Mitel Micollab vulnerabilities

CVE-2020-25606 [MEDIUM] CWE-20 CVE-2020-25606: The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, aka XSS.

CVE-2021-27401 [MEDIUM] CWE-79 CVE-2021-27401: The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS).

CVE-2021-32070 [MEDIUM] CWE-1021 CVE-2021-32070: The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perfor The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users.

CVE-2021-32069 [MEDIUM] CWE-295 CVE-2021-32069: The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middl The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.

CVE-2024-30160 [MEDIUM] CWE-79 CVE-2024-30160: A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 cou A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.

CVE-2024-30159 [MEDIUM] CWE-79 CVE-2024-30159: A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.

CVE-2021-32068 [LOW] CWE-770 CVE-2021-32068: The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.