Nchsoftware - vulnerabilities (CVEs)

34 CVEs in 8 products, 0 in the last 30 days, newest from 2021-07-25.

Products

• Axon Pbx - 10 CVEs
• Quorum - 8 CVEs
• Ivm Attendant - 7 CVEs
• Express Invoice - 4 CVEs
• Express Accounts - 2 CVEs
• Express Accounts Accounting - 1 CVEs
• Meo Encryption Software - 1 CVEs
• Webdictate - 1 CVEs

Newest CVEs of Nchsoftware

• CVE-2021-37447 - CVSS 8.1 (high), 2021-07-25: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
• CVE-2021-37448 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
• CVE-2021-37446 - CVSS 4.3 (medium), 2021-07-25: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
• CVE-2021-37444 - CVSS 8.8 (high), 2021-07-25: NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a…
• CVE-2021-37445 - CVSS 6.5 (medium), 2021-07-25: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
• CVE-2021-37443 - CVSS 8.1 (high), 2021-07-25: NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
• CVE-2021-37449 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
• CVE-2021-37442 - CVSS 6.5 (medium), 2021-07-25: NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
• CVE-2021-37464 - CVSS 5.4 (medium), 2021-07-25: In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
• CVE-2021-37467 - CVSS 5.4 (medium), 2021-07-25: In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
• CVE-2021-37459 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
• CVE-2021-37463 - CVSS 5.4 (medium), 2021-07-25: In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
• CVE-2021-37462 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
• CVE-2021-37466 - CVSS 5.4 (medium), 2021-07-25: In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
• CVE-2021-37458 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
• CVE-2021-37461 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
• CVE-2021-37465 - CVSS 5.4 (medium), 2021-07-25: In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
• CVE-2021-37470 - CVSS 5.4 (medium), 2021-07-25: In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field…
• CVE-2021-37457 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
• CVE-2021-37460 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
• CVE-2021-37453 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
• CVE-2021-37456 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
• CVE-2021-37451 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
• CVE-2021-37455 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
• CVE-2021-37450 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
• CVE-2021-37454 - CVSS 5.4 (medium), 2021-07-25: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
• CVE-2020-13473 - CVSS 5.5 (medium), 2020-12-28: NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file.
• CVE-2020-13476 - CVSS 4.8 (medium), 2020-12-28: NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.
• CVE-2020-13474 - CVSS 6.5 (medium), 2020-12-28: In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as…
• CVE-2020-11560 - CVSS 7.8 (high), 2020-04-07: NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.