Vulnerabilities > Mitel
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-03-02 | CVE-2019-19371 | Cross-site Scripting vulnerability in Mitel Micollab Audio, web & Video Conferencing A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the join meeting interface. | 6.1 |
| 2020-03-02 | CVE-2019-19370 | Cross-site Scripting vulnerability in Mitel Micollab 8.1.2.1 A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the file upload interface. | 6.1 |
| 2020-03-02 | CVE-2019-18863 | Inadequate Encryption Strength vulnerability in Mitel products A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. | 5.9 |
| 2020-02-25 | CVE-2020-9379 | Unspecified vulnerability in Mitel Micontact Center Business The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authenticated user to access sensitive information. | 6.5 |
| 2020-01-13 | CVE-2019-19891 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mitel Sip-Dect Firmware 8.0/8.1 An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. | 5.9 |
| 2019-11-12 | CVE-2018-18819 | Incorrect Authorization vulnerability in Mitel Micollab and Mivoice Business Express A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insufficient access controls. | 5.3 |
| 2019-05-29 | CVE-2019-12165 | Unspecified vulnerability in Mitel products MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7) have a Command Execution Vulnerability. | 9.8 |
| 2019-04-25 | CVE-2018-18285 | SQL Injection vulnerability in Mitel CMG Suite 8.4 SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the login interface. | 9.8 |
| 2019-04-25 | CVE-2018-18286 | SQL Injection vulnerability in Mitel CMG Suite 8.4 SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. | 9.8 |
| 2019-04-02 | CVE-2018-19275 | Insecure Default Initialization of Resource vulnerability in Mitel CMG Suite and Inattend The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the confidentiality, integrity and availability of the system. | 9.8 |