Avaya IP Office VOIP Server
| Platform Information | https://support.avaya.com/products/P0160/ip-office-platform/ |
|---|---|
| Search Engine | Search on Google |
| Type | VOIP |
| End of Sales | - |
| End of Life | - |
| Wired Connection | - |
| Wireless Connection | - |
| Fingerprinting Source | HTTP MAC OUI NIC VENDOR HTTPS |
| Added at | |
| Manufacturer Name | Avaya Inc. |
| Homepage | http://avaya.com/ |
| Headquarters | United States of America |
| Business Status | Ongoing |
| Platform’s Common Vulnerabilities and Exposures (CVE) | ||
|---|---|---|
|
CVE-ID
Severity v3.0
Severity v2.0
Description
|
||
|
CVE-2020-7030
06/04/2020 MEDIUM
5.5 LOW
2.1 A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.
|
||
|
CVE-2016-5285
11/15/2019 HIGH
7.5 MEDIUM
5 A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
|
||
|
CVE-2018-15614
01/23/2019 MEDIUM
5.4 LOW
3.5 A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.
|
||
|
CVE-2018-15610
09/12/2018 HIGH
8.8 HIGH
9 A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2.
|
||
|
CVE-2017-11309
11/10/2017 CRITICAL
9.6 MEDIUM
6.8 Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary code via a long response.
|
||
| Manufacturer’s Common Vulnerabilities and Exposures (CVE) | ||
|---|---|---|
|
CVE-ID
Severity v3.0
Severity v2.0
Description
|
||
|
CVE-2020-7030
06/04/2020 MEDIUM
5.5 LOW
2.1 A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.
|
||
|
CVE-2019-7004
12/12/2019 MEDIUM
6.1 MEDIUM
4.3 A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not evaluated.
|
||
|
CVE-2016-5285
11/15/2019 HIGH
7.5 MEDIUM
5 A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
|
||
|
CVE-2019-7000
07/31/2019 MEDIUM
6.1 MEDIUM
5.8 A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not listed were not evaluated.
|
||
|
CVE-2019-7003
07/11/2019 CRITICAL
10 MEDIUM
6.4 A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.
|
||