CVE-2022-29499

The CVE-2022-29499 vulnerability affects the Service Appliance component in Mitel MiVoice Connect (SA 100, SA 400, Virtual SA) through 19.2 SP3, due to incorrect data validation that enables remote code execution. Impact is documented as Remote Code Execution with high/severe CVSS scores (up to 9...

CVE-2018-3639

CVE-2018-3639 is a speculative execution side‑channel vulnerability (SSB) that can leak memory via speculative stores. The Connected ALMA doc notes a mitigation: SSB is disabled by the new alt-java launcher, reducing impact at the cost of performance, and it references OpenJDK 8u282 as part of th...

CVE-2022-40765

The CVE-2022-40765 issue affects Mitel MiVoice Connect, specifically the Edge Gateway component, where insufficient restriction of URL parameters allows an authenticated attacker with internal network access to perform a command injection. Connected sources confirm an internal-network, authentica...

CVE-2022-41223

The CVE-2022-41223 issue affects the Director database component of Mitel MiVoice Connect (up to 19.3 / 22.22.6100.0). An authenticated attacker can perform a code-injection attack via crafted data due to insufficient restrictions on the database data type. This vulnerability is tracked by CISA a...

CVE-2023-39289

CVE-2023-39289 affects Mitel MiVoice Connect, specifically the Connect Mobility Router component, with versions up to 9.6.2208.101. The vulnerability allows an unauthenticated attacker to perform an account enumeration attack due to improper configuration, potentially exposing system information....

CVE-2023-25598

Summary: CVE-2023-25598 affects Mitel MiVoice Connect, exploiting insufficient validation on the home.php page to enable reflected cross-site scripting (XSS) by an unauthenticated attacker. Affected versions: MiVoice Connect up to 19.3 SP2, and 20.x, 21.x, and 22.x (up to 22.24.1500.0). Impact: a...

CVE-2023-25599

The CVE-2023-25599 issue affects Mitel MiVoice Connect (conferencing component) and is caused by insufficient validation on the test_presenter.php page, enabling unauthenticated, reflected XSS. Affected versions include Mitel MiVoice Connect through 19.3 SP2 and 22.24.1500.0. Consequences stated ...

CVE-2023-31458

Summary of CVE-2023-31458 (Mitel MiVoice Connect Edge Gateway) : The Edge Gateway component in MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier allows an unauthenticated attacker with internal network access to authenticate with administrative privileges because the initial installati...

CVE-2018-9101

Summary: CVE-2018-9101 is a reflected XSS vulnerability in the Mitel MiVoice Connect conferencing component. The issue affects Mitel MiVoice Connect versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2 GA27 (19.49.5200.0) and earlier. Root cause: insufficient validation on the la...

CVE-2023-31459

CVE-2023-31459 affects Mitel MiVoice Connect’s Connect Mobility Router component, in versions 9.6.2208.101 and earlier. The root cause is that initial installation does not enforce a password change, allowing an unauthenticated attacker with internal network access to authenticate with administra...

CVE-2023-31460

CVE-2023-31460 affects Mitel MiVoice Connect’s Connect Mobility Router component (versions ≤ 9.6.2208.101). The root cause is insufficient restriction of URL parameters, enabling an authenticated attacker with internal network access to perform a command injection. Affected products expose high i...

CVE-2023-31457

The CVE-2023-31457 issue affects Mitel MiVoice Connect—Headquarters server component—with versions 19.3 SP2 (22.24.1500.0) and earlier. It allows an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control. If exploited, the impact aligns w...

CVE-2023-39291

CVE-2023-39291 concerns Mitel MiVoice Connect’s Connect Mobility Router (affected versions up to 9.6.2304.102). The vulnerability is described as an information disclosure due to improper configuration, enabling an authenticated attacker with elevated privileges to view system information. The co...

CVE-2018-9103

A CVE entry for CVE-2018-9103 describes a reflected cross-site scripting (XSS) vulnerability in Mitel MiVoice Connect’s conferencing component. Affected products are Mitel MiVoice Connect (R1707-PREM SP1 / 21.84.5535.0 and earlier) and Mitel ST (14.2 GA27 / 19.49.5200.0 and earlier). The issue ar...

CVE-2018-9104

Mit el MiVoice Connect conferencing component is affected by CVE-2018-9104. Affected versions: Mitel MiVoice Connect R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2 GA27 (19.49.5200.0) and earlier. Issue: unauthenticated attacker can trigger a reflected cross-site scripting (XSS) due...

CVE-2020-10211

Mitel MiVoice Connect (UCB component) is affected by CVE-2020-10211, prior to version 19.1 SP1. The issue stems from insufficient validation of URL parameters, enabling an unauthenticated remote attacker to execute arbitrary scripts. Reported impact includes access to sensitive information and po...

CVE-2023-39287

The CVE-2023-39287 entry affects the Edge Gateway component of Mitel MiVoice Connect (through 19.3 SP3, 22.24.5800.0). The vulnerability is a command argument injection caused by insufficient parameter sanitization in the Edge Gateway, exploitable by an authenticated attacker with elevated privil...

CVE-2018-9102

CVE-2018-9102 affects Mitel MiVoice Connect (R1707-PREM SP1, 21.84.5535.0) and Mitel ST (14.2 GA27, 19.49.5200.0): SQL injection in the conferencing component due to insufficient input validation on the signin interface, allowing an unauthenticated attacker to extract sensitive data from the data...

CVE-2020-12679

CVE-2020-12679: A reflected XSS in Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote injection of JavaScript/HTML via PATH_INFO to home.php. Connected sources corroborate the same vulnerability across NVD/Red Hat/CNVD entries, with no public evid...

CVE-2023-39285

CVE-2023-39285 affects Mitel MiVoice Connect, Edge Gateway component, up to version 19.3 SP3 (22.24.5800.0). The vulnerability is a CSRF due to insufficient request validation, allowing an unauthenticated attacker to provide a modified URL and potentially modify system configuration settings. Con...

CVE-2023-32748

CVE-2023-32748 affects Mitel MiVoice Connect, specifically the Linux DVS server component, up to version 19.3 SP2 (22.24.1500.0). The issue arises from improper access control, allowing an unauthenticated attacker with internal network access to execute arbitrary scripts. Impact is described as p...

CVE-2023-39290

The CVE-2023-39290 entry involves Mitel MiVoice Connect, specifically the Edge Gateway component. A vulnerability could allow an authenticated user with elevated privileges to perform an information disclosure due to improper configuration, with the impact being visibility of system information. ...

CVE-2023-39288

The CVE-2023-39288 entry concerns Mitel MiVoice Connect’s Connect Mobility Router component. A command argument injection is possible due to insufficient parameter sanitization, requiring an authenticated attacker with elevated privileges and internal network access. The exploit could enable acce...