CVE-2024-35287

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-352887.8Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occu CVE-2024-35296.1A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been classified as problematic. This affects an CVE-2024-352916.1Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitra CVE-2024-352928.2A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES CVE-2024-352939.1An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devi CVE-2024-352946.5An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials.CVE-2024-352956.1A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between Apr CVE-2024-352968.2Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apach CVE-2024-352974.7Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may CVE-2024-352984.3Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to l CVE-2024-352997.5In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation CVE-2024-35306.1A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been declared as problematic. This vulnerabilit