https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-20049.htmlhttps://patchthecve.com/cve/CVE-2019-20049.htmlWed, 17 Jun 2026 02:29:53 +0000CRITICAL 9.8: An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directory traversal (which helps to bypass authentication) with an insecure file upload to achieve Remote Code Execution as SYSTEM. The directory traversal is in the __construct() whereas https://patchthecve.com/cve/CVE-2019-20048.htmlhttps://patchthecve.com/cve/CVE-2019-20048.htmlWed, 17 Jun 2026 02:29:53 +0000HIGH 7.2: An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with elevated privileges in the Web Directory component on port 389, may upload a PHP file to achieve Remote Code Execution as SYSTEM.https://patchthecve.com/cve/CVE-2019-20047.htmlhttps://patchthecve.com/cve/CVE-2019-20047.htmlWed, 17 Jun 2026 02:29:53 +0000HIGH 7.5: An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded inhttps://patchthecve.com/cve/CVE-2019-14260.htmlhttps://patchthecve.com/cve/CVE-2019-14260.htmlWed, 17 Jun 2026 02:18:03 +0000HIGH 8.0: On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands