Mitel
Mitel Mivoice Connect: vulnerabilidades y CVE
Mitel Mivoice Connect tiene 23 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 5 son críticas y 3 figuran en el catálogo de explotación activa de CISA.
CVE23
Últimos 12 meses0
Críticas5
Explotadas activamente3
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-41223 | Media (6.8) | 11% | ⚠ Explotación activa | 22 nov 2022 | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database… |
| CVE-2022-40765 | Media (6.8) | 11% | ⚠ Explotación activa | 22 nov 2022 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to… |
| CVE-2022-29499 | Crítica (9.8) | 55% | ⚠ Explotación activa | 26 abr 2022 | The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-39285 | Media (4.3) | 0.28% | — | 14 sept 2023 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient… |
| CVE-2023-39291 | Media (4.9) | 0.56% | — | 25 ago 2023 | A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper… |
| CVE-2023-39290 | Media (4.9) | 0.56% | — | 25 ago 2023 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to… |
| CVE-2023-39289 | Alta (7.5) | 0.59% | — | 25 ago 2023 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A… |
| CVE-2023-39288 | Media (5.5) | 0.61% | — | 25 ago 2023 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command… |
| CVE-2023-39287 | Media (5.5) | 0.61% | — | 25 ago 2023 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges and internal network access to conduct a command… |
| CVE-2023-32748 | Crítica (9.8) | 0.90% | — | 14 ago 2023 | The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control. |
| CVE-2023-31458 | Crítica (9.8) | 0.92% | — | 24 may 2023 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with… |
| CVE-2023-25599 | Alta (7.4) | 0.62% | — | 24 may 2023 | A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient… |
| CVE-2023-31460 | Alta (7.2) | 1.7% | — | 24 may 2023 | A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due… |
| CVE-2023-31459 | Alta (8.8) | 0.39% | — | 24 may 2023 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with… |
| CVE-2023-31457 | Crítica (9.8) | 0.99% | — | 24 may 2023 | A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary… |
| CVE-2023-25598 | Media (6.1) | 0.41% | — | 24 may 2023 | A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting… |
| CVE-2022-41223 | Media (6.8) | 11% | ⚠ Explotación activa | 22 nov 2022 | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database… |
| CVE-2022-40765 | Media (6.8) | 11% | ⚠ Explotación activa | 22 nov 2022 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to… |
| CVE-2022-29499 | Crítica (9.8) | 55% | ⚠ Explotación activa | 26 abr 2022 | The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA. |
| CVE-2020-12679 | Media (6.1) | 0.77% | — | 7 may 2020 | A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the… |
| CVE-2020-10211 | Crítica (9.8) | 3.0% | — | 17 abr 2020 | A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL… |
| CVE-2018-3639 | Media (5.5) | 61% | — | 22 may 2018 | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an… |
| CVE-2018-9104 | Media (6.1) | 1.1% | — | 25 abr 2018 | A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated… |
| CVE-2018-9103 | Media (6.1) | 1.1% | — | 25 abr 2018 | A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated… |
| CVE-2018-9102 | Media (6.5) | 1.1% | — | 25 abr 2018 | A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated… |
| CVE-2018-9101 | Media (6.1) | 1.1% | — | 25 abr 2018 | A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.