Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2009-04-10	CVE-2008-6707	Improper Authentication vulnerability in Avaya Communication Manager and SIP Enablement Services The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default application" that lists server configuration, and (6) "full system help." network low complexity avaya CWE-287	6.4
2009-04-01	CVE-2008-6575	Unspecified vulnerability in Avaya Communication Manager Unspecified vulnerability in the SIP server in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service (resource consumption) via unknown vectors. network low complexity avaya	6.8
2009-04-01	CVE-2008-6573	SQL Injection vulnerability in Avaya Communication Manager Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server. network avaya CWE-89	6.8
2008-12-24	CVE-2008-5710	Configuration vulnerability in Avaya Communication Manager Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1.x, 4.0.3, and 5.x allow remote attackers to read (1) configuration files, (2) log files, (3) binary image files, and (4) help files via unknown vectors. network low complexity avaya CWE-16	5.0
2007-03-16	CVE-2007-1490	Remote Security vulnerability in Communication Manager Unspecified maintenance web pages in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allow remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors (aka "shell command injection"). network avaya	6.0