Unity Connection (Cisco) - vulnerabilities (CVEs)

65 CVEs, 0 in the last 30 days, 155 known versions, newest CVE from 2026-05-06. Vendor: Cisco.

CVEs of Unity Connection

CVE-2026-20035 - CVSS 7.2 (high), 2026-05-06: A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected…
CVE-2026-20034 - CVSS 8.8 (high), 2026-05-06: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an…
CVE-2026-20081 - CVSS 6.5 (medium), 2026-04-15: Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To…
CVE-2026-20059 - CVSS 6.1 (medium), 2026-04-15: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS…
CVE-2026-20078 - CVSS 6.5 (medium), 2026-04-15: Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To…
CVE-2026-20061 - CVSS 6.5 (medium), 2026-04-15: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection…
CVE-2026-20060 - CVSS 4.7 (medium), 2026-04-15: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a…
CVE-2026-20045 - CVSS 9.8 (critical), 2026-01-21: A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco…
CVE-2025-20278 - CVSS 6.7 (medium), 2025-06-04: A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the…
CVE-2024-20305 - CVSS 4.8 (medium), 2024-01-26: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site…
CVE-2024-20253 - CVSS 10 (critical), 2024-01-26: A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute…
CVE-2024-20272 - CVSS 9.8 (critical), 2024-01-17: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to…
CVE-2023-20259 - CVSS 8.6 (high), 2023-10-04: A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU…
CVE-2023-20266 - CVSS 7.2 (high), 2023-08-30: A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management…
CVE-2022-20800 - CVSS 6.1 (medium), 2022-07-06: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session…
CVE-2022-20752 - CVSS 5.3 (medium), 2022-07-06: A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and…
CVE-2022-20859 - CVSS 8.8 (high), 2022-07-06: A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &…
CVE-2022-20788 - CVSS 6.1 (medium), 2022-04-21: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition…
CVE-2021-44228 - CVSS 10 (critical), 2021-12-10: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and…
CVE-2021-34701 - CVSS 4.3 (medium), 2021-11-04: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session…
CVE-2021-1362 - CVSS 8.8 (high), 2021-04-08: A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco…
CVE-2021-1409 - CVSS 6.1 (medium), 2021-04-08: Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM…
CVE-2021-1380 - CVSS 6.1 (medium), 2021-04-08: Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM…
CVE-2021-1226 - CVSS 6.5 (medium), 2021-01-13: A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco…
CVE-2020-3130 - CVSS 6.5 (medium), 2020-09-23: A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying…
CVE-2020-3282 - CVSS 6.1 (medium), 2020-07-02: A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management…
CVE-2020-3129 - CVSS 4.8 (medium), 2020-01-26: A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored…
CVE-2019-1915 - CVSS 6.5 (medium), 2019-10-02: A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME),…
CVE-2019-12707 - CVSS 6.1 (medium), 2019-10-02: A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a…
CVE-2019-1685 - CVSS 6.1 (medium), 2019-02-21: A vulnerability in the Security Assertion Markup Language (SAML) single sign-on (SSO) interface of Cisco Unity Connection could allow an unauthenticated,…
CVE-2018-15426 - CVSS 4.8 (medium), 2018-10-05: A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting…
CVE-2018-15403 - CVSS 5.4 (medium), 2018-10-05: A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence…
CVE-2018-15396 - CVSS 6.8 (medium), 2018-10-05: A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization,…
CVE-2018-0354 - CVSS 6.1 (medium), 2018-06-07: A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack…
CVE-2017-6779 - CVSS 7.5 (high), 2018-06-07: Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow…
CVE-2018-0203 - CVSS 5.3 (medium), 2018-02-22: A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail…
CVE-2017-12337 - CVSS 9.8 (critical), 2017-11-16: A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an…
CVE-2017-12212 - CVSS 6.1 (medium), 2017-09-07: A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting…
CVE-2017-6629 - CVSS 5.3 (medium), 2017-05-03: A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary…
CVE-2015-6360 - CVSS 7.5 (high), 2016-04-21: The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka…
CVE-2016-1377 - CVSS 6.1 (medium), 2016-04-12: Cross-site scripting (XSS) vulnerability in Cisco Unity Connection through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified…
CVE-2016-1304 - CVSS 6.1 (medium), 2016-01-30: Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted…
CVE-2016-1300 - CVSS 6.1 (medium), 2016-01-27: Cross-site scripting (XSS) vulnerability in Cisco Unity Connection (UC) 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a…
CVE-2015-6408 - CVSS 6.8 (medium), 2015-12-12: Cross-site request forgery (CSRF) vulnerability in Cisco Unity Connection 11.5(0.98) allows remote attackers to hijack the authentication of arbitrary users,…
CVE-2015-6390 - CVSS 4.3 (medium), 2015-12-03: Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web…
CVE-2015-6299 - CVSS 6.5 (medium), 2015-09-20: SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL…
CVE-2015-0716 - CVSS 6.8 (medium), 2015-05-07: Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote…
CVE-2015-0715 - CVSS 6.5 (medium), 2015-05-07: SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to…
CVE-2015-0616 - CVSS 7.1 (high), 2015-04-03: The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2,…
CVE-2015-0615 - CVSS 7.1 (high), 2015-04-03: The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when…
CVE-2015-0614 - CVSS 7.1 (high), 2015-04-03: The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and…
CVE-2015-0613 - CVSS 7.1 (high), 2015-04-03: The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and…
CVE-2015-0612 - CVSS 7.1 (high), 2015-04-03: The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2,…
CVE-2014-7988 - CVSS 4 (medium), 2014-11-07: The Unified Messaging Service (UMS) in Cisco Unity Connection 10.5 and earlier allows remote authenticated users to obtain sensitive information by reading…
CVE-2014-3336 - CVSS 6.5 (medium), 2014-08-11: SQL injection vulnerability in the web framework in Cisco Unity Connection 9.1(2) and earlier allows remote authenticated users to execute arbitrary SQL…
CVE-2014-3333 - CVSS 9 (critical), 2014-08-11: The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack…
CVE-2014-2145 - CVSS 4 (medium), 2014-04-05: Directory traversal vulnerability in the messaging API in Cisco Unity Connection allows remote authenticated users to read arbitrary files via vectors related…
CVE-2014-2125 - CVSS 4.3 (medium), 2014-04-02: Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web…
CVE-2014-0664 - CVSS 6.8 (medium), 2014-01-10: The server in Cisco Unity Connection allows remote authenticated users to cause a denial of service (CPU consumption) via unspecified IMAP commands, aka Bug…
CVE-2013-5534 - CVSS 4 (medium), 2013-10-19: Directory traversal vulnerability in the attachment service in the Voice Message Web Service (aka VMWS or Cisco Unity Web Service) in Cisco Unity Connection…
CVE-2013-1129 - CVSS 5 (medium), 2013-02-19: Memory leak in Cisco Unity Connection 9.x allows remote attackers to cause a denial of service (memory consumption and process crash) by sending many TCP…
CVE-2012-3096 - CVSS 4 (medium), 2012-09-16: Cisco Unity Connection (UC) 7.1, 8.0, and 8.5 allows remote authenticated users to cause a denial of service (resource consumption and administration outage)…
CVE-2012-3060 - CVSS 7.8 (high), 2012-09-16: Cisco Unity Connection (UC) 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service (CPU consumption) via malformed UDP packets, aka Bug ID…
CVE-2012-0367 - CVSS 7.8 (high), 2012-03-01: Cisco Unity Connection before 7.1.5b(Su5), 8.0 and 8.5 before 8.5.1(Su3), and 8.6 before 8.6.2 allows remote attackers to cause a denial of service (services…
CVE-2012-0366 - CVSS 9 (critical), 2012-03-01: Cisco Unity Connection before 7.1.3b(Su2) allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator…