CVE-2018-15396

Cisco Unity Connection File Upload Denial of Service Vulnerability

A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition.

CVSS 3.0 · 6.8 Medium EPSS 1.8% KEV · Not listed

Vendors

Cisco

Products

Unity Connection

CVE-2018-15400

Cisco Cloud Services Platform 2100 Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Cloud Services Platform 2100 Cloud Services Platform 2100 Firmware

CVE-2018-15401

Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system via a web browser and with the privileges of the user.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Hosted Collaboration Mediation Fulfillment

CVE-2018-15403

Multiple Cisco Unified Communications Products Open Redirect Vulnerability

A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Cisco

Products

Emergency Responder Unified Communications Manager Unified Communications Manager Im And Presence Service and 1 more

CVE-2018-15404

Cisco Integrated Management Controller Supervisor and Cisco UCS Director System Resources Denial of Service Vulnerability

A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Cisco

Products

Integrated Management Controller Supervisor Unified Computing System Director

CVE-2018-15405

Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly include the access level of the web interface user. An attacker who has valid application credentials could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional reconnaissance attacks.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Cisco

Products

Ucs Director

CVE-2018-15406

Cisco UCS Director Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Cisco

Products

Ucs Director

CVE-2018-15407

Cisco HyperFlex World-Readable Sensitive Information Vulnerability

A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnerability is due to insufficient cleanup of installation files. An attacker could exploit this vulnerability by accessing the residual installation files on an affected system. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Hyperflex Hx Data Platform

CVE-2018-15408

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15409

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 31 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15410

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 31 Webex Business Suite 32 Webex Business Suite 33 and 2 more

CVE-2018-15411

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15412

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15413

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15414

Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15415

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15416

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15417

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15418

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 31 Webex Business Suite 32 Webex Business Suite 33 and 2 more

CVE-2018-15419

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more