CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2019-7007 – Avaya Equinox Conferencing Management (iView) Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-7007
A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier. Successful exploitation could potentially allow an unauthenticated attacker to access files that are outside the restricted directory on the remote server. Se ha encontrado una vulnerabilidad de salto de directorio en Avaya Equinox Management(iView) versiones R9.1.9.0 y anteriores. Una explotación con éxito podría potencialmente permitir a un atacante no autenticado acceder a archivos que están fuera del directorio restringido en el servidor remoto. • https://downloads.avaya.com/css/P8/documents/101064450 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2019-7004 – Avaya IP Office XSS Vulnerability
https://notcve.org/view.php?id=CVE-2019-7004
A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not evaluated. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el componente WebUI de IP Office Application Server, podría permitir una ejecución no autorizada de código y revelar potencialmente información confidencial. Todas las versiones del producto 11.x están afectadas. • https://www.exploit-db.com/exploits/48105 http://packetstormsecurity.com/files/156476/Avaya-IP-Office-Application-Server-11.0.0.0-Cross-Site-Scripting.html https://support.avaya.com/css/P8/documents/101062833 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2019-7000 – Avaya Aura Conferencing XSS
https://notcve.org/view.php?id=CVE-2019-7000
A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not listed were not evaluated. Una vulnerabilidad Cross-Site Scripting (XSS) en la Web UI de Avaya Aura Conferencing podría permitir un código de ejecución y potencialmente revelar información confidencial. Versiones afectadas de Avaya Aura conferencing incluyendo todas 8.x versiones anteriores hasta 8.0SP14 (8.0.14). • https://downloads.avaya.com/css/P8/documents/101060208 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-7003 – ACM SQL Injection
https://notcve.org/view.php?id=CVE-2019-7003
A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated. Una vulnerabilidad de inyección SQL en el componente de reportes de Avaya Control Manager, podría permitir a un atacante no autenticado ejecutar comandos SQL arbitrarios y recuperar datos confidenciales relacionados con otros usuarios del sistema. Las versiones afectadas de Avaya Control Manager incluyen a versiones 7.x y versiones 8.0.x anteriores a 8.0.4.0. • http://www.securityfocus.com/bid/109134 https://downloads.avaya.com/css/P8/documents/101059368 https://support.avaya.com/documents/documents-by-contenttype.action?product_id=P0941&product_name=Control+Manager&release_number=releaseId&contentType=ReleaseNotes • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 0CVE-2019-7001 – Avaya IPOCC WebUI SQL Injection
https://notcve.org/view.php?id=CVE-2019-7001
A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users on the system. Affected versions of IP Office Contact Center include all 9.x and 10.x versions prior to 10.1.2.2.2-11201.1908. Unsupported versions not listed here were not evaluated. Una vulnerabilidad de inyección SQL, en el componente WebUI de IP Office Contact Center, podría permitir que un atacante autenticado recupere o modifique datos sensibles relacionados con otros usuarios en el sistema. Las versiones afectadas de IP Office Contact Center incluyen las versiones 9.x y 10.x anteriores a la 10.1.2.2.2-11201.1908. • https://downloads.avaya.com/css/P8/documents/101056762 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •