Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 140

Export CSV
CVE-2023-7031

Avaya Experience Portal Manager Insecure Direct Object Reference Vulnerabilities

Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to an authenticated non-privileged user. Affected versions include 8.0.x and 8.1.x, prior to 8.1.2 patch 0402. Versions prior to 8.0 are end of manufacturer support.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Experience Portal
CVE-2023-3722

Avaya Aura Device Services Remote Code Execution

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

CVSS 3.1 · 8.6 High EPSS 3.9% KEV · Not listed
Vendors
Avaya
Products
Aura Device Services
CVE-2023-3527

Avaya Call Management System CSV injection vulnerability

A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.  

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Call Management System
CVE-2022-2975

Avaya Aura Application Enablement Services weak permissions in web application

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Application Enablement Services
CVE-2021-25657

Avaya IP Office Privilege Escalation Vulnerability

A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Ip Office
CVE-2021-25656

Avaya Aura Experience Portal XSS vulnerabilities

Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Experience Portal
CVE-2021-25655

URL redirection to untrusted site possible in Avaya Aura Experience Portal

A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Experience Portal
CVE-2021-25654

Avaya Aura Device Services Arbitrary Code Execution Vulnerability

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Device Services
CVE-2021-25653

Avaya Aura Appliance Virtualization Platform Utilities Privilege Escalation Vulnerability

A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to escalate privileges. Affects 8.0.0.0 through 8.1.3.1 versions of AVPU.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Appliance Virtualization Platform
CVE-2021-25652

Avaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure Vulnerability

An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects versions 8.0.0.0 through 8.1.3.1 of AVPU.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Appliance Virtualization Platform
CVE-2021-25651

Avaya Aura Utility Services Privilege Escalation Vulnerability

A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya Aura Utility Services

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Utility Services
CVE-2021-25650

Avaya Aura Utility Services Privilege Escalation Vulnerability

A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user. Affects all 7.x versions of Avaya Aura Utility Services

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Utility Services
CVE-2021-25649

Avaya Utility Services Sensitive Information Disclosure Vulnerability

An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects all 7.x versions of Avaya Aura Utility Services

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Utility Services
CVE-2020-7038

Avaya Meetings Server Information Disclosure vulnerability

A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3.x versions before 3.17. Avaya Equinox Conferencing is now offered as Avaya Meetings Server.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Avaya
Products
Equinox Conferencing
CVE-2020-7037

Avaya Equinox Conferencing XXE vulnerability

An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of service. The affected versions of Avaya Equinox Conferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Avaya
Products
Equinox Conferencing
CVE-2020-7036

XXE in Avaya Callback Assist Administration

An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4.7.1.1 Patch 7.

CVSS 3.1 · 8.1 High EPSS 1.0% KEV · Not listed
Vendors
Avaya
Products
Callback Assist
CVE-2020-7035

XXE in Avaya Aura Orchestration Designer

An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Avaya
Products
Aura Orchestration Designer
CVE-2020-7034

Command injection in Avaya Session Border Controller for Enterprise

A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions of Avaya Session Border Controller for Enterprise include 7.x, 8.0 through 8.1.1.x

CVSS 3.1 · 7.2 High EPSS 2.4% KEV · Not listed
Vendors
Avaya
Products
Session Border Controller For Enterprise
CVE-2020-7033

Avaya Equinox Conferencing XSS

A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.10.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Equinox Conferencing
CVE-2020-7032

Avaya WebLM Improper Restriction of XML External Entity Reference

An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Avaya
Products
Aura System Manager Weblm