CVE-2014-0160

CVE-2014-0160 (Heartbleed) is an information-disclosure vulnerability in OpenSSL’s TLS/DTLS heartbeat implementation. Affected: OpenSSL 1.0.1 before 1.0.1g. Root cause: improper handling of the Heartbeat extension (d1_both.c, t1_lib.c) leading to a buffer over-read, enabling an attacker to read m...

CVE-2022-26143

Mitel MiCollab (TP-240) before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 contains a vulnerability in the TP-240 component that allows remote attackers to obtain sensitive information and trigger denial of service, including detrimental outbound traffic. The issue, known for enabling th...

CVE-2018-3639

CVE-2018-3639 is a speculative execution side‑channel vulnerability (SSB) that can leak memory via speculative stores. The Connected ALMA doc notes a mitigation: SSB is disabled by the new alt-java launcher, reducing impact at the cost of performance, and it references OpenJDK 8u282 as part of th...

CVE-2024-41713

Mitel MiCollab’s NuPoint Unified Messaging (NPM) component is affected by CVE-2024-41713, a path-traversal vulnerability that affects MiCollab up to 9.8 SP1 FP2 (9.8.1.201). An unauthenticated attacker can read or modify data and configurations due to insufficient input validation. Connected docu...

CVE-2024-55550

CVE-2024-55550 affects Mitel MiCollab up to 9.8 SP2. The primary description indicates an authenticated administrator can perform a local file read due to insufficient input sanitization, exposing non-sensitive system information without modification or privilege escalation. The connected nuclei ...

CVE-2024-35286

CVE-2024-35286 describes a SQL injection in Mitel MiCollab’s NuPoint Messenger (NPM) up to version 9.8.0.33. An unauthenticated attacker can exploit insufficient input sanitization to read or modify data and perform arbitrary database/management operations. This has a high impact per CVSS 3.1 (CR...

CVE-2019-12165

CVE-2019-12165 affects multiple Mitel MiCollab/ AWV releases: MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, 7.1 (7.1.0.57) and earlier, and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7). The vulnerability is a Command Execut...

CVE-2024-35314

Affects Mitel MiCollab Desktop Client (versions ≤ 9.7.1.110) and MiVoice Business Solution Virtual Instance (MiVB SVI ≤ 1.0.0.25). The vulnerability is a command injection caused by insufficient parameter sanitization, enabling an unauthenticated attacker to execute arbitrary scripts with user in...

CVE-2024-47189

CVE-2024-47189 affects Mitel MiCollab MiCollab’s AWV API interface (through 9.8 SP1 FP2 / 9.8.1.201). The vulnerability is a SQL injection caused by insufficient input sanitization, allowing an unauthenticated attacker to access non-sensitive user provisioning information and potentially execute ...

CVE-2021-32070

The CVE-2021-32070 entry concerns the Mitel MiCollab MiCollab Client Service component prior to version 9.3, where an insecure header response could enable a clickjacking attack. An attacker could modify the browser header and redirect users, as described in the public records. No explicit exploi...

CVE-2023-25597

Mit el MiCollab web conferencing component up to version 9.6.2.9 is affected by an authentication-control flaw that allows an unauthenticated attacker to download a shared file via a crafted request specifying the exact path and filename, potentially exposing sensitive information. Affected softw...

CVE-2020-35547

Affected software: Mitel MiCollab (NuPoint Messenger) before 9.2 FP1. Root cause: library index page in NuPoint Messenger. Impact: unauthenticated attacker could view and modify user data. Remediation: upgrade to Mitel MiCollab 9.2 FP1 (or apply vendor security advisories). Exploitation status:**...

CVE-2022-36452

Summary: CVE-2022-36452 affects Mitel MiCollab (web conferencing component) up to version 9.5.0.101. An unauthenticated attacker could upload a malicious file, with the potential to execute arbitrary code in the application’s context. This is supported by multiple sources (NVD entry and vendor ad...

CVE-2021-32068

CVE-2021-32068 affects Mitel MiCollab components AWV and MiCollab Client Service prior to version 9.3. The vulnerability allows a Man‑In‑The‑Middle by sending multiple TLS session renegotiation requests due to insufficient TLS session controls, potentially enabling an attacker to modify applicati...

CVE-2024-35285

Summary: CVE-2024-35285 affects Mitel MiCollab’s NuPoint Messenger (NPM) component. Affected products/versions: Mitel MiCollab NuPoint Messenger up to and including 9.8.0.33. Root cause: Insufficient parameter sanitization enabling an unauthenticated user to perform a command injection. Impact: U...

CVE-2024-41714

Mit el MiCollab Web Interface (through 9.8 SP1 / 9.8.1.5) and Mitel MiVoice Business Solution Virtual Instance (MiVB SVI through 1.0.0.27) contain a command-injection vulnerability due to insufficient parameter sanitization. Authenticated attackers could execute arbitrary commands with elevated p...

CVE-2021-27401

The Mitel MiCollab Web Client Join Meeting page is vulnerable to Cross‑Site Scripting (XSS) in versions before 9.2 FP2, caused by insufficient input validation. This could allow an attacker to view and modify user data. No exploitation details or remediation are provided in the connected documents.

CVE-2021-32069

CVE-2021-32069 affects the Mitel MiCollab AWV component and is caused by improper TLS negotiation, enabling potential Man-In-The-Middle attacks. Affected are MiCollab installations prior to version 9.3, where an attacker could view and modify data in transit. The vulnerability is documented acros...

CVE-2021-32072

The CVE-2021-32072 entry concerns Mitel MiCollab: the MiCollab Client Service component in MiCollab prior to version 9.3 has an information disclosure flaw due to insufficient output sanitization, allowing an attacker to view source code methods. Connected documents confirm the affected product a...

CVE-2024-47224

The CVE concerns Mitel MiCollab’s AWV component, affecting versions prior to 9.8 SP1 FP2 (9.8.1.201). An unauthenticated attacker can exploit inadequate encoding of user input in URLs to perform a CRLF injection, enabling phishing via crafted links. Red Hat and related feeds corroborate the issue...

CVE-2022-36453

The CVE-2022-36453 affects Mitel MiCollab Client API (MiCollab versions 9.1.3–9.5.0.101). The underlying issue is improper authorization controls in the client API, allowing an authenticated attacker to modify their own profile parameters and potentially take control of another extension number. ...

CVE-2018-18819

CVE-2018-18819 affects MiCollab web conference chat component and MiVoice Business Express: MiCollab versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202); MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 ...

CVE-2021-32067

The CVE-2021-32067 refers to Mitel MiCollab Client Service prior to version 9.3, where insufficient output sanitization/validation could allow an attacker to view sensitive system information via HTTP responses (information disclosure). Affected component: MiCollab Client Service in Mitel MiColla...

CVE-2022-41326

CVE-2022-41326 concerns the Mitel MiCollab web conferencing component up to version 9.6.0.13. The issue arises from improper authorization controls that allow an unauthenticated user to upload arbitrary scripts, enabling remote code execution within the application context. The vulnerability affe...

CVE-2024-41712

Affected software: Mitel MiCollab Web Conferencing Component. Issue: input validation failure in MiCollab up to version 9.8.1.5 enabling an authenticated, local attacker to perform a command injection and run arbitrary commands in the user context. Exploitation status: not stated as active in pro...

CVE-2021-32071

CVE-2021-32071 affects Mitel MiCollab MiCollab Client service prior to version 9.3. An unauthenticated user can bypass access controls to view/modify application data and cause denial of service. The vulnerability is documented across multiple feeds (NVD, Red Hat CVE, CVE list, and related securi...

CVE-2021-27402

Mitel MiCollab’s SAS Admin portal before 9.2 FP2 is affected by a directory traversal vulnerability allowing an unauthenticated attacker to view and modify user data through improper URL validation. Affected: MiCollab versions prior to 9.2 FP2. Root cause: improper validation enabling arbitrary d...

CVE-2024-30160

MitE l MiCollab vulnerability CVE-2024-30160 affects the Suite Applications Services component (versions up to 9.7.1.110 and earlier) and stems from insufficient validation of user input. An authenticated attacker with administrative privileges can perform a Stored Cross-Site Scripting (XSS) atta...

CVE-2024-30159

Mitel MiCollab (web conferencing component) up to version 9.7.1.110 is affected by a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input validation. An authenticated attacker with administrative privileges can inject arbitrary scripts, with the impact limited to confidential...

CVE-2022-36454

The CVE-2022-36454 issue affects Mitel MiCollab, specifically the MiCollab Client API, up to version 9.5.0.101. The root cause is improper authorization controls in the client API, enabling an authenticated attacker to modify their own profile parameters and impersonate another user’s name. Docum...

CVE-2024-35315

Mitel MiCollab Desktop Client (versions up to 9.7.1.110) and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25 contain a privilege-escalation flaw due to improper file validation. An authenticated, local attacker could execute arbitrary code with elevated privileges. MITRE-like impac...

CVE-2022-36451

The CVE-2022-36451 vulnerability affects Mitel MiCollab, specifically the MiCollab Client server component up to version 9.5.0.101. The issue is a Server-Side Request Forgery (SSRF) caused by insufficient restriction of URL parameters, enabling an authenticated attacker to leverage the host serve...

CVE-2024-30157

Summary: CVE-2024-30157 affects Mitel MiCollab (Suite Applications Services component) up through version 9.7.1.110. An authenticated attacker with administrative privileges can exploit a SQL Injection due to improper input validation, potentially executing arbitrary database and management opera...

CVE-2024-35287

Summary (CVE-2024-35287) : Mitel MiCollab's NuPoint Messenger component (versions through 9.8 SP1/9.8.1.5) contains a privilege-escalation flaw due to execution of a resource with unnecessary privileges, enabling an authenticated administrator to run arbitrary commands with elevated privileges. R...

CVE-2024-47223

CVE-2024-47223 affects the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab up to version 9.8 SP1 FP2 (9.8.1.201). The Red Hat/NCSC/PTSecurity and CVE records describe an unauthenticated SQL injection caused by insufficient input sanitization, enabling access to non-sensitive u...

CVE-2024-30158

CVE-2024-30158 affects Mitel MiCollab web conferencing component (versions through 9.7.1.110). The issue is due to insufficient validation of user input, enabling an authenticated attacker with administrative privileges to perform a SQL injection, potentially executing arbitrary database and mana...

CVE-2019-19370

The CVE-2019-19370 affects Mitel MiCollab for Android prior to version 9.0.15. It is a reflected XSS in the web conferencing component caused by insufficient validation in the file upload interface, allowing an unauthenticated attacker to execute arbitrary scripts. No explicit exploitation detail...

CVE-2024-47912

The CVE-2024-47912 affects Mitel MiCollab’s AWV Conferencing component. Versions before 9.8 SP1 FP2 (9.8.1.201) are vulnerable to an unauthenticated data-access attack due to missing authentication mechanisms, allowing an attacker to access and delete sensitive information. Red Hat and other sour...

CVE-2020-25609

CVE-2020-25609 affects the NuPoint Messenger Portal of Mitel MiCollab prior to 9.2. An authenticated attacker could exploit insufficient input validation to perform Cross-Site Scripting (XSS) , potentially viewing and modifying user data. Multiple connected sources (NVD entry, RH advisory, CNVD, ...

CVE-2020-25611

The CVE-2020-25611 entry concerns Mitel MiCollab (AWV portal) prior to version 9.2, where improper input validation enables cross‑site scripting (XSS). This could let an attacker view user conference information by sending arbitrary code. Documents confirm the vulnerability class (XSS) and affect...

CVE-2020-13863

The CVE-2020-13863 entry concerns Mitel MiCollab’s SAS portal (pre-9.1.3) vulnerable to header injection in HTTP responses due to improper input handling. An attacker could exploit this to access user data. CVSS data in the NVD lists both a NETWORK attack with LOW complexity (v2) and HIGH impact ...

CVE-2020-25608

The CVE-2020-25608 entry concerns Mitel MiCollab’s SAS portal (pre-9.2). The connected documents confirm a SQL Injection vulnerability caused by improper input validation, enabling an attacker to access user credentials. Affected component is the SAS portal; root cause is input validation failure...

CVE-2020-25612

CVE-2020-25612 affects Mitel MiCollab/NuPoint Messenger prior to version 9.2. The vulnerability stems from insufficient access control, enabling an attacker with escalated privileges to access user files and potentially disclose sensitive information. Public details in connected sources consisten...

CVE-2025-52914

CVE-2025-52914 affects Mitel MiCollab, specifically the Suite Applications Services component, with a SQL injection flaw caused by insufficient input validation. Affected software: MiCollab 10.0 through SP1 FP1 (10.0.1.101). The CVE describes that an authenticated attacker could run arbitrary SQL...

CVE-2020-25606

The CVE-2020-25606 vulnerability affects Mitel MiCollab’s AWV component prior to version 9.2. It allows an attacker to view system information by sending arbitrary code due to improper input validation (XSS). Affected product: Mitel MiCollab (AWV component). Root cause: input validation weakness ...

CVE-2020-27340

The vulnerability targets Mitel MiCollab’s online help portal (pre-9.2). Affected component is the online help portal, where insufficient access control could let an attacker redirect a user to an unauthorized website by executing malicious scripts. This has been consistently described across mul...

CVE-2020-13767

The CVE-2020-13767 entry affects Mitel MiCollab for iOS prior to version 9.1.332. The issue is insufficient access control that could let an unauthorized user access restricted files and folders, with exploitation requiring a rooted iOS device and the potential to read sensitive information if su...

CVE-2020-25610

CVE-2020-25610 affects the Mitel MiCollab AWV component prior to version 9.2. The vulnerability arises from insufficient access control for conference codes, which could allow an attacker to gain access to a web conference. The available connected sources corroborate this description, but do not ...