https://vulnogram.org/ Most recent CVEs assigned by Avaya, Inc. (avaya). https://vulnogram.org/seaview/icons/avaya.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-1041 https://vulnogram.org/CVE-2025-1041 An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0. Critical Tue, 10 Jun 2025 06:05:25 GMT https://vulnogram.org/CVE-2024-12756 https://vulnogram.org/CVE-2024-12756 An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user. High Tue, 11 Feb 2025 16:59:12 GMT https://vulnogram.org/CVE-2024-12755 https://vulnogram.org/CVE-2024-12755 A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive information. High Tue, 11 Feb 2025 16:57:07 GMT https://vulnogram.org/CVE-2024-7480 https://vulnogram.org/CVE-2024-7480 An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privileges to read arbitrary files on the system. Affected versions include 10.1.x.x and 10.2.x.… Medium Thu, 08 Aug 2024 16:04:25 GMT https://vulnogram.org/CVE-2024-7477 https://vulnogram.org/CVE-2024-7477 A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries against the Avaya Aura System Manager database. Affected versions include 10.1.x.x and 10.2.x.x.… Medium Thu, 08 Aug 2024 16:02:43 GMT https://vulnogram.org/CVE-2024-4197 https://vulnogram.org/CVE-2024-4197 An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all versions prior to 11.1.3.1. Critical Tue, 25 Jun 2024 04:01:17 GMT https://vulnogram.org/CVE-2024-4196 https://vulnogram.org/CVE-2024-4196 An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1. Critical Network Exploitable Tue, 25 Jun 2024 04:00:30 GMT https://vulnogram.org/CVE-2023-7031 https://vulnogram.org/CVE-2023-7031 Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to an authenticated non-privileged user. Affected versions include 8.0.x and 8.1.x, prior to 8… Medium Wed, 17 Jan 2024 18:34:41 GMT https://vulnogram.org/CVE-2023-3722 https://vulnogram.org/CVE-2023-3722 An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.… High Network Exploitable Wed, 19 Jul 2023 19:56:52 GMT https://vulnogram.org/CVE-2023-3527 https://vulnogram.org/CVE-2023-3527 A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command ex… Medium Tue, 18 Jul 2023 21:10:36 GMT https://vulnogram.org/CVE-2022-2249 https://vulnogram.org/CVE-2022-2249 Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.… High Wed, 12 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-2975 https://vulnogram.org/CVE-2022-2975 A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects App… High Thu, 06 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2021-25657 https://vulnogram.org/CVE-2021-25657 A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and ear… High Fri, 02 Sep 2022 01:05:08 GMT https://vulnogram.org/CVE-2021-25654 https://vulnogram.org/CVE-2021-25654 An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services. Medium Fri, 25 Jun 2021 20:15:12 GMT https://vulnogram.org/CVE-2021-25656 https://vulnogram.org/CVE-2021-25656 Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix… Medium Thu, 24 Jun 2021 08:55:32 GMT https://vulnogram.org/CVE-2021-25655 https://vulnogram.org/CVE-2021-25655 A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix). Medium Thu, 24 Jun 2021 08:55:31 GMT https://vulnogram.org/CVE-2021-25653 https://vulnogram.org/CVE-2021-25653 A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to escalate privileges. Affects 8.0.0.0 through 8.1.3.1 versions of AVPU. High Thu, 24 Jun 2021 08:55:29 GMT https://vulnogram.org/CVE-2021-25652 https://vulnogram.org/CVE-2021-25652 An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). This vulnerability may potentially allow any local user to access system functionality and c… Medium Thu, 24 Jun 2021 08:55:28 GMT https://vulnogram.org/CVE-2021-25651 https://vulnogram.org/CVE-2021-25651 A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya Aura Utility Services High Unsupported When Assigned Thu, 24 Jun 2021 08:55:26 GMT https://vulnogram.org/CVE-2021-25650 https://vulnogram.org/CVE-2021-25650 A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user. Affects all 7.x versions of Avaya Aura Utility Services High Unsupported When Assigned Thu, 24 Jun 2021 08:55:25 GMT https://vulnogram.org/CVE-2021-25649 https://vulnogram.org/CVE-2021-25649 An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that shou… Medium Unsupported When Assigned Thu, 24 Jun 2021 08:55:23 GMT https://vulnogram.org/CVE-2020-7038 https://vulnogram.org/CVE-2020-7038 A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management compon… High Network Exploitable Wed, 28 Apr 2021 21:30:21 GMT https://vulnogram.org/CVE-2020-7037 https://vulnogram.org/CVE-2020-7037 An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a d… High Wed, 28 Apr 2021 21:30:20 GMT https://vulnogram.org/CVE-2020-7036 https://vulnogram.org/CVE-2020-7036 An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions… High Fri, 23 Apr 2021 21:00:20 GMT https://vulnogram.org/CVE-2020-7035 https://vulnogram.org/CVE-2020-7035 An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versi… High Fri, 23 Apr 2021 21:00:20 GMT https://vulnogram.org/CVE-2020-7034 https://vulnogram.org/CVE-2020-7034 A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions… High Fri, 23 Apr 2021 20:15:15 GMT https://vulnogram.org/CVE-2020-7032 https://vulnogram.org/CVE-2020-7032 An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM i… Medium Fri, 13 Nov 2020 00:20:14 GMT https://vulnogram.org/CVE-2020-7033 https://vulnogram.org/CVE-2020-7033 A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions be… Medium Thu, 12 Nov 2020 23:55:11 GMT https://vulnogram.org/CVE-2020-7029 https://vulnogram.org/CVE-2020-7029 A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perfo… Medium Network Exploitable Tue, 11 Aug 2020 23:05:18 GMT https://vulnogram.org/CVE-2019-7005 https://vulnogram.org/CVE-2019-7005 A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gain sensitive information. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7… Medium Network Exploitable Fri, 07 Aug 2020 21:20:12 GMT https://vulnogram.org/CVE-2020-7030 https://vulnogram.org/CVE-2020-7030 A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 throug… Medium Wed, 03 Jun 2020 23:45:14 GMT https://vulnogram.org/CVE-2019-7007 https://vulnogram.org/CVE-2019-7007 A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier. Successful exploitation could potentially allow an unauthenticated attacker to access files that are outside the restricted direct… High Network Exploitable Fri, 28 Feb 2020 22:00:17 GMT https://vulnogram.org/CVE-2019-7004 https://vulnogram.org/CVE-2019-7004 A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior t… Medium Wed, 11 Dec 2019 23:25:15 GMT https://vulnogram.org/CVE-2019-7000 https://vulnogram.org/CVE-2019-7000 A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.… Medium Network Exploitable Wed, 31 Jul 2019 21:42:45 GMT https://vulnogram.org/CVE-2019-7003 https://vulnogram.org/CVE-2019-7003 A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya C… Critical Network Exploitable Thu, 11 Jul 2019 18:37:32 GMT https://vulnogram.org/CVE-2019-7001 https://vulnogram.org/CVE-2019-7001 A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users on the system. Affected versions of IP Office Contact Center include all… Critical Thu, 04 Apr 2019 15:56:34 GMT https://vulnogram.org/CVE-2019-7006 https://vulnogram.org/CVE-2019-7006 Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive information. Affected versions include all 6.2.x versions prior to 6.2 SP13. Medium Wed, 27 Feb 2019 00:00:00 GMT https://vulnogram.org/CVE-2018-15617 https://vulnogram.org/CVE-2018-15617 A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remote, unauthenticated user to cause denial of service. Affected versions include 6.3.x, all 7.x versions prior to 7.1.3.2, and all 8… Medium Fri, 01 Feb 2019 15:00:00 GMT https://vulnogram.org/CVE-2018-15614 https://vulnogram.org/CVE-2018-15614 A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of… Medium Wed, 23 Jan 2019 17:00:00 GMT https://vulnogram.org/CVE-2018-15616 https://vulnogram.org/CVE-2018-15616 A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.… Critical Network Exploitable Wed, 17 Oct 2018 19:00:00 GMT https://vulnogram.org/CVE-2018-15611 https://vulnogram.org/CVE-2018-15611 A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1… Medium Thu, 27 Sep 2018 23:00:00 GMT https://vulnogram.org/CVE-2018-15615 https://vulnogram.org/CVE-2018-15615 A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x. High Mon, 24 Sep 2018 13:00:00 GMT https://vulnogram.org/CVE-2018-15613 https://vulnogram.org/CVE-2018-15613 A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions… High Network Exploitable Fri, 21 Sep 2018 18:00:00 GMT https://vulnogram.org/CVE-2018-15612 https://vulnogram.org/CVE-2018-15612 A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2… High Network Exploitable Fri, 21 Sep 2018 18:00:00 GMT https://vulnogram.org/CVE-2018-15610 https://vulnogram.org/CVE-2018-15610 A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 thr… High Wed, 12 Sep 2018 21:00:00 GMT