CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7038 – Avaya Meetings Server Information Disclosure vulnerability
https://notcve.org/view.php?id=CVE-2020-7038
A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3.x versions before 3.17. Avaya Equinox Conferencing is now offered as Avaya Meetings Server. Se detectó una vulnerabilidad en el componente Management de Avaya Equinox Conferencing que podría permitir a un atacante remoto no autenticado conseguir acceso a las sesiones de pantalla compartida y de pizarra. Las versiones afectadas del componente Management de Avaya Equinox Conferencing incluyen todas las versiones 3.x anteriores a la 3.17. • https://support.avaya.com/css/P8/documents/101075574 • CWE-284: Improper Access Control •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7037 – Avaya Equinox Conferencing XXE vulnerability
https://notcve.org/view.php?id=CVE-2020-7037
An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of service. The affected versions of Avaya Equinox Conferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server. Una vulnerabilidad XML External Entities (XXE) en el componente Media Server de Avaya Equinox Conferencing que podría permitir a un atacante remoto autenticado conseguir acceso de lectura a la información almacenada en un sistema afectado o incluso potencialmente conllevar a una denegación de servicio. Las versiones afectadas de Avaya Equinox Conferencing incluyen todas las versiones 9.x anteriores a 9.1.11. • https://support.avaya.com/css/P8/documents/101075574 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2020-7036 – XXE in Avaya Callback Assist Administration
https://notcve.org/view.php?id=CVE-2020-7036
An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4.7.1.1 Patch 7. Una vulnerabilidad XML External Entities (XXE) en Callback Assist, podría permitir a un atacante remoto autenticado conseguir acceso de lectura a la información que es almacenada en un sistema afectado. Las versiones afectadas de Callback Assist incluyen todas las versiones 4.0.x anteriores a 4.7.1.1 Patch 7 • https://downloads.avaya.com/css/P8/documents/101075450 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7035 – XXE in Avaya Aura Orchestration Designer
https://notcve.org/view.php?id=CVE-2020-7035
An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3. Una vulnerabilidad de XML External Entities (XXE) en la interfaz de usuario basada en web de Avaya Aura Orchestration Designer, podría permitir a un atacante remoto autenticado conseguir acceso de lectura a información almacenada en un sistema afectado. Las versiones afectadas de Orchestration Designer incluyen todas las versiones 7.x anteriores a 7.2.3 • https://downloads.avaya.com/css/P8/documents/101075450 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7034 – Command injection in Avaya Session Border Controller for Enterprise
https://notcve.org/view.php?id=CVE-2020-7034
A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions of Avaya Session Border Controller for Enterprise include 7.x, 8.0 through 8.1.1.x Una vulnerabilidad de inyección de comandos en Avaya Session Border Controller for Enterprise, podría permitir a un atacante remoto autenticado enviar mensajes especialmente diseñados y ejecutar comandos arbitrarios con los privilegios del sistema afectado. Las versiones afectadas de Avaya Session Border Controller for Enterprise incluyen versiones 7.x, 8.0 hasta 8.1.1.x • https://downloads.avaya.com/css/P8/documents/101075451 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •