CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7035 – XXE in Avaya Aura Orchestration Designer
https://notcve.org/view.php?id=CVE-2020-7035
An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3. Una vulnerabilidad de XML External Entities (XXE) en la interfaz de usuario basada en web de Avaya Aura Orchestration Designer, podría permitir a un atacante remoto autenticado conseguir acceso de lectura a información almacenada en un sistema afectado. Las versiones afectadas de Orchestration Designer incluyen todas las versiones 7.x anteriores a 7.2.3 • https://downloads.avaya.com/css/P8/documents/101075450 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15613 – Orchestration Designer Runtime Config XSS
https://notcve.org/view.php?id=CVE-2018-15613
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1. Una vulnerabilidad Cross-Site Scripting (XSS) en el componente Runtime Config de Avaya Aura Orchestration Designer podría resultar en la devolución de contenido malicioso al usuario. Las versiones afectadas de Avaya Aura Orchestration Designer son todas las versiones hasta la 7.2.1. • https://downloads.avaya.com/css/P8/documents/101052293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15612 – Orchestration Designer Runtime Config CSRF
https://notcve.org/view.php?id=CVE-2018-15612
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1. Una vulnerabilidad Cross-Site Request Forgery (CSRF) en el componente Runtime Config de Avaya Aura Orchestration Designer podría permitir que un atacante añada, cambie o elimine configuración de administrador. Las versiones afectadas de Avaya Aura Orchestration Designer son todas las versiones hasta la 7.2.1. • https://downloads.avaya.com/css/P8/documents/101052293 • CWE-352: Cross-Site Request Forgery (CSRF) •