Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
52 results · page 1 of 2
Aug 8, 2025A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conducCVE-2025-52914 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conductCVE-2025-52913 · Other software · reported by MITRECritical 9.8
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Mitel MiCollab Path Traversal VulnerabilityCVE-2024-55550 · Email & office · Mitel · reported by MITREExploitedRansomwareLow 2.7
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
- Product
- MiCollab
- On CISA’s list since
- Jan 7, 2025 (federal fix deadline Jan 28, 2025)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmitel.commitel.com
Oct 21, 2024A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attackCVE-2024-47224 · Email & office · Mitel · reported by MITREMedium 6.5
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0CVE-2024-41714 · Email & office · mitel · reported by MITREHigh 8.8
A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Mitel MiCollab Path Traversal VulnerabilityCVE-2024-41713 · Email & office · Mitel · reported by MITREExploitedRansomwareCritical 9.1
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
- Product
- MiCollab
- On CISA’s list since
- Jan 7, 2025 (federal fix deadline Jan 28, 2025)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmitel.comcisa.gov
Oct 21, 2024A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack,CVE-2024-41712 · Email & office · mitel · reported by MITREMedium 6.6
A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system within the context of the user.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an auCVE-2024-35315 · Email & office · mitel · reported by MITREMedium 5.6
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker to run arbitrary code with elevated privileges.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unCVE-2024-35314 · Email & office · mitel · reported by MITRECritical 9.8
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administCVE-2024-35287 · Email & office · mitel · reported by MITREMedium 6.7
A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insuffCVE-2024-35286 · Email & office · mitel · reported by MITRECritical 9.8
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to inCVE-2024-35285 · Email & office · mitel · reported by MITRECritical 9.8
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.
- Product
- micollab_nupoint_messanger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative priviCVE-2024-30160 · Email & office · Mitel · reported by MITREMedium 4.8
A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to coCVE-2024-30159 · Email & office · Mitel · reported by MITREMedium 4.8
A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored Cross-Site Scripting (XSS) attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to coCVE-2024-30158 · Email & office · mitel · reported by MITREHigh 7.2
A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative priviCVE-2024-30157 · Email & office · mitel · reported by MITREHigh 7.2
A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacCVE-2024-47912 · Email & office · mitel · reported by MITREHigh 8.2
A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to access and delete sensitive information.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attackCVE-2024-47223 · Email & office · mitel · reported by MITRECritical 9.4
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and execute arbitrary SQL database commands.
- Product
- micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attaCVE-2024-47189 · Email & office · Mitel · reported by MITREHigh 7.7
The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of specific details to access non-sensitive user provisioning information and execute arbitrary SQL database commands.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafCVE-2023-25597 · Email & office · Mitel · reported by MITREMedium 5.9
A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorizatCVE-2022-41326 · Email & office · Mitel · reported by MITRECritical 9.8
The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files.CVE-2022-36452 · Email & office · Mitel · reported by MITRECritical 9.8
A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to iCVE-2022-36454 · Email & office · Mitel · reported by MITREMedium 6.5
A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to impersonate another user's name.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters duCVE-2022-36453 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to control another extension number.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side RequeCVE-2022-36451 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage connections and permissions available to the host server.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
- Product
- MiCollab, MiVoice Business Express
- On CISA’s list since
- Mar 25, 2022 (federal fix deadline Apr 15, 2022)
- What to do
- Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogarstechnica.comblog.cloudflare.com
Aug 13, 2021The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application dataCVE-2021-32072 · Email & office · Mitel · reported by MITREMedium 6.5
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to insufficient output sanitization. A successful exploit could allow an attacker to view source code methods.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control.CVE-2021-32071 · Email & office · Mitel · reported by MITRECritical 9.8
The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful exploit could allow an attacker to view and modify application data, and cause a denial of service for users.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response.CVE-2021-32070 · Email & office · Mitel · reported by MITREMedium 5.4
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response. A successful exploit could allow an attacker to modify the browser header and redirect users.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation.CVE-2021-32069 · Email & office · Mitel · reported by MITREMedium 4.8
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple seCVE-2021-32068 · Email & office · Mitel · reported by MITRELow 3.7
The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests, due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to CVE-2021-32067 · Email & office · Mitel · reported by MITREMedium 6.5
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary direcCVE-2021-27402 · Email & office · Mitel · reported by MITREMedium 6.5
The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due CVE-2021-27401 · Email & office · Mitel · reported by MITREMedium 6.1
The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS).
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2021A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user dataCVE-2020-35547 · Email & office · Mitel · reported by MITRECritical 9.1
A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to iCVE-2020-27340 · Email & office · Mitel · reported by MITREMedium 6.1
The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control.CVE-2020-25612 · Email & office · Mitel · reported by MITREMedium 4.9
The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control. Successful exploit could potentially allow an attacker to gain access to sensitive information.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input valCVE-2020-25611 · Email & office · Mitel · reported by MITREMedium 6.1
The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input validation, aka XSS. Successful exploitation could allow an attacker to view user conference information.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference codeCVE-2020-25610 · Email & office · Mitel · reported by MITREMedium 5.3
The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference codes.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validatioCVE-2020-25609 · Email & office · Mitel · reported by MITREMedium 5.4
The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection.CVE-2020-25608 · Email & office · Mitel · reported by MITREHigh 7.2
The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, akCVE-2020-25606 · Email & office · Mitel · reported by MITREMedium 6.1
The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, aka XSS.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2020An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could aCVE-2020-11797 · Email & office · Mitel · reported by MITREHigh 7.5
An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit could allow an attacker to access sensitive shared files.
- Product
- Micollab Audio, Web & Video Conferencing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2020The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the impropeCVE-2020-13863 · Email & office · Mitel · reported by MITREHigh 8.1
The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2020The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access controlCVE-2020-13767 · Email & office · Mitel · reported by MITREMedium 5.9
The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control. An exploit requires a rooted iOS device, and (if successful) could allow an attacker to gain access to sensitive information,
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access CVE-2020-11798 · Email & office · Mitel · reported by MITREMedium 5.3
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
- Product
- Micollab Audio, Web & Video Conferencing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.commitel.com
Mar 2, 2020A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficienCVE-2019-19608 · Email & office · Mitel · reported by MITRECritical 9.8
A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the registeredList.cgi page. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
- Product
- Micollab Audio, Web & Video Conferencing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2020A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient iCVE-2019-19607 · Email & office · Mitel · reported by MITRECritical 9.8
A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the session parameter. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
- Product
- Micollab Audio, Web & Video Conferencing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2020A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conCVE-2019-19371 · Email & office · Mitel · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the join meeting interface. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Micollab Audio, Web & Video Conferencing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2020A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenCVE-2019-19370 · Email & office · Mitel · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the file upload interface. A successful exploit could allow an attacker to execute arbitrary scripts.
- Product
- Micollab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.