# cve.now: Avaya

The newest entries naming Avaya as an affected vendor (up to 200), of 47 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-1041](https://cve.now/CVE-2025-1041.md): Avaya Call Management System RCE vulnerability (CVSS 9.9)
- [CVE-2024-12756](https://cve.now/CVE-2024-12756.md): Avaya Spaces HTML injection (HTMLi) Vulnerability (CVSS 7.3)
- [CVE-2024-12755](https://cve.now/CVE-2024-12755.md): Avaya Spaces XSS Vulnerability (CVSS 7.9)
- [CVE-2024-7480](https://cve.now/CVE-2024-7480.md): Improper access control in Avaya Aura System Manager (CVSS 4.2)
- [CVE-2024-7477](https://cve.now/CVE-2024-7477.md): Avaya Aura System Manager SQL injection vulnerability (CVSS 6.5)
- [CVE-2024-4197](https://cve.now/CVE-2024-4197.md): Avaya IP Office One-X Portal File Upload Vulnerability (CVSS 9.9)
- [CVE-2024-4196](https://cve.now/CVE-2024-4196.md): Avaya IP Office Web Control RCE Vulnerability (CVSS 10.0)
- [CVE-2023-7031](https://cve.now/CVE-2023-7031.md): Avaya Experience Portal Manager Insecure Direct Object Reference Vulnerabilities (CVSS 5.7)
- [CVE-2023-3722](https://cve.now/CVE-2023-3722.md): Avaya Aura Device Services Remote Code Execution (CVSS 8.6)
- [CVE-2023-3527](https://cve.now/CVE-2023-3527.md): Avaya Call Management System CSV injection vulnerability (CVSS 6.8)
- [CVE-2023-32218](https://cve.now/CVE-2023-32218.md): Avaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (CVSS 6.1)
- [CVE-2023-31187](https://cve.now/CVE-2023-31187.md): Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials (CVSS 6.5)
- [CVE-2023-31186](https://cve.now/CVE-2023-31186.md): Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy (CVSS 5.3)
- [CVE-2022-2249](https://cve.now/CVE-2022-2249.md): Avaya Aura Communication Manager Privilege Escalation Vulnerabilities (CVSS 7.7)
- [CVE-2022-2975](https://cve.now/CVE-2022-2975.md): Avaya Aura Application Enablement Services weak permissions in web application (CVSS 7.7)
- [CVE-2021-25657](https://cve.now/CVE-2021-25657.md): Avaya IP Office Privilege Escalation Vulnerability (CVSS 7.8)
- [CVE-2021-25654](https://cve.now/CVE-2021-25654.md): Avaya Aura Device Services Arbitrary Code Execution Vulnerability (CVSS 6.2)
- [CVE-2021-25656](https://cve.now/CVE-2021-25656.md): Avaya Aura Experience Portal XSS vulnerabilities (CVSS 5.3)
- [CVE-2021-25655](https://cve.now/CVE-2021-25655.md): URL redirection to untrusted site possible in Avaya Aura Experience Portal (CVSS 4.4)
- [CVE-2021-25653](https://cve.now/CVE-2021-25653.md): Avaya Aura Appliance Virtualization Platform Utilities Privilege Escalation Vulnerability (CVSS 8.0)
- [CVE-2021-25652](https://cve.now/CVE-2021-25652.md): Avaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure Vulnerability (CVSS 4.9)
- [CVE-2021-25651](https://cve.now/CVE-2021-25651.md): Avaya Aura Utility Services Privilege Escalation Vulnerability (CVSS 8.0)
- [CVE-2021-25650](https://cve.now/CVE-2021-25650.md): Avaya Aura Utility Services Privilege Escalation Vulnerability (CVSS 7.7)
- [CVE-2021-25649](https://cve.now/CVE-2021-25649.md): Avaya Utility Services Sensitive Information Disclosure Vulnerability (CVSS 4.9)
- [CVE-2020-7038](https://cve.now/CVE-2020-7038.md): Avaya Meetings Server Information Disclosure vulnerability (CVSS 7.5)
- [CVE-2020-7037](https://cve.now/CVE-2020-7037.md): Avaya Equinox Conferencing XXE vulnerability (CVSS 8.1)
- [CVE-2020-7036](https://cve.now/CVE-2020-7036.md): XXE in Avaya Callback Assist Administration (CVSS 8.1)
- [CVE-2020-7035](https://cve.now/CVE-2020-7035.md): XXE in Avaya Aura Orchestration Designer (CVSS 8.1)
- [CVE-2020-7034](https://cve.now/CVE-2020-7034.md): Command injection in Avaya Session Border Controller for Enterprise (CVSS 7.2)
- [CVE-2020-7032](https://cve.now/CVE-2020-7032.md): Avaya WebLM Improper Restriction of XML External Entity Reference (CVSS 6.5)
- [CVE-2020-7033](https://cve.now/CVE-2020-7033.md): Avaya Equinox Conferencing XSS (CVSS 6.3)
- [CVE-2020-7029](https://cve.now/CVE-2020-7029.md): Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability (CVSS 6.4)
- [CVE-2019-7005](https://cve.now/CVE-2019-7005.md): Unauthenticated Information Disclosure Vulnerability in IP Office (CVSS 5.9)
- [CVE-2020-7030](https://cve.now/CVE-2020-7030.md): IPO Information Disclosure (CVSS 5.5)
- [CVE-2019-7007](https://cve.now/CVE-2019-7007.md): Avaya Equinox Conferencing Management (iView) Directory Traversal Vulnerability (CVSS 7.5)
- [CVE-2019-7004](https://cve.now/CVE-2019-7004.md): Avaya IP Office XSS Vulnerability (CVSS 6.4)
- [CVE-2019-7000](https://cve.now/CVE-2019-7000.md): Avaya Aura Conferencing XSS (CVSS 5.9)
- [CVE-2019-7003](https://cve.now/CVE-2019-7003.md): ACM SQL Injection (CVSS 9.3)
- [CVE-2019-7001](https://cve.now/CVE-2019-7001.md): Avaya IPOCC WebUI SQL Injection (CVSS 9.9)
- [CVE-2018-15617](https://cve.now/CVE-2018-15617.md): Communication Manager Denial of Service (CVSS 6.5)
- [CVE-2018-15614](https://cve.now/CVE-2018-15614.md): IP Office one-X Portal XSS (CVSS 6.8)
- [CVE-2018-15616](https://cve.now/CVE-2018-15616.md): System Platform Web UI Deserialization (CVSS 9.0)
- [CVE-2018-15611](https://cve.now/CVE-2018-15611.md): Communication Manager Local Administrator PrivEsc (CVSS 6.3)
- [CVE-2018-15615](https://cve.now/CVE-2018-15615.md): CMS Supervisor Information Disclosure (CVSS 7.2)
- [CVE-2018-15613](https://cve.now/CVE-2018-15613.md): Orchestration Designer Runtime Config XSS (CVSS 8.3)
- [CVE-2018-15612](https://cve.now/CVE-2018-15612.md): Orchestration Designer Runtime Config CSRF (CVSS 8.3)
- [CVE-2018-15610](https://cve.now/CVE-2018-15610.md): Improper access controls in IP Office one-X Portal (CVSS 7.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/avaya
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.