Alcatel-Lucent Enterprise bug bounty programs
al-enterprise.com Updated
Alcatel-Lucent Enterprise runs one public program: a self-hosted disclosure program with no cash rewards.
- Top reward
- No cash
- Disclosure only
- Programs
- 1
- None pays cash
- Targets in scope
- 0
- Not listed publicly
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Alcatel-Lucent Enterprise runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Alcatel Lucent
Self-hosted · Disclosure only |
No cash | None | – | – | Open |
-
- Safe harbor
- None
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
What each program lets you test.
None of these programs lists its targets publicly. Each program's policy says what you may test.
Recent changes
Reward and scope changes across every Alcatel-Lucent Enterprise program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Alcatel-Lucent Enterprise products, from the NVD.
-
CVE-2019-20047 High
An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allows a remote unauthenticated attacker to retrieve the content of its own session files. Every session file contains the administrative LDAP credentials encoded in a reversible format. Sessions are stored in /sessions/sess_<sessionid>.
-
CVE-2019-20048 High
An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with elevated privileges in the Web Directory component on port 389, may upload a PHP file to achieve Remote Code Execution as SYSTEM.
-
CVE-2019-20049 Critical
An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directory traversal (which helps to bypass authentication) with an insecure file upload to achieve Remote Code Execution as SYSTEM. The directory traversal is in the __construct() whereas the insecure file upload is in SetSkinImages().
-
CVE-2019-14260 High
On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
-
CVE-2007-3010 Critical
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
About this page
This page gathers every public program listed under al-enterprise.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.