https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-49186.htmlhttps://patchthecve.com/cve/CVE-2025-49186.htmlWed, 17 Jun 2026 09:30:53 +0000MEDIUM 5.3: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.https://patchthecve.com/cve/CVE-2025-1041.htmlhttps://patchthecve.com/cve/CVE-2025-1041.htmlWed, 17 Jun 2026 08:38:16 +0000CRITICAL 9.9: An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.https://patchthecve.com/cve/CVE-2024-12756.htmlhttps://patchthecve.com/cve/CVE-2024-12756.htmlWed, 17 Jun 2026 07:00:26 +0000HIGH 7.3: An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user.https://patchthecve.com/cve/CVE-2024-12755.htmlhttps://patchthecve.com/cve/CVE-2024-12755.htmlWed, 17 Jun 2026 07:00:25 +0000HIGH 7.9: A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive information.https://patchthecve.com/cve/CVE-2024-7480.htmlhttps://patchthecve.com/cve/CVE-2024-7480.htmlWed, 17 Jun 2026 08:20:17 +0000MEDIUM 4.2: An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privileges to read arbitrary files on the system. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer https://patchthecve.com/cve/CVE-2024-7477.htmlhttps://patchthecve.com/cve/CVE-2024-7477.htmlWed, 17 Jun 2026 08:20:17 +0000MEDIUM 6.5: A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries against the Avaya Aura System Manager database.  Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer https://patchthecve.com/cve/CVE-2024-4197.htmlhttps://patchthecve.com/cve/CVE-2024-4197.htmlWed, 17 Jun 2026 08:01:18 +0000CRITICAL 9.9: An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all versions prior to 11.1.3.1.https://patchthecve.com/cve/CVE-2024-4196.htmlhttps://patchthecve.com/cve/CVE-2024-4196.htmlWed, 17 Jun 2026 08:01:18 +0000CRITICAL 10.0: An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.https://patchthecve.com/cve/CVE-2023-7031.htmlhttps://patchthecve.com/cve/CVE-2023-7031.htmlWed, 17 Jun 2026 06:51:54 +0000MEDIUM 5.7: Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to an authenticated non-privileged user. Affected versions include 8.0.x and 8.1.x, prior to 8.1.2 patch 0402. Versions prior to 8.0 are end of