Mitel Micollab vulnerabilities

CVE-2024-30157 [HIGH] CWE-89 CVE-2024-30157: A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 cou A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.

CVE-2020-13863 [HIGH] CWE-74 CVE-2020-13863: The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by perform The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information.

CVE-2020-25608 [HIGH] CWE-20 CVE-2020-25608: The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due t The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection.

CVE-2021-27402 [MEDIUM] CWE-22 CVE-2021-27402: The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to acc The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.

CVE-2024-41712 [MEDIUM] CWE-94 CVE-2024-41712: A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an a A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system within the context of the user.

CVE-2022-36454 [MEDIUM] CWE-285 CVE-2022-36454: A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authen A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to impersonate another user's name.

CVE-2024-47224 [MEDIUM] CWE-116 CVE-2024-47224: A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9 A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack.

CVE-2021-32072 [MEDIUM] CWE-116 CVE-2021-32072: The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get so The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.

CVE-2024-35287 [MEDIUM] CWE-276 CVE-2024-35287: A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 ( A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary com

CVE-2020-13767 [MEDIUM] CVE-2020-13767: The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access res The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control. An exploit requires a rooted iOS device, and (if successful) could allow an attacker to gain access to sensitive information,

CVE-2023-25597 [MEDIUM] CWE-287 CVE-2023-25597: A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an u A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information.

CVE-2021-32067 [MEDIUM] CWE-116 CVE-2021-32067: The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view s The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.

CVE-2018-18819 [MEDIUM] CWE-863 CVE-2018-18819: A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and e A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insuffici

CVE-2024-35315 [MEDIUM] CWE-94 CVE-2024-35315: A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solu A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker to run arbitrary code with elevated privileges.

CVE-2020-25610 [MEDIUM] CVE-2020-25610: The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web confe The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference codes.

CVE-2020-25611 [MEDIUM] CWE-20 CVE-2020-25611: The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference inf The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input validation, aka XSS. Successful exploitation could allow an attacker to view user conference information.

CVE-2020-25609 [MEDIUM] CWE-79 CVE-2020-25609: The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to e The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data.

CVE-2020-25612 [MEDIUM] CVE-2020-25612: The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control. Successful exploit could potentially allow an attacker to gain access to sensitive information.

CVE-2019-19370 [MEDIUM] CWE-79 CVE-2019-19370: A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab a A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the file upload interface. A successful exploit could allow an attacker to execute a

CVE-2020-27340 [MEDIUM] CVE-2020-27340: The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control.