CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31458
https://notcve.org/view.php?id=CVE-2023-31458
24 May 2023 — A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands. • https://www.mitel.com/support/security-advisories •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31459
https://notcve.org/view.php?id=CVE-2023-31459
24 May 2023 — A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands. • https://www.mitel.com/support/security-advisories • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31460
https://notcve.org/view.php?id=CVE-2023-31460
24 May 2023 — A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters. • https://www.mitel.com/support/security-advisories • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-40765 – Mitel MiVoice Connect Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2022-40765
22 Nov 2022 — A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters. Una vulnerabilidad en el componente Edge Gateway de Mitel MiVoice Connect hasta la versión 19.3 (22.22.6100.0) podría permitir que un atacante autenticado con acceso a la red interna lleve a cabo un ataque de inyección de comandos, debido a una restricción... • https://www.mitel.com/support/security-advisories • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41223 – Mitel MiVoice Connect Code Injection Vulnerability
https://notcve.org/view.php?id=CVE-2022-41223
22 Nov 2022 — The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type. El componente de base de datos Director de MiVoice Connect hasta la versión 19.3 (22.22.6100.0) podría permitir a un atacante autenticado realizar un ataque de inyección de código a través de datos manipulados debido a restricciones insuficientes en el tipo de datos de la base de da... • https://www.mitel.com/support/security-advisories • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 0CVE-2022-29499 – Mitel MiVoice Connect Data Validation Vulnerability
https://notcve.org/view.php?id=CVE-2022-29499
26 Apr 2022 — The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA. El componente Service Appliance en Mitel MiVoice Connect versiones hasta 19.2 SP3, permite una ejecución de código remota debido a una comprobación incorrecta de los datos. Los Service Appliances son SA 100, SA 400 y Virtual SA The Service Appliance component in Mitel MiVoice Connect allows remote code executio... • https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 0CVE-2020-12456
https://notcve.org/view.php?id=CVE-2020-12456
26 Aug 2020 — A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform directory traversal, and execute arbitrary scripts in the context of the Connect client. Una vulnerabilidad de ejecución de código remota en Mitel MiVoice Connect Client versiones anteriores a 214.100.1223.0, podrí... • https://www.mitel.com/support/security-advisories • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12679
https://notcve.org/view.php?id=CVE-2020-12679
07 May 2020 — A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php. Una vulnerabilidad de tipo cross-site scripting (XSS) reflejado en la Mitel ShoreTel Conference Web Application versión 19.50.1000.0 antes de MiVoice Connect versión 18.7 SP2, permite a atacantes remotos inyectar JavaScript y HTML arbitrario por medio del PATH_INFO en e... • https://gist.github.com/kampji/5ade2d15817650a725aa89fa2e6e4752 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10377
https://notcve.org/view.php?id=CVE-2020-10377
17 Apr 2020 — A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access to user credentials. A successful exploit could allow an attacker to access the system with compromised user credentials. Una vulnerabilidad de cifrado débil en Mitel MiVoice Connect Client versiones anteriores a 214.100.1214.0, podría permitir a un atacante no autenticado acceder a las credenciales de usuario. Una explotación con éxito podría permitir a un atacante ac... • https://www.mitel.com/support/security-advisories • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2020-10211
https://notcve.org/view.php?id=CVE-2020-10211
17 Apr 2020 — A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive information. Una vulnerabilidad de ejecución de código remota en el componente UCB de Mitel MiVoice Connect versiones anteriores a 19.1, SP1, podría permitir a un atacante no autenticado remoto ejecutar scripts arbitr... • https://www.mitel.com/support/security-advisories • CWE-20: Improper Input Validation •