Mitel Micollab vulnerabilities

CVE-2025-52914 [HIGH] CWE-89 CVE-2025-52914: A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands.

CVE-2024-55550 [LOW] CWE-22 CVE-2024-55550: Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege t Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive syste

CVE-2024-35285 [CRITICAL] CWE-77 CVE-2024-35285: A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthentica A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.

CVE-2024-35314 [CRITICAL] CWE-94 CVE-2024-35314: A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solu A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute

CVE-2024-35286 [CRITICAL] CWE-89 CVE-2024-35286: A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthentica A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.

CVE-2024-41713 [CRITICAL] CWE-22 CVE-2024-41713: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 F A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and s

CVE-2024-47223 [CRITICAL] CWE-89 CVE-2024-47223: A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9 A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and ex

CVE-2024-30158 [HIGH] CWE-89 CVE-2024-30158: A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.

CVE-2024-47912 [HIGH] CWE-306 CVE-2024-47912: A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to access and delete sensitive information.

CVE-2024-30157 [HIGH] CWE-89 CVE-2024-30157: A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 cou A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.

CVE-2024-41714 [HIGH] CWE-94 CVE-2024-41714: A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoi A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary c

CVE-2024-47189 [HIGH] CWE-89 CVE-2024-47189: The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of specific details to access non-sensitive user provisi

CVE-2024-35315 [MEDIUM] CWE-94 CVE-2024-35315: A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solu A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker to run arbitrary code with elevated privileges.

CVE-2024-41712 [MEDIUM] CWE-94 CVE-2024-41712: A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an a A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system within the context of the user.

CVE-2024-30160 [MEDIUM] CWE-79 CVE-2024-30160: A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 cou A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.

CVE-2024-47224 [MEDIUM] CWE-116 CVE-2024-47224: A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9 A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack.

CVE-2024-30159 [MEDIUM] CWE-79 CVE-2024-30159: A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.

CVE-2024-35287 [MEDIUM] CWE-276 CVE-2024-35287: A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 ( A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary com

CVE-2023-25597 [MEDIUM] CWE-287 CVE-2023-25597: A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an u A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information.

CVE-2022-41326 [CRITICAL] CWE-862 CVE-2022-41326: The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated att The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application.