CVE-2014-0160

CVE-2014-0160 (Heartbleed) is an information-disclosure vulnerability in OpenSSL’s TLS/DTLS heartbeat implementation. Affected: OpenSSL 1.0.1 before 1.0.1g. Root cause: improper handling of the Heartbeat extension (d1_both.c, t1_lib.c) leading to a buffer over-read, enabling an attacker to read m...

CVE-2022-26143

Mitel MiCollab (TP-240) before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 contains a vulnerability in the TP-240 component that allows remote attackers to obtain sensitive information and trigger denial of service, including detrimental outbound traffic. The issue, known for enabling th...

CVE-2018-3639

CVE-2018-3639 is a speculative execution side‑channel vulnerability (SSB) that can leak memory via speculative stores. The Connected ALMA doc notes a mitigation: SSB is disabled by the new alt-java launcher, reducing impact at the cost of performance, and it references OpenJDK 8u282 as part of th...

CVE-2024-41713

Mitel MiCollab’s NuPoint Unified Messaging (NPM) component is affected by CVE-2024-41713, a path-traversal vulnerability that affects MiCollab up to 9.8 SP1 FP2 (9.8.1.201). An unauthenticated attacker can read or modify data and configurations due to insufficient input validation. Connected docu...

CVE-2024-55550

Mitel MiCollab through 9.8 SP2 (9.8.2.12) is vulnerable to a local file read flaw (CVE-2024-55550) caused by insufficient input sanitization . An authenticated attacker with administrative privileges can exploit this to access resources constrained to the admin level, although disclosure is limit...

CVE-2024-35286

The NuPoint Messenger (NPM) component of Mitel MiCollab (versions through 9.8.0.33 ) is vulnerable to a SQL injection attack due to insufficient sanitization of user input. An unauthenticated attacker can exploit this flaw to access sensitive information and perform arbitrary database and managem...

CVE-2024-35314

A command injection vulnerability exists in the Mitel MiCollab Desktop Client (version 9.7.1.110 and earlier) and MiVoice Business Solution Virtual Instance (MiVB SVI) (version 1.0.0.25). The root cause is insufficient parameter sanitization (or failure to neutralize special elements), which coul...

CVE-2019-12165

CVE-2019-12165 affects multiple Mitel MiCollab/ AWV releases: MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, 7.1 (7.1.0.57) and earlier, and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7). The vulnerability is a Command Execut...

CVE-2021-32070

The CVE-2021-32070 entry concerns the Mitel MiCollab MiCollab Client Service component prior to version 9.3, where an insecure header response could enable a clickjacking attack. An attacker could modify the browser header and redirect users, as described in the public records. No explicit exploi...

CVE-2024-47189

The API Interface of the AWV (Audio, Web and Video Conferencing) component in Mitel MiCollab (versions through 9.8 SP1 FP2 (9.8.1.201) ) is vulnerable to SQL injection due to insufficient sanitization of user input. An unauthenticated attacker with specific knowledge could exploit this to access ...

CVE-2023-25597

Mit el MiCollab web conferencing component up to version 9.6.2.9 is affected by an authentication-control flaw that allows an unauthenticated attacker to download a shared file via a crafted request specifying the exact path and filename, potentially exposing sensitive information. Affected softw...

CVE-2024-41714

A command injection vulnerability exists in the Web Interface component of Mitel MiCollab (through 9.8 SP1/9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) (through 1.0.0.27). The root cause is insufficient parameter sanitization , which could allow an authenticated attacker to ...

CVE-2021-32069

CVE-2021-32069 affects the Mitel MiCollab AWV component and is caused by improper TLS negotiation, enabling potential Man-In-The-Middle attacks. Affected are MiCollab installations prior to version 9.3, where an attacker could view and modify data in transit. The vulnerability is documented acros...

CVE-2024-35285

A command injection vulnerability exists in the NuPoint Messenger (NPM) component of the Mitel MiCollab collaboration platform, affecting versions through 9.8.0.33 . The flaw stems from a lack of data cleaning measures and insufficient parameter sanitization at the management level. An unauthenti...

CVE-2024-47224

The AWV (Audio, Web and Video Conferencing) component in Mitel MiCollab prior to version 9.8 SP1 FP2 (9.8.1.201) is vulnerable to a CRLF injection attack . The root cause is the inadequate encoding of user input in URLs, which allows an unauthenticated attacker to perform phishing attacks by redi...

CVE-2022-36452

Summary: CVE-2022-36452 affects Mitel MiCollab (web conferencing component) up to version 9.5.0.101. An unauthenticated attacker could upload a malicious file, with the potential to execute arbitrary code in the application’s context. This is supported by multiple sources (NVD entry and vendor ad...

CVE-2021-32068

CVE-2021-32068 affects Mitel MiCollab components AWV and MiCollab Client Service prior to version 9.3. The vulnerability allows a Man‑In‑The‑Middle by sending multiple TLS session renegotiation requests due to insufficient TLS session controls, potentially enabling an attacker to modify applicati...

CVE-2022-36451

The CVE-2022-36451 vulnerability affects Mitel MiCollab, specifically the MiCollab Client server component up to version 9.5.0.101. The issue is a Server-Side Request Forgery (SSRF) caused by insufficient restriction of URL parameters, enabling an authenticated attacker to leverage the host serve...

CVE-2024-41712

A command injection vulnerability exists in the Web Conferencing Component of Mitel MiCollab (versions through 9.8.1.5 ). The root cause is insufficient validation of user input , which could allow an authenticated attacker to execute arbitrary commands on the system within the context of the use...

CVE-2020-35547

Affected software: Mitel MiCollab (NuPoint Messenger) before 9.2 FP1. Root cause: library index page in NuPoint Messenger. Impact: unauthenticated attacker could view and modify user data. Remediation: upgrade to Mitel MiCollab 9.2 FP1 (or apply vendor security advisories). Exploitation status:**...

CVE-2024-35315

A vulnerability exists in the Mitel MiCollab Desktop Client (versions 9.7.1.110 and earlier) and MiVoice Business Solution Virtual Instance (MiVB SVI) (version 1.0.0.25) due to improper file validation and insufficient access control . An authenticated attacker could exploit these deficiencies to...

CVE-2021-27401

The Mitel MiCollab Web Client Join Meeting page is vulnerable to Cross‑Site Scripting (XSS) in versions before 9.2 FP2, caused by insufficient input validation. This could allow an attacker to view and modify user data. No exploitation details or remediation are provided in the connected documents.

CVE-2021-32067

The CVE-2021-32067 refers to Mitel MiCollab Client Service prior to version 9.3, where insufficient output sanitization/validation could allow an attacker to view sensitive system information via HTTP responses (information disclosure). Affected component: MiCollab Client Service in Mitel MiColla...

CVE-2022-41326

CVE-2022-41326 concerns the Mitel MiCollab web conferencing component up to version 9.6.0.13. The issue arises from improper authorization controls that allow an unauthenticated user to upload arbitrary scripts, enabling remote code execution within the application context. The vulnerability affe...

CVE-2018-18819

CVE-2018-18819 affects MiCollab web conference chat component and MiVoice Business Express: MiCollab versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202); MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 ...

CVE-2021-32071

CVE-2021-32071 affects Mitel MiCollab MiCollab Client service prior to version 9.3. An unauthenticated user can bypass access controls to view/modify application data and cause denial of service. The vulnerability is documented across multiple feeds (NVD, Red Hat CVE, CVE list, and related securi...

CVE-2022-36453

The CVE-2022-36453 affects Mitel MiCollab Client API (MiCollab versions 9.1.3–9.5.0.101). The underlying issue is improper authorization controls in the client API, allowing an authenticated attacker to modify their own profile parameters and potentially take control of another extension number. ...

CVE-2024-30160

MitE l MiCollab vulnerability CVE-2024-30160 affects the Suite Applications Services component (versions up to 9.7.1.110 and earlier) and stems from insufficient validation of user input. An authenticated attacker with administrative privileges can perform a Stored Cross-Site Scripting (XSS) atta...

CVE-2021-27402

Mitel MiCollab’s SAS Admin portal before 9.2 FP2 is affected by a directory traversal vulnerability allowing an unauthenticated attacker to view and modify user data through improper URL validation. Affected: MiCollab versions prior to 9.2 FP2. Root cause: improper validation enabling arbitrary d...

CVE-2021-32072

The CVE-2021-32072 entry concerns Mitel MiCollab: the MiCollab Client Service component in MiCollab prior to version 9.3 has an information disclosure flaw due to insufficient output sanitization, allowing an attacker to view source code methods. Connected documents confirm the affected product a...

CVE-2024-30159

Mitel MiCollab (web conferencing component) up to version 9.7.1.110 is affected by a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input validation. An authenticated attacker with administrative privileges can inject arbitrary scripts, with the impact limited to confidential...

CVE-2024-30158

CVE-2024-30158 affects Mitel MiCollab web conferencing component (versions through 9.7.1.110). The issue is due to insufficient validation of user input, enabling an authenticated attacker with administrative privileges to perform a SQL injection, potentially executing arbitrary database and mana...

CVE-2022-36454

The CVE-2022-36454 issue affects Mitel MiCollab, specifically the MiCollab Client API, up to version 9.5.0.101. The root cause is improper authorization controls in the client API, enabling an authenticated attacker to modify their own profile parameters and impersonate another user’s name. Docum...

CVE-2024-30157

Summary: CVE-2024-30157 affects Mitel MiCollab (Suite Applications Services component) up through version 9.7.1.110. An authenticated attacker with administrative privileges can exploit a SQL Injection due to improper input validation, potentially executing arbitrary database and management opera...

CVE-2024-35287

A privilege escalation vulnerability exists in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) . The root cause is identified as insufficient access control and the execution of a resource with unnecessary privileges. An authenticated attacker with admini...

CVE-2024-47912

A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab (versions prior to 9.8 SP1 FP2 (9.8.1.201) ) allows an unauthenticated attacker to perform unauthorized data-access attacks. The root cause is a missing authentication mechanism and deficiencies in the aut...

CVE-2025-52914

CVE-2025-52914 affects Mitel MiCollab, specifically the Suite Applications Services component, with a SQL injection flaw caused by insufficient input validation. Affected software: MiCollab 10.0 through SP1 FP1 (10.0.1.101). The CVE describes that an authenticated attacker could run arbitrary SQL...

CVE-2024-47223

The AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through version 9.8 SP1 FP2 (9.8.1.201) is vulnerable to a SQL injection attack. The root cause is the insufficient sanitization of user input , which could allow an unauthenticated attacker to access non-sensitive user provi...

CVE-2019-19370

The CVE-2019-19370 affects Mitel MiCollab for Android prior to version 9.0.15. It is a reflected XSS in the web conferencing component caused by insufficient validation in the file upload interface, allowing an unauthenticated attacker to execute arbitrary scripts. No explicit exploitation detail...

CVE-2020-25611

The CVE-2020-25611 entry concerns Mitel MiCollab (AWV portal) prior to version 9.2, where improper input validation enables cross‑site scripting (XSS). This could let an attacker view user conference information by sending arbitrary code. Documents confirm the vulnerability class (XSS) and affect...

CVE-2020-25609

CVE-2020-25609 affects the NuPoint Messenger Portal of Mitel MiCollab prior to 9.2. An authenticated attacker could exploit insufficient input validation to perform Cross-Site Scripting (XSS) , potentially viewing and modifying user data. Multiple connected sources (NVD entry, RH advisory, CNVD, ...

CVE-2020-25606

The CVE-2020-25606 vulnerability affects Mitel MiCollab’s AWV component prior to version 9.2. It allows an attacker to view system information by sending arbitrary code due to improper input validation (XSS). Affected product: Mitel MiCollab (AWV component). Root cause: input validation weakness ...

CVE-2020-25612

CVE-2020-25612 affects Mitel MiCollab/NuPoint Messenger prior to version 9.2. The vulnerability stems from insufficient access control, enabling an attacker with escalated privileges to access user files and potentially disclose sensitive information. Public details in connected sources consisten...

CVE-2020-13863

The CVE-2020-13863 entry concerns Mitel MiCollab’s SAS portal (pre-9.1.3) vulnerable to header injection in HTTP responses due to improper input handling. An attacker could exploit this to access user data. CVSS data in the NVD lists both a NETWORK attack with LOW complexity (v2) and HIGH impact ...

CVE-2020-25608

The CVE-2020-25608 entry concerns Mitel MiCollab’s SAS portal (pre-9.2). The connected documents confirm a SQL Injection vulnerability caused by improper input validation, enabling an attacker to access user credentials. Affected component is the SAS portal; root cause is input validation failure...

CVE-2020-27340

The vulnerability targets Mitel MiCollab’s online help portal (pre-9.2). Affected component is the online help portal, where insufficient access control could let an attacker redirect a user to an unauthorized website by executing malicious scripts. This has been consistently described across mul...

CVE-2020-25610

CVE-2020-25610 affects the Mitel MiCollab AWV component prior to version 9.2. The vulnerability arises from insufficient access control for conference codes, which could allow an attacker to gain access to a web conference. The available connected sources corroborate this description, but do not ...

CVE-2020-13767

The CVE-2020-13767 entry affects Mitel MiCollab for iOS prior to version 9.1.332. The issue is insufficient access control that could let an unauthorized user access restricted files and folders, with exploitation requiring a rooted iOS device and the potential to read sensitive information if su...