CVE-2008-6797

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

The server in Mitel NuPoint Messenger R11 and R3 sends usernames and passwords in cleartext to Exchange servers, which allows remote attackers to obtain sensitive information by sniffing the network.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:C/I:N/A:N

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/576996US Government Resource
http://www.mitel.com/resources/NuPoint_and_Exchange.pdfVendor Advisory
http://www.securityfocus.com/bid/34847
http://www.kb.cert.org/vuls/id/576996US Government Resource
http://www.mitel.com/resources/NuPoint_and_Exchange.pdfVendor Advisory
http://www.securityfocus.com/bid/34847

Timeline

Published: May 7, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-67987.5Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to execute arbitrary SQL CVE-2008-67997.5connection.php in FlashChat 5.0.8 allows remote attackers to bypass the role filter mechanism and gain administrative privileges by setting CVE-2008-68014.4Cross-site request forgery (CSRF) vulnerability in Vivvo CMS before 4.0.4 allows remote attackers to hijack the authentication of unspecifie CVE-2008-68027.5Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary SQL commands via the CVE-2008-68037.5SQL injection vulnerability in diziler.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the id CVE-2008-68047.5Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the COOKIE_LAST_ADMIN_USER CVE-2008-68056.8Multiple SQL injection vulnerabilities in Mic_Blog 0.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL CVE-2008-68066.8Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary cod CVE-2008-68077.5PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL CVE-2008-68087.5SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute arbitrary SQL comma CVE-2008-68097.5SQL injection vulnerability in hotel_habitaciones.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allows remote attacker CVE-2008-68107.5Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allow remote