CVE-2020-7033

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.10.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Avaya	Avaya Equinox Conferencing	>= 9.x, < 9.1.10

References

https://downloads.avaya.com/css/P8/documents/101072147Vendor Advisory
https://downloads.avaya.com/css/P8/documents/101072147Vendor Advisory

Timeline

Published: Nov 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-70348.8A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send sp CVE-2020-70356.5An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticate CVE-2020-70366.5An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to informat CVE-2020-70378.1An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote at CVE-2020-70387.5A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote CVE-2020-70395.6tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can CVE-2020-70408.1storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to p CVE-2020-70415.3An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an CVE-2020-70425.3An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the CVE-2020-70439.1An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostn CVE-2020-70447.5In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to CVE-2020-70456.5In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by validating opcode