Known vulnerabilities in Cisco Unified Communications Manager IM & Presence Service

Vendor: Cisco Systems, Inc
Software: Cisco Unified Communications Manager IM & Presence Service
Software CPE: cpe:2.3:a:cisco_systems:cisco_unified_communications_manager_im_presence_service:*:*:*:*:*:*:*:*
Website: https://www.cisco.com
Total vulnerabilities: 27
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco Unified Communications Manager IM & Presence Service Cisco Unified Communications Manager IM & Presence Service is affected by 27 known vulnerabilities: 1 critical, 2 high, 8 medium, 16 low Critical High Medium Low

Vulnerabilities (27)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU121911 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-20045		 CWE-94 Critical
Available
Exploited
 14SU5 21.01.2026 SB2026012157
#VU114778 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-20330		 CWE-79 Low
No
No
 15SU3 04.09.2025 SB2025090418
#VU110238 - Command injection
CVE-2025-20278		 CWE-77 Low
No
No
 15SU2 06.06.2025 SB2025060643
#VU109651 - Privilege Chaining
CVE-2025-20112		 CWE-268 Low
No
No
 CUP.015.000(001.12000.013) 22.05.2025 SB2025052222
#VU100063 - Exposure of sensitive information to an unauthorized actor
CVE-2024-20457		 CWE-200 Medium
No
No
 12.5(1)SU9, 15SU2 07.11.2024 SB2024110752
#VU88131 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-20310		 CWE-79 Low
No
No
 12.5 SU8 04.04.2024 SB2024040430
#VU85776 - Deserialization of Untrusted Data
CVE-2024-20253		 CWE-502 High
No
No
 - 24.01.2024 SB2024012480
#VU81671 - Improper input validation
CVE-2023-20259		 CWE-20 High
No
No
 12.5(1)SU8 06.10.2023 SB2023100607
#VU79942 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-20242		 CWE-79 Low
No
No
 12.5(1)SU8, 14SU4 24.08.2023 SB2023082423
#VU77085 - Improper input validation
CVE-2023-20108		 CWE-20 Medium
No
No
 12.5(1)SU7, 14SU3 08.06.2023 SB2023060809
#VU62475 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-20786		 CWE-89 Medium
No
No
 11.5(1)SU11, 12.5(1)SU6, 14SU1 21.04.2022 SB2022042131
#VU57948 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-34701		 CWE-22 Low
No
No
 - 04.11.2021 SB2021110406
#VU57947 - Cross-Site Request Forgery (CSRF)
CVE-2021-34773		 CWE-352 Low
No
No
 - 04.11.2021 SB2021110405
#VU52943 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-1365		 CWE-89 Medium
No
No
 12.5.1 SU4 06.05.2021 SB2021050628
#VU52939 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-1363		 CWE-89 Medium
No
No
 12.5.1 SU4 06.05.2021 SB2021050628
#VU51972 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-1409		 CWE-79 Low
No
No
 14.0.0.95200.4 08.04.2021 SB2021040801
#VU51969 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-1380		 CWE-79 Low
No
No
 14.0.0.95200.4 08.04.2021 SB2021040801
#VU51966 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-1362		 CWE-94 Medium
No
No
 11.5.1 SU9, 12.5.1 SU4 07.04.2021 SB2021040722
#VU49965 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-1357		 CWE-22 Medium
No
No
 11.5.1 SU9, 12.5.1 SU4 25.01.2021 SB2021012513
#VU49964 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-1355		 CWE-89 Medium
No
No
 11.5.1 SU9, 12.5.1 SU4 20.01.2021 SB2021012513


Showing elements 1 - 20 out of 27