Shelby Spencer

**Name of the Vulnerable Software and Affected Versions** Avaya Aura Device Services versions 7.0 through 8.1.4.0 **Description** An arbitrary code execution issue was discovered in Avaya Aura Device Services, potentially allowing a local user to execute specially crafted scripts. The vulnerability is related to the creation of temporary files with insecure permissions. **Recommendations** For versions 7.0 through 8.1.4.0, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avaya Aura Appliance Virtualization Platform Utilities (AVPU) versions 8.0.0.0 through 8.1.3.1 **Description** An information disclosure issue was discovered in the directory and file management of AVPU, potentially allowing any local user to access system functionality and configuration information that should only be available to a privileged user. **Recommendations** For versions 8.0.0.0 through 8.1.3.1, update to a version that contains a fix for this issue to prevent unauthorized access to system functionality and configuration information.

**Name of the Vulnerable Software and Affected Versions** Avaya Aura Appliance Virtualization Platform Utilities (AVPU) versions 8.0.0.0 through 8.1.3.1 **Description** A privilege escalation issue was discovered that may allow a local user to escalate privileges. **Recommendations** For versions 8.0.0.0 through 8.1.3.1, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Annex Cloud Loyalty Experience Platform versions prior to 2021.1.0.2 Description: The issue is related to an Insecure Direct Object Reference (IDOR) that allows any authenticated attacker to modify existing users, including those assigned to different environments and clients. Recommendations: For versions prior to 2021.1.0.2, update to version 2021.1.0.2 or later to resolve the issue.