securityalerts@avaya.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS securityalerts@avaya.com
03
assessed vulnerabilities (45)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-1041US | critical9.8 | — | ||
An improper input validation discovered in
Avaya Call Management System
could allow an unauthorized
remote command via a specially crafted web request. Affected versions includ… | ||||
| CVE-2024-12756US | medium6.1 | — | ||
An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user. | ||||
| CVE-2024-12755US | medium5.4 | — | ||
A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive information. | ||||
| CVE-2024-7480US | medium4.4 | — | ||
An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privileges to read arbitra… | ||||
| CVE-2024-7477US | medium6.7 | — | ||
A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries against the Avaya Aura Sys… | ||||
| CVE-2024-4197US | critical9.8 | — | ||
An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all… | ||||
| CVE-2024-4196US | critical9.8 | — | ||
An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Contr… | ||||
| CVE-2023-7031US | medium4.3 | — | ||
Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to an authenticated non-… | ||||
| CVE-2023-3722US | critical9.8 | Exploit | ||
An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious upl… | ||||
| CVE-2023-3527US | medium6.8 | — | ||
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted dat… | ||||
| CVE-2022-2249US | medium6.7 | — | ||
Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue… | ||||
| CVE-2022-2975US | medium6.7 | — | ||
A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading t… | ||||
| CVE-2021-25657US | high7.8 | — | ||
A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects… | ||||
| CVE-2021-25654US | high7.8 | — | ||
An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 thr… | ||||
| CVE-2021-25656US | medium5.4 | — | ||
Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive in… | ||||
| CVE-2021-25655US | medium6.1 | — | ||
A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions inc… | ||||
| CVE-2021-25653US | high7.8 | — | ||
A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to escalate privileges.… | ||||
| CVE-2021-25652US | medium5.5 | — | ||
An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). This vulnerability may… | ||||
| CVE-2021-25651US | high7.8 | — | ||
A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya… | ||||
| CVE-2021-25650US | high8.8 | — | ||
A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user… | ||||