Secunia

Avaya has acknowledged some vulnerabilities in Avaya AES / MX, which can be exploited by malicious, local users to bypass certain security restrictions, by malicious users to disclose potentially sensitive information, and by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, or disclose sensitive information.

For more information:
SA27398
SA28274
SA30500
SA31379

The following products and versions are affected:
* Avaya Meeting Exchange (MX) - all versions
* Avaya AES - all versions

Solution
The vendor recommends that local and network access to the affected systems be restricted until an update is available.
Original Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area