Filtered by vendor Mitel
Subscribe
Total
108 CVE
CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
---|---|---|---|---|---|
CVE-2019-19608 | 1 Mitel | 1 Micollab Audio\, Web \& Video Conferencing | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the registeredList.cgi page. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts. | |||||
CVE-2019-19891 | 1 Mitel | 2 Sip-dect, Sip-dect Firmware | 2024-02-28 | 4.3 MEDIUM | 5.9 MEDIUM |
An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. A successful exploit may allow the attacker to intercept sensitive information. | |||||
CVE-2019-19607 | 1 Mitel | 1 Micollab Audio\, Web \& Video Conferencing | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the session parameter. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts. | |||||
CVE-2018-19275 | 1 Mitel | 2 Cmg Suite, Inattend | 2024-02-28 | 10.0 HIGH | 9.8 CRITICAL |
The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the confidentiality, integrity and availability of the system. | |||||
CVE-2019-9591 | 1 Mitel | 1 Connect Onsite | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter. | |||||
CVE-2018-18285 | 1 Mitel | 1 Cmg Suite | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the login interface. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts. | |||||
CVE-2019-12165 | 1 Mitel | 2 Micollab, Micollab Audio\, Web \& Video Conferencing | 2024-02-28 | 10.0 HIGH | 9.8 CRITICAL |
MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7) have a Command Execution Vulnerability. Successful exploit of this vulnerability could allow an attacker to execute arbitrary system commands. | |||||
CVE-2018-18286 | 1 Mitel | 1 Cmg Suite | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts. | |||||
CVE-2019-9592 | 1 Mitel | 1 Connect Onsite | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter. | |||||
CVE-2019-9593 | 1 Mitel | 1 Connect Onsite | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter. | |||||
CVE-2016-6562 | 1 Mitel | 1 Shortel Mobility Client | 2024-02-28 | 2.9 LOW | 7.5 HIGH |
On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials. | |||||
CVE-2018-12901 | 1 Mitel | 2 St, St Firmware | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 (19.49.9400.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts. | |||||
CVE-2018-16226 | 1 Mitel | 1 Mivoice Office 400 | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack, due to insufficient validation for the start.asp page. A successful exploit could allow the attacker to execute arbitrary scripts to access sensitive browser-based information. | |||||
CVE-2018-15497 | 1 Mitel | 2 Mivoice 5330e, Mivoice 5330e Firmware | 2024-02-28 | 10.0 HIGH | 9.8 CRITICAL |
The Mitel MiVoice 5330e VoIP device is affected by memory corruption flaws in the SIP/SDP packet handling functionality. An attacker can exploit this issue remotely, by sending a particular pattern of SIP/SDP packets, to cause a denial of service state in the affected devices and probably remote code execution. | |||||
CVE-2018-5781 | 1 Mitel | 2 Connect Onsite, St14.2 | 2024-02-28 | 10.0 HIGH | 9.8 CRITICAL |
A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vendrecording.php page. Successful exploit could allow an attacker to execute arbitrary PHP code within the context of the application. | |||||
CVE-2018-3639 | 12 Arm, Canonical, Debian and 9 more | 321 Cortex-a, Ubuntu Linux, Debian Linux and 318 more | 2024-02-28 | 2.1 LOW | 5.5 MEDIUM |
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. | |||||
CVE-2018-9102 | 1 Mitel | 2 Mivoice Connect, St 14.2 | 2024-02-28 | 4.3 MEDIUM | 6.5 MEDIUM |
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allow an attacker to extract sensitive information from the database. | |||||
CVE-2018-9103 | 1 Mitel | 2 Mivoice Connect, St 14.2 | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts. | |||||
CVE-2018-5782 | 1 Mitel | 2 Connect Onsite, St14.2 | 2024-02-28 | 10.0 HIGH | 9.8 CRITICAL |
A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vsethost.php page. Successful exploit could allow an attacker to execute arbitrary PHP code within the context of the application. | |||||
CVE-2018-5780 | 1 Mitel | 2 Connect Onsite, St14.2 | 2024-02-28 | 10.0 HIGH | 9.8 CRITICAL |
A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vnewmeeting.php page. Successful exploit could allow an attacker to execute arbitrary PHP code within the context of the application. |