Vulnerabilities > Avaya

DATE CVE VULNERABILITY TITLE RISK
2009-04-10 CVE-2008-6707 Improper Authentication vulnerability in Avaya Communication Manager and SIP Enablement Services
The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default application" that lists server configuration, and (6) "full system help."
network
low complexity
avaya CWE-287
6.4
2009-04-10 CVE-2008-6706 Multiple Security vulnerability in Avaya Communication Manager and SIP Enablement Services
Multiple unspecified vulnerabilities in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allow remote attackers to obtain (1) application server configuration, (2) database server configuration including encrypted passwords, (3) a system utility that decrypts "subscriber table passwords," (4) a system utility that decrypts database passwords, and (5) a system utility that encrypts "subscriber table passwords."
network
low complexity
avaya
7.8
2009-04-01 CVE-2008-6575 Unspecified vulnerability in Avaya Communication Manager
Unspecified vulnerability in the SIP server in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service (resource consumption) via unknown vectors.
network
low complexity
avaya
6.8
2009-04-01 CVE-2008-6574 Input Validation vulnerability in Avaya SIP Enablement Services (SES) Server
Unspecified vulnerability in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain privileges and cause a denial of service via unknown vectors related to reuse of valid credentials.
network
low complexity
avaya
7.5
2009-04-01 CVE-2008-6573 SQL Injection vulnerability in Avaya Communication Manager
Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server.
network
avaya CWE-89
6.8
2009-03-30 CVE-2009-0115 Incorrect Permission Assignment for Critical Resource vulnerability in multiple products
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.
7.8
2009-02-14 CVE-2008-6141 Resource Management Errors vulnerability in Avaya IP Soft Phone 6.0/6.01.85
Unspecified vulnerability in Avaya IP Softphone 6.0 SP4 and 6.01.85 allows remote attackers to cause a denial of service (crash) via a large amount of H.323 data.
network
low complexity
avaya CWE-399
5.0
2009-02-14 CVE-2008-6140 Remote Denial Of Service vulnerability in Avaya One-X 2.1.0.78
Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Avaya one-X Desktop Edition 2.1.0.78 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
network
low complexity
avaya
5.0
2009-01-09 CVE-2008-5882 SQL Injection vulnerability in multiple products
SQL injection vulnerability in login.asp in Citrix Application Gateway - Broadcast Server (BCS) before 6.1, as used by Avaya AG250 - Broadcast Server before 2.0 and possibly other products, allows remote attackers to execute arbitrary SQL commands via the txtUID parameter.
network
low complexity
citrix avaya CWE-89
7.5
2008-12-24 CVE-2008-5710 Configuration vulnerability in Avaya Communication Manager
Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1.x, 4.0.3, and 5.x allow remote attackers to read (1) configuration files, (2) log files, (3) binary image files, and (4) help files via unknown vectors.
network
low complexity
avaya CWE-16
5.0