nchsoftware vulnerabilities

Products

• axon pbx 10
• quorum 8
• ivm attendant 7
• express invoice 4
• express accounts 2
• express accounts accounting 1
• meo encryption software 1
• webdictate 1

Latest nchsoftware CVEs

Newest publication first · page 1 of 2

1. CVE-2021-37442 NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.

   Published 2021-07-25

   Medium·CVSS 6.5

   NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.

2. CVE-2021-37443 NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.

   Published 2021-07-25

   High·CVSS 8.1

   NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.

3. CVE-2021-37444 NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows...

   Published 2021-07-25

   High·CVSS 8.8

   NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file fo...

4. CVE-2021-37445 In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.

   Published 2021-07-25

   Medium·CVSS 6.5

   In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.

5. CVE-2021-37446 In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.

   Published 2021-07-25

   Medium·CVSS 4.3

   In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.

6. CVE-2021-37447 In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.

   Published 2021-07-25

   High·CVSS 8.1

   In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.

7. CVE-2021-37448 Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).

   Published 2021-07-25

   Medium·CVSS 5.4

   Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).

8. CVE-2021-37449 Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).

   Published 2021-07-25

   Medium·CVSS 5.4

   Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).

9. CVE-2021-37450 Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).

   Published 2021-07-25

   Medium·CVSS 5.4

   Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).

10. CVE-2021-37451 Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).

11. CVE-2021-37453 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).

12. CVE-2021-37454 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).

13. CVE-2021-37455 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).

14. CVE-2021-37456 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).

15. CVE-2021-37457 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).

16. CVE-2021-37458 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).

17. CVE-2021-37459 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).

18. CVE-2021-37460 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).

19. CVE-2021-37461 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).

20. CVE-2021-37462 Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).

    Published 2021-07-25

    Medium·CVSS 5.4

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).

21. CVE-2021-37463 In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).

22. CVE-2021-37464 In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).

    Published 2021-07-25

    Medium·CVSS 5.4

    In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).

23. CVE-2021-37465 In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).

    Published 2021-07-25

    Medium·CVSS 5.4

    In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).

24. CVE-2021-37466 In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).

    Published 2021-07-25

    Medium·CVSS 5.4

    In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).

25. CVE-2021-37467 In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).

    Published 2021-07-25

    Medium·CVSS 5.4

    In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.