Mitel vulnerabilities, page 2
141 vulnerabilities
Known vulnerabilities in Mitel products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 83 products.
PrioritiseCVE-2024-35314mitel · micollab +1 moremitel micollabA vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts.CVSS9.8CriticalEPSS1.80%RoutineCVE-2024-35287mitel · micollabmitel micollabA vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.CVSS6.7MediumEPSS0.21%PrioritiseCVE-2024-35286mitel · micollabmitel micollabA vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.CVSS9.8CriticalEPSS65.73%PrioritiseCVE-2024-35285mitel · micollabmitel micollabA vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.CVSS9.8CriticalEPSS1.32%RoutineCVE-2024-30160mitel · micollabmitel micollabA vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.CVSS4.8MediumEPSS0.32%RoutineCVE-2024-30159mitel · micollabmitel micollabA vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.CVSS4.8MediumEPSS0.32%RoutineCVE-2024-30158mitel · micollabmitel micollabA vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.CVSS7.2HighEPSS0.41%RoutineCVE-2024-30157mitel · micollabmitel micollabA vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.CVSS7.2HighEPSS0.41%RoutineCVE-2024-42514mitel · micontact_center_businessmitel micontact_center_businessA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to access sensitive information and send unauthorized messages during an active chat session.CVSS8.1HighEPSS0.45%RoutineCVE-2024-36446mitel · mivoice_mx-onemitel mivoice_mx-oneThe provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema.CVSS8.8HighEPSS0.49%Act nowCVE-2024-41710Mitel · SIP Phones +15 moreMitel SIP Phones Argument Injection VulnerabilityA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.CVSS7.2HighKEVEPSS41.65%PrioritiseCVE-2024-37570mitel · 6869i_sip_firmwaremitel 6869i_sip_firmwareOn Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution.CVSS8.8HighEPSS1.06%PrioritiseCVE-2024-37569mitel · 6869i_sip_firmwaremitel 6869i_sip_firmwareAn issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter.CVSS8.8HighEPSS3.20%RoutineCVE-2024-35284mitel · micontact_center_businessmitel micontact_center_businessA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation.CVSS5.4MediumEPSS0.25%RoutineCVE-2024-35283mitel · micontact_center_businessmitel micontact_center_businessA vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insufficient input validation.CVSS6.1MediumEPSS0.26%PrioritiseCVE-2024-28066mitel · 6905_firmware +13 moremitel 6905_firmwareIn Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).CVSS8.8HighEPSS0.45%RoutineCVE-2024-28070mitel · micontact_center_businessmitel micontact_center_businessA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive information and gain unauthorized access.CVSS6.8MediumEPSS0.45%PrioritiseCVE-2024-28069mitel · micontact_center_businessmitel micontact_center_businessA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to access sensitive information and potentially conduct unauthorized actions within the vulnerable component.CVSS7.5HighEPSS0.57%PrioritiseCVE-2023-40266mitel · unify_openscape_xpressions_webassistantmitel unify_openscape_xpressions_webassistantAn issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal.CVSS9.8CriticalEPSS0.70%RoutineCVE-2023-40265mitel · unify_openscape_xpressions_webassistantmitel unify_openscape_xpressions_webassistantAn issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload.CVSS8.8HighEPSS0.92%