Vulnerabilities > Mitel > Mivoice Connect > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-14 | CVE-2023-39285 | Cross-Site Request Forgery (CSRF) vulnerability in Mitel Mivoice Connect A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. | 4.3 |
| 2023-08-25 | CVE-2023-39287 | Argument Injection or Modification vulnerability in Mitel Mivoice Connect A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. | 5.5 |
| 2023-08-25 | CVE-2023-39288 | Argument Injection or Modification vulnerability in Mitel Mivoice Connect A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. | 5.5 |
| 2023-08-25 | CVE-2023-39290 | Unspecified vulnerability in Mitel Mivoice Connect A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. | 4.9 |
| 2023-08-25 | CVE-2023-39291 | Unspecified vulnerability in Mitel Mivoice Connect A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. | 4.9 |
| 2023-05-24 | CVE-2023-25598 | Cross-site Scripting vulnerability in Mitel Mivoice Connect A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the home.php page. | 6.1 |
| 2022-11-22 | CVE-2022-40765 | Command Injection vulnerability in Mitel Mivoice Connect 19.1/19.3 A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters. | 6.8 |
| 2022-11-22 | CVE-2022-41223 | Code Injection vulnerability in Mitel Mivoice Connect 19.1/19.3 The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type. | 6.8 |
| 2020-05-07 | CVE-2020-12679 | Cross-site Scripting vulnerability in Mitel Mivoice Connect and Shoretel Conference web A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php. | 6.1 |
| 2018-05-22 | CVE-2018-3639 | Information Exposure Through Discrepancy vulnerability in multiple products Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. | 5.5 |