How severe is CVE-2018-0355?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.1 out of 10.

What type of vulnerability is CVE-2018-0355?

This is classified as CWE-20, which is a common weakness in software security.

CVE-2018-0355 - MEDIUM Severity | CVSS 6.1

Vulnerability Description

A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline frames (iframes) by the web UI of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected UI to navigate to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct click-jacking or other client-side browser attacks on the affected system. Cisco Bug IDs: CSCvg19761.

Related Vulnerabilities

CVE-2009-5158

MEDIUM

CVSS:6.1(Medium)

The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.

CWE-202009

CVE-2014-9678

MEDIUM

CVSS:6.1(Medium)

FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to conduct content-spoofing attacks via the Swfile parameter.

CWE-202014

CVE-2015-2918

MEDIUM

CVSS:6.1(Medium)

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct c...

CWE-202015

CVE-2015-8682

MEDIUM

CVSS:6.1(Medium)

The Video0 driver in Huawei P8 smartphones with software GRA-UL00 before GRA-UL00C00B350, GRA-UL10 before GRA-UL10C00B350, GRA-TL00 before GRA-TL00C01B350, GRA-CL00 before GRA-CL00C92B350, and GRA-CL1...

CWE-202015

CVE-2015-8760

MEDIUM

CVSS:6.1(Medium)

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

CWE-202015

CVE-2016-0789

MEDIUM

CVSS:6.1(Medium)

CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splittin...

CWE-202016