Micollab
by Mitel
CVEs (53)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-41712 | 0.00 | — | 0.01 | Oct 21, 2024 | A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary… | |||
| CVE-2024-47223 | 0.00 | — | 0.00 | Oct 21, 2024 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow… | |||
| CVE-2024-30158 | 0.00 | — | 0.00 | Oct 21, 2024 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker… | |||
| CVE-2023-25597 | 0.00 | — | 0.01 | Apr 14, 2023 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit… | |||
| CVE-2022-41326 | 0.00 | — | 0.01 | Nov 22, 2022 | The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application. | |||
| CVE-2022-36453 | 0.00 | — | 0.01 | Oct 25, 2022 | A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to control another… | |||
| CVE-2022-36454 | 0.00 | — | 0.00 | Oct 25, 2022 | A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to impersonate another… | |||
| CVE-2022-36451 | 0.00 | — | 0.01 | Oct 25, 2022 | A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an… | |||
| CVE-2022-36452 | 0.00 | — | 0.01 | Oct 25, 2022 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application. | |||
| CVE-2021-32069 | 0.00 | — | 0.01 | Aug 13, 2021 | The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data. | |||
| CVE-2021-32072 | 0.00 | — | 0.01 | Aug 13, 2021 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods. | |||
| CVE-2021-32071 | 0.00 | — | 0.01 | Aug 13, 2021 | The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users. | |||
| CVE-2021-32070 | 0.00 | — | 0.01 | Aug 13, 2021 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users. | |||
| CVE-2021-32068 | 0.00 | — | 0.01 | Aug 13, 2021 | The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to… | |||
| CVE-2021-32067 | 0.00 | — | 0.01 | Aug 13, 2021 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization. | |||
| CVE-2021-27402 | 0.00 | — | 0.01 | Aug 13, 2021 | The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal. | |||
| CVE-2020-35547 | 0.00 | — | 0.01 | Jan 29, 2021 | A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data. | |||
| CVE-2020-25608 | 0.00 | — | 0.01 | Dec 18, 2020 | The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection. | |||
| CVE-2020-25609 | 0.00 | — | 0.01 | Dec 18, 2020 | The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data. | |||
| CVE-2020-27340 | 0.00 | — | 0.01 | Dec 18, 2020 | The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control. |
- CVE-2024-41712Oct 21, 2024risk 0.00cvss —epss 0.01
A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary…
- CVE-2024-47223Oct 21, 2024risk 0.00cvss —epss 0.00
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow…
- CVE-2024-30158Oct 21, 2024risk 0.00cvss —epss 0.00
A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker…
- CVE-2023-25597Apr 14, 2023risk 0.00cvss —epss 0.01
A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit…
- CVE-2022-41326Nov 22, 2022risk 0.00cvss —epss 0.01
The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application.
- CVE-2022-36453Oct 25, 2022risk 0.00cvss —epss 0.01
A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to control another…
- CVE-2022-36454Oct 25, 2022risk 0.00cvss —epss 0.00
A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to impersonate another…
- CVE-2022-36451Oct 25, 2022risk 0.00cvss —epss 0.01
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an…
- CVE-2022-36452Oct 25, 2022risk 0.00cvss —epss 0.01
A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application.
- CVE-2021-32069Aug 13, 2021risk 0.00cvss —epss 0.01
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.
- CVE-2021-32072Aug 13, 2021risk 0.00cvss —epss 0.01
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.
- CVE-2021-32071Aug 13, 2021risk 0.00cvss —epss 0.01
The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users.
- CVE-2021-32070Aug 13, 2021risk 0.00cvss —epss 0.01
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users.
- CVE-2021-32068Aug 13, 2021risk 0.00cvss —epss 0.01
The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to…
- CVE-2021-32067Aug 13, 2021risk 0.00cvss —epss 0.01
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.
- CVE-2021-27402Aug 13, 2021risk 0.00cvss —epss 0.01
The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.
- CVE-2020-35547Jan 29, 2021risk 0.00cvss —epss 0.01
A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data.
- CVE-2020-25608Dec 18, 2020risk 0.00cvss —epss 0.01
The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection.
- CVE-2020-25609Dec 18, 2020risk 0.00cvss —epss 0.01
The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data.
- CVE-2020-27340Dec 18, 2020risk 0.00cvss —epss 0.01
The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control.
Page 2 of 3