CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25597
https://notcve.org/view.php?id=CVE-2023-25597
A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information. • https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0002 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22854
https://notcve.org/view.php?id=CVE-2023-22854
The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information. • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0001 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41326
https://notcve.org/view.php?id=CVE-2022-41326
The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application. El componente de conferencia web de Mitel MiCollab hasta la versión 9.6.0.13 podría permitir que un atacante no autenticado cargue scripts arbitrarios debido a controles de autorización inadecuados. Un exploit exitoso podría permitir la ejecución remota de código dentro del contexto de la aplicación. • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0009 •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-40765 – Mitel MiVoice Connect Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2022-40765
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters. Una vulnerabilidad en el componente Edge Gateway de Mitel MiVoice Connect hasta la versión 19.3 (22.22.6100.0) podría permitir que un atacante autenticado con acceso a la red interna lleve a cabo un ataque de inyección de comandos, debido a una restricción insuficiente de los parámetros de URL. The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41223 – Mitel MiVoice Connect Code Injection Vulnerability
https://notcve.org/view.php?id=CVE-2022-41223
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type. El componente de base de datos Director de MiVoice Connect hasta la versión 19.3 (22.22.6100.0) podría permitir a un atacante autenticado realizar un ataque de inyección de código a través de datos manipulados debido a restricciones insuficientes en el tipo de datos de la base de datos. The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008 • CWE-94: Improper Control of Generation of Code ('Code Injection') •