Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2022-2249

Avaya Aura Communication Manager Privilege Escalation Vulnerabilities

Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.1.0.0.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Communication Manager
CVE-2010-2798

kernel: gfs2: rename causes kernel panic

The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avaya Canonical Debian and 5 more
Products
Aura Communication Manager Aura Presence Services Aura Session Manager and 14 more
CVE-2010-2942

kernel: net sched: fix some kernel memory leaks

The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya Canonical Linux and 4 more
Products
Aura Communication Manager Aura Presence Services Aura Session Manager and 12 more
CVE-2010-2943

kernel: xfs: validate inode numbers in file handles correctly

The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.

CVSS 3.1 · 8.1 High EPSS 17.0% KEV · Not listed
Vendors
Avaya Canonical Linux and 2 more
Products
Aura Communication Manager Aura Presence Services Aura Session Manager and 8 more
CVE-2010-2492

kernel: ecryptfs_uid_hash() buffer overflow

Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avaya Linux Redhat and 1 more
Products
Aura Communication Manager Aura Presence Services Aura Session Manager and 7 more
CVE-2020-7029

Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Communication Manager Aura Messaging
CVE-2018-15617

Communication Manager Denial of Service

A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remote, unauthenticated user to cause denial of service. Affected versions include 6.3.x, all 7.x versions prior to 7.1.3.2, and all 8.x versions prior to 8.0.1.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Avaya
Products
Aura Communication Manager
CVE-2018-15611

Communication Manager Local Administrator PrivEsc

A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Avaya
Products
Aura Communication Manager
CVE-2016-5285

nss: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Avaya Debian Mozilla and 2 more
Products
Aura Application Enablement Services Aura Application Server 5300 Aura Communication Manager and 29 more