Cisco Unified Web And E-Mail Interaction Manager vulnerabilities

9 CVEs affecting Cisco Unified Web And E-Mail Interaction Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-6416, published 2015-12-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-4298, published 2015-08-19. Medium severity, CVSS 6.5. EPSS: 2.5% chance of exploitation in the next 30 days. Cisco Unified Web and E-Mail Interaction Manager 9.0(2) and 11.0(1) improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors,…
CVE-2015-4299, published 2015-08-19. Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days. Cisco Unified Web and E-Mail Interaction Manager 9.0(2) improperly performs authorization, which allows remote authenticated users to remove default messaging-queue system folders via unspecified…
CVE-2015-6255, published 2015-08-19. Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-Mail Interaction Manager 9.0(2) allows remote attackers to inject arbitrary web script or HTML via a crafted chat message, aka Bug…
CVE-2015-0753, published 2015-05-29. Medium severity, CVSS 6.8. EPSS: 1.8% chance of exploitation in the next 30 days. SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified…
CVE-2015-6416, published 2015-12-14. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web script or HTML a…
CVE-2015-0655, published 2015-02-28. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via…
CVE-2014-2194, published 2014-05-20. Medium severity, CVSS 6.8. EPSS: 1.2% chance of exploitation in the next 30 days. system/egain/chat/entrypoint in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to have an unspecified impact by injecting a spoofed XML external entity.
CVE-2014-2192, published 2014-05-20. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-mail Interaction Manager 9.0(2) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka…
CVE-2014-2193, published 2014-05-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Cisco Unified Web and E-Mail Interaction Manager places session identifiers in GET requests, which allows remote attackers to inject conversation text by obtaining a valid identifier, aka Bug ID…