Avaya vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-1041 An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request.Critical 9.9 · Jun 10, 2025
• CVE-2024-12756 An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user.High 7.3 · Feb 11, 2025
• CVE-2024-12755 A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive information.High 7.9 · Feb 11, 2025
• CVE-2024-4197 An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component.Critical 9.9 · Jun 25, 2024
• CVE-2024-4196 An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web requCritical 10 · Jun 25, 2024
• CVE-2023-3722 An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server userHigh 8.6 · Jul 19, 2023
• CVE-2022-38168 Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the loCritical 9.1 · Nov 3, 2022
• CVE-2022-2249 Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their priHigh 7.7 · Oct 12, 2022
• CVE-2022-2975 A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modifHigh 7.7 · Oct 6, 2022
• CVE-2021-25657 A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privilegesHigh 7.8 · Sep 1, 2022
• CVE-2021-25653 A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to High 8 · Jun 24, 2021
• CVE-2021-25651 A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges.High 8 · Jun 24, 2021
• CVE-2021-25650 A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts High 7.7 · Jun 24, 2021
• CVE-2020-7038 A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain acHigh 7.5 · Apr 28, 2021
• CVE-2020-7037 An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read High 8.1 · Apr 28, 2021
• CVE-2020-7036 An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored oHigh 8.1 · Apr 23, 2021
• CVE-2020-7035 An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker tHigh 8.1 · Apr 23, 2021
• CVE-2020-7034 A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messHigh 7.2 · Apr 23, 2021
• CVE-2019-7005 A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gainHigh 7.5 · Aug 7, 2020
• CVE-2019-7007 A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier.High 7.5 · Feb 28, 2020
• CVE-2019-7003 A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and Critical 10 · Jul 11, 2019
• CVE-2019-7001 A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data relatCritical 9.9 · Apr 4, 2019
• CVE-2018-15616 A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack thCritical 9 · Oct 17, 2018
• CVE-2018-15615 A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connectHigh 7.2 · Sep 24, 2018
• CVE-2018-15613 A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returnedHigh 8.3 · Sep 21, 2018