CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25597
https://notcve.org/view.php?id=CVE-2023-25597
A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information. • https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0002 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41326
https://notcve.org/view.php?id=CVE-2022-41326
The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application. El componente de conferencia web de Mitel MiCollab hasta la versión 9.6.0.13 podría permitir que un atacante no autenticado cargue scripts arbitrarios debido a controles de autorización inadecuados. Un exploit exitoso podría permitir la ejecución remota de código dentro del contexto de la aplicación. • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0009 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36454
https://notcve.org/view.php?id=CVE-2022-36454
A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to impersonate another user's name. Una vulnerabilidad en la API del cliente MiCollab de Mitel MiCollab versiones hasta 9.5.0.101, podría permitir a un atacante autenticado modificar los parámetros de su perfil debido a controles de autorización inapropiados. Una explotación con éxito podría permitir al atacante autenticado suplantar el nombre de otro usuario • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0006 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36452
https://notcve.org/view.php?id=CVE-2022-36452
A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application. Una vulnerabilidad en el componente de conferencias web de Mitel MiCollab versiones hasta 9.5.0.101, podría permitir a un atacante no autenticado descargar archivos maliciosos. Una explotación con éxito podría permitir a un atacante ejecutar código arbitrario dentro del contexto de la aplicación • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0006 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36451
https://notcve.org/view.php?id=CVE-2022-36451
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage connections and permissions available to the host server. Una vulnerabilidad en el componente del servidor MiCollab Client de Mitel MiCollab versiones hasta 9.5.0.101, podría permitir a un atacante autenticado conducir un ataque de tipo Server-Side Request Forgery (SSRF) debido a una restricción insuficiente de los parámetros de la URL. Una explotación con éxito podría permitir a un atacante aprovechar las conexiones y los permisos disponibles en el servidor anfitrión • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0006 • CWE-918: Server-Side Request Forgery (SSRF) •