Skip to content
OpenAdvisories

Vendor

Avaya

47 known vulnerabilities.

Products

IP Office 7 Avaya Aura Utility Services 3 IX Workforce Engagement 3 Avaya Spaces 2 Avaya Aura Appliance Virtualization Platform Utilities 2 Communication Manager 2 Avaya Aura Communication Manager 2 Orchestration Designer 2 Aura System Manager 2 Avaya Call Management System 2 Session Border Controller for Enterprise 1 Avaya Aura Messaging 1 WebLM 1 System Manager 1 Avaya Aura® System Platform 1 Avaya Aura Devices Services 1 Call Management System Supervisor 1 Avaya Meetings Management 1 IP Office Application Server 1 Equinox Conferencing Management (iView) 1 IP Office Contact Center 1 Aura Device Services 1 Avaya Control Manager 1 Avaya Aura Conferencing 1 Avaya Aura Application Enablement Services 1 Experience Portal Manager 1 Avaya Equinox Conferencing 1 Aura Orchestration Designer 1 Avaya Meetings Server 1 Callback Assist 1 Avaya Experience Portal 1 IX Workforce Engagement v15.2.7.1195 0 Aura Utility Services 0 Aura Device Services < 8.1.4.1.40 0 Breeze Platform 0 Session Border Controller 0 one-X 0 Aura Experience Portal 0 Oceana 0 CMS < 20.0.0.0 0
All Critical High Medium Low Exploited only Public exploit

47 results · Feed

  • Medium 6.8
    CVE-2018-15614

    IP Office one-X Portal XSS

    A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Offic…

    Avaya IP Office
  • Critical 9.0
    CVE-2018-15616

    System Platform Web UI Deserialization

    A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 throu…

    Avaya Avaya Aura® System Platform
  • Medium 6.3
    CVE-2018-15611

    Communication Manager Local Administrator PrivEsc

    A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1.

    Avaya Communication Manager
  • High 7.2
    CVE-2018-15615

    CMS Supervisor Information Disclosure

    A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x.

    Avaya Call Management System Supervisor
  • High 8.3
    CVE-2018-15612

    Orchestration Designer Runtime Config CSRF

    A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.

    Avaya Orchestration Designer
  • High 8.3
    CVE-2018-15613

    Orchestration Designer Runtime Config XSS

    A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2…

    Avaya Orchestration Designer
  • High 7.3
    CVE-2018-15610

    Improper access controls in IP Office one-X Portal

    A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1…

    Avaya IP Office