Vulnerabilities > Mitel
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-04-17 | CVE-2020-10211 | Improper Input Validation vulnerability in Mitel Mivoice Connect and Mivoice Connect Client A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. | 7.5 |
| 2020-03-02 | CVE-2019-19608 | SQL Injection vulnerability in Mitel Micollab Audio, web & Video Conferencing A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the registeredList.cgi page. | 7.5 |
| 2020-03-02 | CVE-2019-19607 | SQL Injection vulnerability in Mitel Micollab Audio, web & Video Conferencing A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the session parameter. | 7.5 |
| 2020-03-02 | CVE-2019-19371 | Cross-site Scripting vulnerability in Mitel Micollab Audio, web & Video Conferencing A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the join meeting interface. | 4.3 |
| 2020-03-02 | CVE-2019-19370 | Cross-site Scripting vulnerability in Mitel Micollab 8.1.2.1 A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the file upload interface. | 4.3 |
| 2020-03-02 | CVE-2019-18863 | Cleartext Transmission of Sensitive Information vulnerability in Mitel products A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. | 4.3 |
| 2020-02-25 | CVE-2020-9379 | Incorrect Authorization vulnerability in Mitel Micontact Center Business 8.0/9.0.0.0/9.0.1.0 The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authenticated user to access sensitive information. | 4.0 |
| 2020-01-13 | CVE-2019-19891 | Inadequate Encryption Strength vulnerability in Mitel Sip-Dect Firmware 8.0/8.1 An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. | 4.3 |
| 2019-11-12 | CVE-2018-18819 | Incorrect Authorization vulnerability in Mitel Micollab and Mivoice Business Express A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insufficient access controls. | 5.0 |
| 2019-05-29 | CVE-2019-12165 | Unspecified vulnerability in Mitel Micollab and Micollab AWV MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7) have a Command Execution Vulnerability. | 10.0 |