Filtered by vendor Mitel
Subscribe
Total
98 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-35547 | 1 Mitel | 1 Micollab | 2024-02-04 | 6.4 MEDIUM | 9.1 CRITICAL |
| A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data. | |||||
| CVE-2020-24692 | 1 Mitel | 1 Micontact Center Business | 2024-02-04 | 3.6 LOW | 7.1 HIGH |
| The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session. | |||||
| CVE-2020-24593 | 1 Mitel | 1 Micloud Management Portal | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper input validation. | |||||
| CVE-2020-25608 | 1 Mitel | 1 Micollab | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection. | |||||
| CVE-2021-3176 | 1 Mitel | 1 Businesscti Enterprise | 2024-02-04 | 6.0 MEDIUM | 8.0 HIGH |
| The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view user information and application data. | |||||
| CVE-2020-24693 | 1 Mitel | 1 Micontact Center Business | 2024-02-04 | 2.1 LOW | 3.3 LOW |
| The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitization. | |||||
| CVE-2020-28351 | 1 Mitel | 2 Shoretel, Shoretel Firmware | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page. | |||||
| CVE-2020-24592 | 1 Mitel | 1 Micloud Management Portal | 2024-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output sanitization. | |||||
| CVE-2020-27154 | 1 Mitel | 1 Businesscti Enterprise | 2024-02-04 | 6.5 MEDIUM | 8.8 HIGH |
| The chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x before 7.0.3 could allow an attacker to gain access to user information by sending arbitrary code, due to improper input validation. A successful exploit could allow an attacker to view the user information and application data. | |||||
| CVE-2020-25610 | 1 Mitel | 1 Micollab | 2024-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference codes. | |||||
| CVE-2020-24595 | 1 Mitel | 1 Micloud Management Portal | 2024-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensitive information due to insufficient access control. | |||||
| CVE-2020-27340 | 1 Mitel | 1 Micollab | 2024-02-04 | 5.8 MEDIUM | 6.1 MEDIUM |
| The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control. | |||||
| CVE-2020-24594 | 1 Mitel | 1 Micloud Management Portal | 2024-02-04 | 6.8 MEDIUM | 9.6 CRITICAL |
| Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session. | |||||
| CVE-2020-27640 | 1 Mitel | 4 Mivoice 6930, Mivoice 6930 Firmware, Mivoice 6940 and 1 more | 2024-02-04 | 4.8 MEDIUM | 8.1 HIGH |
| The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations. | |||||
| CVE-2020-25606 | 1 Mitel | 1 Micollab | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, aka XSS. | |||||
| CVE-2020-12679 | 1 Mitel | 2 Mivoice Connect, Shoretel Conference Web | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php. | |||||
| CVE-2020-11797 | 1 Mitel | 1 Micollab Audio\, Web \& Video Conferencing | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit could allow an attacker to access sensitive shared files. | |||||
| CVE-2020-11798 | 1 Mitel | 1 Micollab Audio\, Web \& Video Conferencing | 2024-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories. | |||||
| CVE-2020-13767 | 1 Mitel | 1 Micollab | 2024-02-04 | 4.3 MEDIUM | 5.9 MEDIUM |
| The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control. An exploit requires a rooted iOS device, and (if successful) could allow an attacker to gain access to sensitive information, | |||||
| CVE-2020-10211 | 1 Mitel | 2 Mivoice Connect, Mivoice Connect Client | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive information. | |||||