Posts tagged: Cisco

An attacker with ESXi hypervisor admin rights can escalate from the restricted shell of several Cisco Unified Communications and Contact Center virtual appliances straight to root on the guest OS.

Cisco’s Cloud Connect component in Unified Contact Center Enterprise accepts crafted TCP data on a specific port with no authentication check, letting a remote attacker read or alter data on the device.

A stored input-validation flaw in Cisco ICM Enterprise’s web management interface lets an attacker run script in an administrator’s browser session if tricked into clicking a crafted link.

An unauthenticated attacker could poison cached HTTP responses in Cisco Webex Meetings’ cloud-based join service, causing some clients to receive incorrect responses when connecting to a meeting.

Three flaws in Cisco’s cloud-based Webex service let a crafted link inject scripting into a user’s session, with the fix applied server-side and no local patching needed.

A symbolic-link trick during agent upgrades lets a logged-in local user on Windows redirect the update process’s delete operation onto any protected file on the machine.

Opening a booby-trapped .aef script file in Cisco’s Unified CCX Editor can let an attacker run their own code on the machine, using whatever access the person who opened the file already has.

Three separate flaws in the Cisco Unified CCX admin web interface let an already-authenticated administrator plant a stored XSS payload, deserialise a malicious Java object for code execution, or use path traversal plus SSH to run commands as root.