MI
Product
MiCollab
On CISA KEVExploited in the wildRansomware-linked
47
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 11Medium 23Low 2
Watch
Add MiCollab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-26143 In wildKEV | 9.8 | Mar 9 | MiCollab, MiVoice Business Express Access Control Vulnerability Affected: before 9.4; 9.4; 9.4 |
| CVE-2024-41713 RansomwareIn wildKEV | 9.1 | Oct 21 | Mitel MiCollab Path Traversal Vulnerability Affected: through 9.8.1.201 |
| CVE-2014-0160 In wildKEV | 7.5 | Apr 7 | OpenSSL Information Disclosure Vulnerability Affected: 6.0; 7.0; 7.1; 7.2; 7.3; 7.3.0.104 |
| CVE-2024-55550 RansomwareIn wildKEV | 2.7 | Dec 10 | Mitel MiCollab Path Traversal Vulnerability Affected: through 9.8.1.201 |
| CVE-2024-35314 | 9.8 | Oct 21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated… Affected: through 9.7.1.110 |
| CVE-2024-35286 | 9.8 | Oct 21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization… Affected: through 9.8.0.33 |
| CVE-2024-35285 | 9.8 | Oct 21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient… Affected: through 9.8.0.33 |
| CVE-2022-41326 | 9.8 | Nov 22 | The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls Affected: through 9.6.0.105 |
| CVE-2022-36452 | 9.8 | Oct 25 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files Affected: before 9.6 |
| CVE-2021-32071 | 9.8 | Aug 13 | The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control Affected: before 9.3 |
| CVE-2019-12165 | 9.8 | May 29 | MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0… Affected: 7.1 through 7.1.0.57; 7.2 through 7.2.2.13; 7.3 through 7.3.0.204 |
| CVE-2024-47223 | 9.4 | Oct 21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL… Affected: through 9.8.1.201 |
| CVE-2020-35547 | 9.1 | Jan 29 | A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user data Affected: through 9.2 |
| CVE-2025-52914 | 8.8 | Aug 8 | A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection… Affected: before 9.8.3.103; 10.0.0.26 before 10.1.0.10 |
| CVE-2024-41714 | 8.8 | Oct 21 | A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow… Affected: through 9.8.1.5 |
| CVE-2022-36453 | 8.8 | Oct 25 | A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper… Affected: 9.1.3 through 9.5.0.101 |
| CVE-2022-36451 | 8.8 | Oct 25 | A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF)… Affected: through 9.5.0.101 |
| CVE-2024-47912 | 8.2 | Oct 21 | A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform… Affected: through 9.8.1.201 |
| CVE-2020-13863 | 8.1 | Aug 26 | The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input… Affected: before 9.1.3 |
| CVE-2024-47189 | 7.7 | Oct 21 | The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL… Affected: through 9.8.1.201 |
| CVE-2024-30158 | 7.2 | Oct 21 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL… Affected: through 9.7.1.110 |
| CVE-2024-30157 | 7.2 | Oct 21 | A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a… Affected: through 9.7.1.110 |
| CVE-2020-25608 | 7.2 | Dec 18 | The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection Affected: before 9.2 |
| CVE-2024-35287 | 6.7 | Oct 21 | A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to… Affected: through 9.8.1.5 |
| CVE-2024-41712 | 6.6 | Oct 21 | A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to… Affected: through 9.8.1.5 |
| CVE-2024-47224 | 6.5 | Oct 21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a… Affected: through 9.8.1.201 |
| CVE-2022-36454 | 6.5 | Oct 25 | A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper… Affected: through 9.5.0.101 |
| CVE-2021-32072 | 6.5 | Aug 13 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application data) due to… Affected: before 9.3 |
| CVE-2021-32067 | 6.5 | Aug 13 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output… Affected: before 9.3 |
| CVE-2021-27402 | 6.5 | Aug 13 | The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to… Affected: before 9.2; 9.2; 9.2 |
| CVE-2021-27401 | 6.1 | Aug 13 | The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient… Affected: before 9.2; 9.2; 9.2 |
| CVE-2020-27340 | 6.1 | Dec 18 | The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access… Affected: before 9.2 |
| CVE-2020-25611 | 6.1 | Dec 18 | The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input validation, aka XSS Affected: before 9.2 |
| CVE-2020-25606 | 6.1 | Dec 18 | The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, aka XSS Affected: before 9.2 |
| CVE-2019-19370 | 6.1 | Mar 2 | A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to… Affected: before 9.0.15 |
| CVE-2023-25597 | 5.9 | Apr 14 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request -… Affected: before 9.7 |
| CVE-2020-13767 | 5.9 | Aug 26 | The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control Affected: before 9.1.332 |
| CVE-2024-35315 | 5.6 | Oct 21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated… Affected: through 9.7.1.110 |
| CVE-2021-32070 | 5.4 | Aug 13 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response Affected: before 9.3 |
| CVE-2020-25609 | 5.4 | Dec 18 | The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS Affected: before 9.2 |
| CVE-2020-25610 | 5.3 | Dec 18 | The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference codes Affected: before 9.2 |
| CVE-2018-18819 | 5.3 | Nov 12 | A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice… Affected: 7.3 through 7.3.0.601; 8.0.0.40 through 8.0.2.202 |
| CVE-2020-25612 | 4.9 | Dec 18 | The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control Affected: before 9.2 |
| CVE-2024-30160 | 4.8 | Oct 21 | A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a… Affected: through 9.7.1.110 |
| CVE-2024-30159 | 4.8 | Oct 21 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a Stored… Affected: through 9.7.1.110 |
| CVE-2021-32069 | 4.8 | Aug 13 | The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation Affected: before 9.3 |
| CVE-2021-32068 | 3.7 | Aug 13 | The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation… Affected: before 9.3 |
Showing 47