CVE-2020-13617

The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitive information due to improper memory handling during failed login attempts...

Information disclosure

The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitive information due to improper memory handling during failed login attempts...

Improper access control

The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control. An exploit requires a rooted iOS device, and if successful could allow an attacker to gain access to sensitive information,...

Design/Logic Flaw

The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information...

CVE-2020-12456

CVE-2020-12456 affects Mitel MiVoice Connect Client prior to 214.100.1223.0. The issue arises from improper rendering of chat messages in the chat notification window, enabling remote code execution. A successful exploit could allow an attacker to steal session cookies, perform directory traversa...

CVE-2020-12456

A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform...

CVE-2020-13617

CVE-2020-13617 affects Mitel MiVoice 6800/6900 series SIP Phones with firmware before 5.1.0.SP5. The Web UI component exposes sensitive information due to improper memory handling during failed login attempts, allowing an unauthenticated attacker to access data. According to the NVD entry, the is...

CVE-2020-13617

The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitive information due to improper memory handling during failed login attempts...

CVE-2020-13767

The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control. An exploit requires a rooted iOS device, and if successful could allow an attacker to gain access to sensitive information,...

CVE-2020-13767

The CVE-2020-13767 entry affects Mitel MiCollab for iOS prior to version 9.1.332. The issue is insufficient access control that could let an unauthorized user access restricted files and folders, with exploitation requiring a rooted iOS device and the potential to read sensitive information if su...

CVE-2020-13863

The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information...

CVE-2020-13863

The CVE-2020-13863 entry concerns Mitel MiCollab’s SAS portal (pre-9.1.3) vulnerable to header injection in HTTP responses due to improper input handling. An attacker could exploit this to access user data. CVSS data in the NVD lists both a NETWORK attack with LOW complexity (v2) and HIGH impact ...

Mitel Networks MiCollab AWV Path Traversal Vulnerability

Mitel Networks MiCollab AWV is an application for managing audio, web and video conferencing from Mitel Networks Canada. A path traversal vulnerability exists in the web conference component in Mitel Networks MiCollab AWV versions prior to 8.1.2.4 and 9.x versions prior to 9.1.3, which stems from...

CVE-2020-11798

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

CVE-2020-11798

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

Directory traversal

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

CVE-2020-11798

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

CVE-2020-11798

CVE-2020-11798 affects Mitel MiCollab AWV’s web conference component. Versions prior to 8.1.2.4 and 9.x prior to 9.1.3 are vulnerable to a Directory Traversal flaw caused by insufficient access validation, allowing an attacker to access arbitrary files in restricted server directories via a craft...

Mitel Networks ShoreTel Conference Cross-Site Scripting Vulnerability

Mitel Networks ShoreTel Conference is a suite of teleconferencing solutions from Mitel Networks Canada. A cross-site scripting vulnerability exists in the home.php file in Mitel Networks ShoreTel Conference version 19.50.1000.0. A remote attacker can exploit this vulnerability to inject arbitrary...

CVE-2020-12679

A reflected cross-site scripting XSS vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATHINFO to home.php...