Cisco Unity Express Software vulnerabilities

3 CVEs affecting Cisco Unity Express Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-1114, published 2013-02-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-1114, published 2013-02-13. Medium severity, CVSS 4.3. EPSS: 10.3% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unity Express before 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud87527.
CVE-2006-2166, published 2006-05-04. Low severity, CVSS 2.1. EPSS: 1.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows…
CVE-2013-1120, published 2013-02-06. Medium severity, CVSS 6.8. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown…