CVE-2021-3352

The Mitel MiContact Center Business Software Development Kit (SDK) is affected, specifically versions 8.0.0.0–8.1.4.1 and 9.0.0.0–9.3.1.0. The root cause is improper handling of tokens in the SDK, which can allow an unauthenticated attacker to view and modify user data without authorization. This...

CVE-2024-35284

The Mitel MiContact Center Business platform, specifically versions through 10.0.0.4 , is vulnerable to a reflected cross-site scripting (XSS) attack. This security issue resides in the legacy chat component and is caused by insufficient input validation . An unauthenticated attacker can exploit ...

CVE-2024-35283

The Ignite component of Mitel MiContact Center Business versions through 10.0.0.4 is vulnerable to a stored cross-site scripting (XSS) attack. The root cause is insufficient input validation , which could allow an unauthenticated attacker to execute malicious scripts. While the documents recommen...

CVE-2020-9379

CVE-2020-9379 affects the MiContact Center Business SDK with Site Based Security versions 8.0 through 9.0.1.0 before KB496276. The description states that an authenticated user can access sensitive information, potentially exposing user conversations. The core issue appears to be access-control-r...

CVE-2024-28070

A vulnerability exists in the legacy chat component of Mitel MiContact Center Business (versions through 10.0.0.4 ). Due to insufficient input validation, an unauthenticated attacker can conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could lead to the exposure of s...

CVE-2020-24692

CVE-2020-24692 affects the Ignite portal in Mitel MiContact Center Business prior to 9.3.0.0. The issue is insufficient input validation allowing cross-site scripting (XSS), which could let an attacker execute arbitrary scripts and potentially gain access to a user session. The description and co...

CVE-2024-28069

Mitel MiContact Center Business versions through 10.0.0.4 are vulnerable to an information disclosure attack due to an improper configuration in the legacy chat component . An unauthenticated attacker could exploit this misconfiguration to access sensitive information and potentially perform unau...

CVE-2024-42514

A vulnerability in the legacy chat component of Mitel MiContact Center Business (versions through 10.1.0.4) allows an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. Exploitation requires user interaction and could enable an attacker to a...

CVE-2023-22854

The ccmweb component of Mitel MiContact Center Business server versions 9.2.2.0 through 9.4.1.0 is vulnerable to an arbitrary file download. This is caused by insufficient restriction of URL parameters , which allows an unauthenticated attacker to access sensitive information. As a temporary work...

CVE-2020-24693

The Mitel MiContact Center Business Ignite portal is affected by CVE-2020-24693, with the Ignite portal vulnerability located in the MiContact Center’s Ignite component prior to version 9.3.0.0. The root cause is insufficient output sanitization, which could allow a local attacker to view system ...

CVE-2025-67823

A vulnerability in the Multimedia Email component of Mitel MiContact Center Business (versions through 10.2.0.10) and Mitel CX (versions through 1.1.0.1) allows an unauthenticated attacker to perform a Cross-Site Scripting (XSS) attack. The root cause is insufficient input validation . A successf...