Overview 331 matches · 1 in Waratek scope · 1 protected · 1 exploited · 1 CISA KEV · 9 public PoC · 3 EPSS ≥ 0.5
331matches
1in Waratek scope0.3%
1protected0.3%
1exploited0.3%
1CISA KEV0.3%
9public PoC2.7%
3EPSS ≥ 0.50.9%
Protected by Waratek
1
0.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
136
41.1%
Not applicable
194
58.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.3%
partly blocked
0
0.0%
not blocked
330
99.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
0.3%
Working exploit published
8
2.4%
Proof of concept only
0
0.0%
Forecast only
1
0.3%
No public exploit
321
97.0%
split by
peak 42 / year
20061
Not applicable1
High1
not blocked1
No public exploit1
20071
Not applicable1
Medium1
not blocked1
Working exploit published1
20081
Not applicable1
High1
not blocked1
Working exploit published1
20096
Not applicable6
High6
not blocked6
No public exploit6
20101
Not applicable1
Medium1
not blocked1
No public exploit1
20118
Not applicable8
High7
Medium1
not blocked8
No public exploit8
201214
Not applicable14
High14
not blocked14
No public exploit14
201338
Outside Waratek scope5
Not applicable33
High5
Medium31
Low2
not blocked38
No public exploit38
201425
Outside Waratek scope16
Not applicable9
High6
Medium19
not blocked25
Working exploit published1
No public exploit24
201525
Outside Waratek scope15
Not applicable10
High2
Medium23
not blocked25
No public exploit25
201615
Outside Waratek scope11
Not applicable4
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
201731
Outside Waratek scope20
Not applicable11
Critical6
High8
Medium17
not blocked31
Working exploit published1
No public exploit30
201840
Outside Waratek scope24
Not applicable16
Critical3
High25
Medium11
Low1
not blocked40
Working exploit published1
Forecast only1
No public exploit38
201930
Outside Waratek scope20
Not applicable10
High21
Medium9
not blocked30
Working exploit published1
No public exploit29
202042
Outside Waratek scope17
Not applicable25
Critical2
High18
Medium17
Low5
not blocked42
No public exploit42
202126
Protected by Waratek1
Outside Waratek scope8
Not applicable17
Critical1
High5
Medium18
Low2
blocked by ARMR today1
not blocked25
Exploited1
No public exploit25
20225
Not applicable5
High1
Medium4
not blocked5
No public exploit5
20236
Not applicable6
Medium6
not blocked6
No public exploit6
20245
Not applicable5
High1
Medium4
not blocked5
No public exploit5
20257
Not applicable7
High1
Medium6
not blocked7
No public exploit7
20264
Not applicable4
Medium4
not blocked4
No public exploit4
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2016-1484 | High | 2016-08-23 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors, aka Bug ID CSCuy92724. |
| CVE-2016-1448 | High | 2016-07-17 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.7 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuy92706. |
| CVE-2016-1450 | High | 2016-07-15 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID CSCuy92715. |
| CVE-2016-1449 | Medium | 2016-07-15 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy92711. |
| CVE-2016-1447 | Medium | 2016-07-15 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in the administrator interface in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuy83194. |
| CVE-2016-1446 | High | 2016-07-15 | Outside Waratek scope | No public exploit | SQL injection vulnerability in Cisco WebEx Meetings Server 2.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuy83200. |
| CVE-2016-1410 | High | 2016-05-28 | Not applicable | No public exploit | Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hosting a meeting, aka Bug ID CSCux84312. |
| CVE-2016-4349 | High | 2016-04-28 | Not applicable | No public exploit | Untrusted search path vulnerability in Cisco WebEx Productivity Tools 2.40.5001.10012 allows local users to gain privileges via a Trojan horse cryptsp.dll, dwmapi.dll, msimg32.dll, ntmarta.dll, propsys.dll, riched20.dll, rpcrtremote.dll, secur32.dll, sxs.dll, or uxtheme.dll file in the current working directory, aka Bug ID CSCuy56140. |
| CVE-2016-1389 | High | 2016-04-28 | Outside Waratek scope | No public exploit | Open redirect vulnerability in Cisco WebEx Meetings Server (CWMS) 2.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuy44695. |
| CVE-2015-6360 | High | 2016-04-21 | Outside Waratek scope | No public exploit | The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. |
| CVE-2016-1309 | Medium | 2016-02-07 | Outside Waratek scope | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meetings Server 2.5.1.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy01843. |
| CVE-2015-6384 | Medium | 2015-12-05 | Not applicable | No public exploit | The Cisco WebEx Meetings application before 8.5.1 for Android improperly initializes custom application permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka Bug ID CSCuw86442. |
| CVE-2015-4297 | Medium | 2015-08-19 | Not applicable | No public exploit | Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136. |
| CVE-2015-4281 | Medium | 2015-07-22 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.5 MR1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCus56150 and CSCus56146. |
| CVE-2015-4276 | Medium | 2015-07-16 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138. |
| CVE-2015-4212 | Medium | 2015-06-24 | Not applicable | No public exploit | Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering credentials, aka Bug ID CSCut17466. |
| CVE-2015-4208 | High | 2015-06-24 | Not applicable | No public exploit | Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request, aka Bug ID CSCup88398. |
| CVE-2015-4210 | Medium | 2015-06-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCur03806. |
| CVE-2015-4209 | Medium | 2015-06-23 | Not applicable | No public exploit | Cisco WebEx Meeting Center does not properly determine authorization for reading a host calendar, which allows remote attackers to obtain sensitive information by obtaining a list of all meetings and then sending a calendar request for each one, aka Bug ID CSCur23913. |
| CVE-2015-4207 | Medium | 2015-06-23 | Not applicable | No public exploit | Cisco WebEx Meeting Center places a meeting's access number in a URL, which allows remote attackers to obtain sensitive information and bypass intended attendance restrictions by visiting a meeting-registration page, aka Bug ID CSCus62147. |
| CVE-2015-4194 | Medium | 2015-06-19 | Not applicable | No public exploit | The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests, aka Bug ID CSCuf28861. |
| CVE-2015-0634 | Medium | 2015-05-15 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310. |
| CVE-2015-0668 | Medium | 2015-03-20 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737. |
| CVE-2015-0589 | High | 2015-02-07 | Outside Waratek scope | No public exploit | The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460. |
| CVE-2015-0597 | Medium | 2015-02-02 | Outside Waratek scope | No public exploit | The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159. |
| CVE-2015-0596 | Medium | 2015-02-02 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163. |
| CVE-2015-0595 | Medium | 2015-02-02 | Outside Waratek scope | No public exploit | The XMLAPI in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests, aka Bug ID CSCuj67079. |
| CVE-2015-0590 | Medium | 2015-01-17 | Not applicable | No public exploit | Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165. |
| CVE-2014-8034 | Medium | 2015-01-15 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which makes it easier for remote attackers to obtain access via a brute-force approach of guessing usernames, aka Bug ID CSCuj40321. |
| CVE-2015-0583 | Medium | 2015-01-14 | Not applicable | No public exploit | Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281. |
| CVE-2014-8036 | Medium | 2015-01-10 | Outside Waratek scope | No public exploit | The outlookpa component in Cisco WebEx Meetings Server does not properly validate API input, which allows remote attackers to modify a meeting's invite list via a crafted URL, aka Bug ID CSCuj40254. |
| CVE-2014-8035 | Medium | 2015-01-10 | Outside Waratek scope | No public exploit | The web framework in Cisco WebEx Meetings Server produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCuj40247. |
| CVE-2014-8033 | Medium | 2015-01-09 | Outside Waratek scope | No public exploit | The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421. |
| CVE-2014-8032 | Medium | 2015-01-09 | Outside Waratek scope | No public exploit | The OutlookAction LI in Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive encrypted-password information via unspecified vectors, aka Bug IDs CSCuj40453 and CSCuj40449. |
| CVE-2014-8031 | Medium | 2015-01-09 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj40456. |
| CVE-2014-8030 | Medium | 2015-01-09 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in sendPwMail.do in Cisco WebEx Meetings Server allows remote attackers to inject arbitrary web script or HTML via the email parameter, aka Bug ID CSCuj40381. |
| CVE-2014-3400 | Medium | 2014-10-05 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344. |
| CVE-2014-3395 | Medium | 2014-09-30 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server (WMS) 2.5 allows remote attackers to trigger the download of arbitrary files via a crafted URL, aka Bug ID CSCup10343. |
| CVE-2014-3340 | Medium | 2014-08-20 | Not applicable | No public exploit | Directory traversal vulnerability in an unspecified PHP script in the server in Cisco WebEx MeetMeNow allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCuo16166. |
| CVE-2014-3302 | Medium | 2014-08-01 | Outside Waratek scope | No public exploit | user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708. |
| CVE-2014-3304 | Medium | 2014-07-28 | Outside Waratek scope | No public exploit | The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722. |
| CVE-2014-3303 | Medium | 2014-07-28 | Outside Waratek scope | No public exploit | The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj81713. |
| CVE-2014-3305 | Medium | 2014-07-26 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735. |
| CVE-2014-3301 | Medium | 2014-07-26 | Outside Waratek scope | No public exploit | The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned messages, aka Bug ID CSCuj81700. |
| CVE-2014-3110 | Medium | 2014-07-24 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input. |
| CVE-2014-2717 | High | 2014-07-24 | Not applicable | No public exploit | Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page. |
| CVE-2014-3311 | Medium | 2014-07-10 | Outside Waratek scope | No public exploit | Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467. |
| CVE-2014-3310 | Medium | 2014-07-10 | Outside Waratek scope | No public exploit | The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463. |
| CVE-2014-3296 | Medium | 2014-06-21 | Outside Waratek scope | No public exploit | The XML programmatic interface (XML PI) in Cisco WebEx Meeting Server 1.5(.1.131) and earlier allows remote authenticated users to obtain sensitive meeting information via a crafted URL, aka Bug ID CSCum03527. |
| CVE-2014-3294 | Medium | 2014-06-10 | Outside Waratek scope | No public exploit | Cisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug ID CSCuj81691. |
| CVE-2014-3286 | Medium | 2014-06-08 | Outside Waratek scope | No public exploit | The web framework in Cisco WebEx Meeting Server does not properly restrict the content of reply messages, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug IDs CSCuj81685, CSCuj81688, CSCuj81665, CSCuj81744, and CSCuj81661. |
| CVE-2014-2199 | Medium | 2014-05-20 | Outside Waratek scope | No public exploit | meetinginfo.do in Cisco WebEx Event Center, WebEx Meeting Center, WebEx Sales Center, WebEx Training Center, WebEx Meetings Server 1.5(.1.131) and earlier, and WebEx Business Suite (WBS) 27 before 27.32.31.16, 28 before 28.12.13.18, and 29 before 29.5.1.12 allows remote attackers to obtain sensitive meeting information by leveraging knowledge of a meeting identifier, aka Bug IDs CSCuo68624 and CSCue46738. |
| CVE-2014-2136 | High | 2014-05-08 | Not applicable | No public exploit | Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka Bug IDs CSCui72223, CSCul01163, and CSCul01166. |
| CVE-2014-2135 | High | 2014-05-08 | Not applicable | No public exploit | Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka Bug IDs CSCul87216 and CSCuj07603. |
| CVE-2014-2134 | High | 2014-05-08 | Not applicable | No public exploit | Heap-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted audio channel in a .wrf file, aka Bug ID CSCuc39458. |
| CVE-2014-2133 | High | 2014-05-08 | Not applicable | No public exploit | Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file that triggers improper LZW decompression, aka Bug ID CSCuj87565. |
| CVE-2014-2132 | High | 2014-05-08 | Not applicable | No public exploit | Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allow remote attackers to cause a denial of service (application crash) via a crafted (1) .wrf or (2) .arf file that triggers a buffer over-read, aka Bug ID CSCuh52768. |
| CVE-2014-2186 | Medium | 2014-04-30 | Outside Waratek scope | No public exploit | Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777. |
| CVE-2014-0708 | Medium | 2014-03-21 | Not applicable | No public exploit | WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) a browser's history, aka Bug ID CSCul98272. |
| CVE-2014-0682 | Medium | 2014-01-29 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346. |
| CVE-2013-6687 | Medium | 2014-01-16 | Outside Waratek scope | No public exploit | The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876. |
| CVE-2013-6966 | Medium | 2013-12-17 | Not applicable | No public exploit | Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul36031. |
| CVE-2013-6973 | Medium | 2013-12-14 | Not applicable | No public exploit | Cisco WebEx Training Center allows remote attackers to discover registration IDs via a crafted URL, aka Bug ID CSCul57121. |
| CVE-2013-6972 | Medium | 2013-12-14 | Not applicable | No public exploit | Cisco WebEx Training Center allows remote attackers to discover session numbers, and bypass host approval for audio-conference attendance, by reading HTML source code, aka Bug ID CSCul57126. |
| CVE-2013-6971 | Medium | 2013-12-14 | Not applicable | No public exploit | Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul57140. |
| CVE-2013-6970 | Medium | 2013-12-14 | Not applicable | No public exploit | Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses, aka Bug ID CSCul35928. |
| CVE-2013-6969 | Medium | 2013-12-14 | Not applicable | No public exploit | The training-registration page in Cisco WebEx Training Center allows remote attackers to modify unspecified fields via unknown vectors, aka Bug ID CSCul35990. |
| CVE-2013-6968 | Medium | 2013-12-14 | Not applicable | No public exploit | Cisco WebEx Training Center provides different error messages for registration attempts depending on whether the e-mail address exists, which allows remote attackers to enumerate attendees via a series of requests, aka Bug ID CSCul36003. |
| CVE-2013-6967 | Medium | 2013-12-14 | Not applicable | No public exploit | Open redirect vulnerability in the mobile-browser subsystem in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul36020. |
| CVE-2013-6965 | Medium | 2013-12-14 | Not applicable | No public exploit | The registration component in Cisco WebEx Training Center provides the training-session URL before e-mail confirmation is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul36183. |
| CVE-2013-6964 | Low | 2013-12-14 | Not applicable | No public exploit | Cisco WebEx Meeting Center allows remote authenticated users to bypass access control and inject content from a different WebEx site via unspecified vectors, aka Bug ID CSCul36197. |
| CVE-2013-6963 | Medium | 2013-12-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the registration component in Cisco WebEx Training Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36207. |
| CVE-2013-6962 | Medium | 2013-12-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the mobile-browser subsystem in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36228. |
| CVE-2013-6961 | Medium | 2013-12-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Collaboration Partner Access Console (CPAC) in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36237. |
| CVE-2013-6960 | Medium | 2013-12-14 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meeting Center allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul36248. |
| CVE-2013-6959 | Medium | 2013-12-14 | Not applicable | No public exploit | Open redirect vulnerability in Cisco WebEx Sales Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul25557. |
| CVE-2013-6711 | Medium | 2013-12-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the product-creation administrative page in Cisco WebEx Sales Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCul25540. |
| CVE-2013-6710 | Medium | 2013-12-14 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Training Center allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCul25567. |
| CVE-2013-6709 | Medium | 2013-12-14 | Not applicable | No public exploit | The registration component in Cisco WebEx Training Center provides the training-session URL before payment is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul57111. |
| CVE-2013-5529 | Medium | 2013-10-16 | Outside Waratek scope | No public exploit | The deployment module in the server in Cisco WebEx Meeting Center does not properly validate the passphrase, which allows remote attackers to launch a deployment or cause a denial of service (deployment interruption) via a direct request, aka Bug ID CSCuf52200. |
| CVE-2013-1119 | High | 2013-09-06 | Not applicable | No public exploit | Buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DHT index value in JPEG data within a WRF file, aka Bug ID CSCuc24503. |
| CVE-2013-1118 | High | 2013-09-06 | Not applicable | No public exploit | Stack-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCuc27645. |
| CVE-2013-1117 | High | 2013-09-06 | Not applicable | No public exploit | Buffer overflow in the exception handler in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCuc27639. |
| CVE-2013-1116 | High | 2013-09-06 | Not applicable | No public exploit | Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted ARF file, aka Bug IDs CSCue74147 and CSCub28383. |
| CVE-2013-1115 | High | 2013-09-06 | Not applicable | No public exploit | Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ARF file, aka Bug IDs CSCue74118, CSCub28371, CSCud23401, and CSCud31109. |
| CVE-2013-3448 | Medium | 2013-08-02 | Outside Waratek scope | No public exploit | Cisco WebEx Meetings Server does not check whether a user account is active, which allows remote authenticated users to bypass intended access restrictions by performing meeting operations after account deactivation, aka Bug ID CSCuh33315. |
| CVE-2013-3425 | Medium | 2013-07-31 | Not applicable | No public exploit | The Meeting Center component in Cisco WebEx 11 generates different error messages for invalid file-access attempts depending on whether a file exists, which allows remote authenticated users to enumerate files via a series of SPI calls, aka Bug ID CSCuc35965. |
| CVE-2013-3392 | Medium | 2013-06-21 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco WebEx Social allow remote attackers to hijack the authentication of arbitrary users via unspecified vectors, aka Bug IDs CSCuh10405 and CSCuh10355. |
| CVE-2013-1205 | Medium | 2013-06-06 | Outside Waratek scope | No public exploit | The Event Center module in Cisco WebEx Meetings Server does not perform request authentication in all intended circumstances, which allows remote attackers to discover host keys and event passwords via crafted URLs, aka Bug ID CSCue62485. |
| CVE-2012-6399 | Medium | 2013-05-27 | Not applicable | No public exploit | Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, aka Bug ID CSCud94176. |
| CVE-2013-1245 | Medium | 2013-05-16 | Not applicable | No public exploit | The user-management page in Cisco WebEx Social relies on client-side validation of values in the Screen Name, First Name, Middle Name, Last Name, Email Address, and Job Title fields, which allows remote authenticated users to bypass intended access restrictions via crafted requests, aka Bug ID CSCue67190. |
| CVE-2013-1244 | Low | 2013-05-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the portal module in Cisco WebEx Social allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL in the link field in a post, aka Bug ID CSCue67199. |
| CVE-2013-1232 | Medium | 2013-05-04 | Outside Waratek scope | No public exploit | The HTTP implementation in Cisco WebEx Node for MCS, WebEx Meetings Server, and WebEx Node for ASR 1000 Series allows remote attackers to read the contents of uninitialized memory locations via a crafted request, aka Bug IDs CSCue36672, CSCue31363, CSCuf17466, and CSCug61252. |
| CVE-2013-1231 | Medium | 2013-05-03 | Outside Waratek scope | No public exploit | The HTTP implementation in Cisco WebEx Node for MCS and WebEx Meetings Server allows remote attackers to read cache files via a crafted request, aka Bug IDs CSCue36664 and CSCue36629. |
| CVE-2013-1107 | Medium | 2013-02-06 | Not applicable | No public exploit | The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235. |
| CVE-2013-1110 | Medium | 2013-01-21 | Not applicable | No public exploit | Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and (1) enable or (2) disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065. |
| CVE-2013-1108 | Medium | 2013-01-21 | Not applicable | No public exploit | Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064. |
| CVE-2013-1109 | Medium | 2013-01-17 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in testingLibraryAction.do in the Training Center testing library in Cisco WebEx Training Center allows remote attackers to hijack the authentication of arbitrary users for requests that delete tests, aka Bug ID CSCzu81067. |
| CVE-2012-6397 | Medium | 2013-01-17 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cisco WebEx Social (formerly Cisco Quad) allows remote attackers to inject arbitrary web script or HTML via a crafted RSS service link, aka Bug ID CSCub61977. |
| CVE-2012-3941 | High | 2012-10-25 | Not applicable | No public exploit | Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72850. |