Skip to content
OpenAdvisories

Vendor

Avaya

47 known vulnerabilities.

Products

IP Office 7 Avaya Aura Utility Services 3 IX Workforce Engagement 3 Avaya Spaces 2 Avaya Aura Appliance Virtualization Platform Utilities 2 Communication Manager 2 Avaya Aura Communication Manager 2 Orchestration Designer 2 Aura System Manager 2 Avaya Call Management System 2 Session Border Controller for Enterprise 1 Avaya Aura Messaging 1 WebLM 1 System Manager 1 Avaya Aura® System Platform 1 Avaya Aura Devices Services 1 Call Management System Supervisor 1 Avaya Meetings Management 1 IP Office Application Server 1 Equinox Conferencing Management (iView) 1 IP Office Contact Center 1 Aura Device Services 1 Avaya Control Manager 1 Avaya Aura Conferencing 1 Avaya Aura Application Enablement Services 1 Experience Portal Manager 1 Avaya Equinox Conferencing 1 Aura Orchestration Designer 1 Avaya Meetings Server 1 Callback Assist 1 Avaya Experience Portal 1 IX Workforce Engagement v15.2.7.1195 0 Aura Utility Services 0 Aura Device Services < 8.1.4.1.40 0 Breeze Platform 0 Session Border Controller 0 one-X 0 Aura Experience Portal 0 Oceana 0 CMS < 20.0.0.0 0
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.9
    CVE-2025-1041

    Avaya Call Management System RCE vulnerability

    An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.

    Avaya Avaya Call Management System
  • Critical 9.9
    CVE-2024-4197

    Avaya IP Office One-X Portal File Upload Vulnerability

    An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all versions prior to 11.1.3.1.

    Avaya IP Office
  • Critical 10.0
    CVE-2024-4196

    Avaya IP Office Web Control RCE Vulnerability

    An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.

    Avaya IP Office
  • Critical 9.3
    CVE-2019-7003

    ACM SQL Injection

    A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Ma…

    Avaya Avaya Control Manager
  • Critical 9.9
    CVE-2019-7001

    Avaya IPOCC WebUI SQL Injection

    A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users on the system. Affected versions of IP Office Contact Center include all 9.x and …

    Avaya IP Office Contact Center
  • Critical 9.0
    CVE-2018-15616

    System Platform Web UI Deserialization

    A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 throu…

    Avaya Avaya Aura® System Platform