Mitel MiCollab 访问控制错误漏洞

Mitel MiCollab is a mobile application that provides voice, video, messaging, audio conferencing, and team collaboration for employees from Mitel Canada. A security vulnerability exists in Mitel MiCollab version 9.8 SP1 FP2 9.8.1.201 and prior versions, which stems from a missing authentication...

PT-2024-32470 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.8 SP1 FP2 9.8.1.201 Description: The issue concerns the API Interface of the AWV component, where insufficient sanitization of user input could allow an unauthenticated attacker to conduct SQL injection. This...

CVE-2024-35287

Summary (CVE-2024-35287) : Mitel MiCollab's NuPoint Messenger component (versions through 9.8 SP1/9.8.1.5) contains a privilege-escalation flaw due to execution of a resource with unnecessary privileges, enabling an authenticated administrator to run arbitrary commands with elevated privileges. R...

CVE-2024-30159

Mitel MiCollab (web conferencing component) up to version 9.7.1.110 is affected by a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input validation. An authenticated attacker with administrative privileges can inject arbitrary scripts, with the impact limited to confidential...

CVE-2024-41713

A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the...

CVE-2024-35314

A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance MiVB SVI 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user...

CVE-2024-35287

A vulnerability in the NuPoint Messenger NPM component of Mitel MiCollab through version 9.8 SP1 9.8.1.5 could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploi...

CVE-2024-47224

A vulnerability in the AWV Audio, Web and Video Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perfo...

CVE-2024-47223

CVE-2024-47223 affects the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab up to version 9.8 SP1 FP2 (9.8.1.201). The Red Hat/NCSC/PTSecurity and CVE records describe an unauthenticated SQL injection caused by insufficient input sanitization, enabling access to non-sensitive u...

Mitel MiCollab和Mitel MiVoice 代码注入漏洞

Mitel MiCollab and Mitel MiVoice are both products of Mitel Canada.Mitel MiCollab is a mobile application that provides voice, video, messaging, audio conferencing, and team collaboration for employees.Mitel MiVoice is an IP-capable telephone. A security vulnerability exists in Mitel MiCollab...

CVE-2024-41712

A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system...

Mitel MiCollab 代码注入漏洞

Mitel MiCollab is a mobile application from Mitel Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees. An input validation error vulnerability exists in Mitel MiColla, which can be exploited by an attacker to execute arbitrary commands on the syst...

CVE-2024-41713

Mitel MiCollab’s NuPoint Unified Messaging (NPM) component is affected by CVE-2024-41713, a path-traversal vulnerability that affects MiCollab up to 9.8 SP1 FP2 (9.8.1.201). An unauthenticated attacker can read or modify data and configurations due to insufficient input validation. Connected docu...

CVE-2024-35286

CVE-2024-35286 describes a SQL injection in Mitel MiCollab’s NuPoint Messenger (NPM) up to version 9.8.0.33. An unauthenticated attacker can exploit insufficient input sanitization to read or modify data and perform arbitrary database/management operations. This has a high impact per CVSS 3.1 (CR...

PT-2024-10183 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.8 SP2 Description: Mitel MiCollab is susceptible to a local file read issue stemming from insufficient input sanitization. A successful exploit allows an authenticated attacker with administrative privileges ...

The vulnerability of the MX-ONE Provisioning Manager tool, a corporate communication platform from Mitel MiVoice, allows a perpetrator to bypass authentication procedures and compromise the integrity of the protected information.

The vulnerability of the MX-ONE Provisioning Manager PM tool, a component of the corporate communication platform Mitel MiVoice MX-ONE, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to bypass authentication procedures and compromise the...

PT-2024-7463

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions 9.8 SP1 FP2 9.8.1.201 and earlier Description: A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab could allow an unauthenticated attacker to conduct a path traversal attack due to...

PT-2024-7462 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions prior to 9.8 SP1 FP2 9.8.1.201 Description: A vulnerability in the AWV component of Mitel MiCollab could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in...

PT-2024-7508 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions prior to 9.8 SP1 FP2 9.8.1.201 Description: A vulnerability in the AWV Conferencing component could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms...

CVE-2024-42514

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to...