Nchsoftware Security Vulnerabilities

CVE-2021-37445

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file...

CVE-2021-37444

NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt.....

CVE-2021-37449

Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder=...

CVE-2021-37443

NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file...

CVE-2021-37442

NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read...

CVE-2021-37447

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file...

CVE-2021-37448

Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name...

CVE-2021-37446

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file...

CVE-2021-37458

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field...

CVE-2021-37456

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address...

CVE-2021-37466

In NCH Quorum v2.03 and earlier, XSS exists via /conference?id=...

CVE-2021-37455

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan...

CVE-2021-37463

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name...

CVE-2021-37460

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id=...

CVE-2021-37450

Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id=...

CVE-2021-37453

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name...

CVE-2021-37454

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name...

CVE-2021-37459

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field...

CVE-2021-37461

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id=...

CVE-2021-37457

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field...

CVE-2021-37467

In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid=...

CVE-2021-37451

Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx=...

CVE-2021-37465

In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id=...

CVE-2021-37462

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip=...

CVE-2021-37464

In NCH Quorum v2.03 and earlier, XSS exists via Conference Description...

CVE-2021-37470

In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary...

CVE-2020-13476

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List...

CVE-2020-13473

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration...

CVE-2020-13474

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit...