CVSS 7.8. EPSS: 3.8% chance of exploitation in the next 30 days. The TimesTenD process in Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4) allows remote attackers to cause a denial of service (process crash) via a large number of TCP…
CVE-2006-5553, published 2006-10-26. High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days. Cisco Security Agent (CSA) for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193, as used by Unified CallManager (CUCM) and Unified Presence Server (CUPS), allows remote attackers to cause a denial…
CVE-2014-3328, published 2014-07-26. Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days. The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125.
CVE-2013-1137, published 2013-02-27. High severity, CVSS 7.8. EPSS: 2.3% chance of exploitation in the next 30 days. Cisco Unified Presence Server (CUPS) 8.6, 9.0, and 9.1 before 9.1.1 allows remote attackers to cause a denial of service (CPU consumption) via crafted packets to the SIP TCP port, aka Bug ID…
CVE-2015-4220, published 2015-06-25. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq03773.
CVE-2013-6983, published 2013-12-31. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh35615.
CVE-2007-3775, published 2007-07-15. High severity, CVSS 7.8. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allows remote attackers to cause a denial of service (loss of cluster…
CVE-2007-1826, published 2007-04-02. High severity, CVSS 7.8. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in the IPSec Manager Service for Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allows remote attackers to…
CVE-2008-1158, published 2008-05-16. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via malformed packets, aka Bug ID…
CVE-2007-1834, published 2007-04-03. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allow remote attackers to cause a denial of service (loss of voice services) via a…

Latest

CVE-2014-3339, published 2014-08-12. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote authenticated users to…
CVE-2013-1242, published 2013-05-10. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. Memory leak in the web framework in the server in Cisco Unified Presence (CUP) allows remote attackers to cause a denial of service (memory consumption) via malformed TCP packets, aka Bug ID…
CVE-2011-1643, published 2011-08-29. High severity, CVSS 10.0. EPSS: 1.9% chance of exploitation in the next 30 days. Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x, 7.x before 7.1(5b)su4, 8.0, and 8.5 before 8.5(1)su2 and Cisco Unified Presence Server 6.x, 7.x, 8.0, and 8.5 before 8.5xnr…
CVE-2010-2840, published 2010-08-26. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. The Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which…
CVE-2010-2839, published 2010-08-26. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. SIPD in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) allows remote attackers to cause a denial of service (stack memory corruption and process failure) via a malformed SIP message,…