Avaya vulnerabilities
130 vulnerabilities
Known vulnerabilities in Avaya products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 160 products.
Products
50 of 160- Communication Manager18 vulnerabilities
- Modular Messaging Message Storage Server15 vulnerabilities
- S830011 vulnerabilities
- S850011 vulnerabilities
- S870011 vulnerabilities
- Aura Communication Manager10 vulnerabilities
- Converged Communications Server10 vulnerabilities
- Aura System Manager9 vulnerabilities
- Ip Office9 vulnerabilities
- Sip Enablement Services7 vulnerabilities
- Aura Session Manager6 vulnerabilities
- Aura System Platform6 vulnerabilities
- Iq5 vulnerabilities
- Messaging Storage Server5 vulnerabilities
- 4602Sw Ip Phone4 vulnerabilities
- Aura Application Enablement Services4 vulnerabilities
- Aura Experience Portal4 vulnerabilities
- Aura Presence Services4 vulnerabilities
- Aura Utility Services4 vulnerabilities
- Message Networking4 vulnerabilities
- Aura Conferencing3 vulnerabilities
- Avaya Aura Utility Services3 vulnerabilities
- Call Management System3 vulnerabilities
- Equinox Conferencing3 vulnerabilities
- Intuity Audix3 vulnerabilities
- Ix Workforce Engagement3 vulnerabilities
- Libsafe3 vulnerabilities
- Meeting Exchange3 vulnerabilities
- One X3 vulnerabilities
- S87103 vulnerabilities
- Sg2003 vulnerabilities
- Sg2033 vulnerabilities
- Sg2083 vulnerabilities
- Sg53 vulnerabilities
- Voice Portal3 vulnerabilities
- Vsu3 vulnerabilities
- Argent Office2 vulnerabilities
- Aura Appliance Virtualization Platform2 vulnerabilities
- Aura Application Server 53002 vulnerabilities
- Aura Device Services2 vulnerabilities
- Aura Messaging2 vulnerabilities
- Aura Orchestration Designer2 vulnerabilities
- Aura Sip Enablement Services2 vulnerabilities
- Aura Voice Portal2 vulnerabilities
- Avaya Aura Appliance Virtualization Platform Utilities2 vulnerabilities
- Avaya Aura Communication Manager2 vulnerabilities
- Avaya Call Management System2 vulnerabilities
- Avaya Spaces2 vulnerabilities
- Call Management System Server2 vulnerabilities
- Intuity Audix Lx2 vulnerabilities
CVE-2018-15616avayaavaya_aura_system_platform
EPSS score3.34%
A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.CVE-2018-15617avayaaura_communication_manager+1EPSS score2.24%
A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remote, unauthenticated user to cause denial of service. Affected versions include 6.3.x, all 7.x versions prior to 7.1.3.2, and all 8.x versions prior to 8.0.1.CVE-2018-15612avayaorchestration_designerEPSS score0.39%
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.CVE-2018-15615avayacall_management_system_supervisorEPSS score0.34%
A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x.CVE-2018-15613avayaaura_orchestration_designer+1EPSS score0.77%
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.CVE-2018-15610avayaip_officeEPSS score1.85%
A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2.CVE-2018-15614avayaip_officeEPSS score0.62%
A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.CVE-2018-15611avayaaura_communication_manager+1EPSS score0.30%
A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1.CVE-2018-6635avayaauraEPSS score1.17%
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.CVE-2003-1359avayapredictive_dialer_system+1EPSS score1.23%
Buffer overflow in stmkfont utility of HP-UX 10.0 through 11.22 allows local users to gain privileges via a long command line argument.CVE-2021-25656avayaaura_experience_portal+1EPSS score0.34%
Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).CVE-2021-25649avayaaura_utility_services+1EPSS score0.62%
An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects all 7.x versions of Avaya Aura Utility ServicesCVE-2021-25652avayaaura_appliance_virtualization_platform+1EPSS score0.70%
An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects versions 8.0.0.0 through 8.1.3.1 of AVPU.CVE-2021-25657avayaip_officeEPSS score0.26%
A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.CVE-2021-25655avayaaura_experience_portal+1EPSS score0.38%
A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).CVE-2021-25654avayaaura_device_services+1EPSS score0.78%
An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services.CVE-2021-25650avayaaura_utility_services+1EPSS score0.51%
A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user. Affects all 7.x versions of Avaya Aura Utility ServicesCVE-2021-25653avayaaura_appliance_virtualization_platform+1EPSS score0.64%
A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to escalate privileges. Affects 8.0.0.0 through 8.1.3.1 versions of AVPU.CVE-2021-25651avayaaura_utility_services+1EPSS score0.48%
A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya Aura Utility ServicesCVE-2007-1491avayas8300+2EPSS score0.39%
Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties.