Vendor

Nch

Products

CVEs

Across products

Status

Private

Products

Axon PBX
12 CVEs
Quorum
9 CVEs
IVM Attendant
6 CVEs
WebDictate
2 CVEs
Axon Virtual Pbx
1 CVE
NCH Software
1 CVE
Reflect CRM
1 CVE

Recent CVEs

View all 31 CVEs →

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2021-37441	Nch Axon PBX	Hig	0.57	8.8	0.01	Jul 25, 2021	NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.
CVE-2021-37447	Nch Quorum	Hig	0.53	8.1	0.02	Jul 25, 2021	In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
CVE-2021-37443	Nch IVM Attendant	Hig	0.53	8.1	0.01	Jul 25, 2021	NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
CVE-2021-37445	Nch Quorum	Med	0.42	6.5	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
CVE-2021-37442	Nch IVM Attendant	Med	0.42	6.5	0.01	Jul 25, 2021	NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
CVE-2021-37440	Nch Axon PBX	Med	0.42	6.5	0.01	Jul 25, 2021	NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.
CVE-2021-37469	Nch WebDictate	Med	0.42	6.5	0.01	Jul 25, 2021	In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem.
CVE-2021-37452	Nch Quorum	Med	0.36	5.5	0.00	Jul 25, 2021	NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.
CVE-2021-37449	Nch IVM Attendant	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
CVE-2021-37448	Nch IVM Attendant	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
CVE-2021-37470	Nch WebDictate	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
CVE-2021-37467	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
CVE-2021-37466	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
CVE-2021-37465	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
CVE-2021-37464	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
CVE-2021-37463	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
CVE-2021-37462	Nch Axon PBX	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
CVE-2021-37461	Nch Axon PBX	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
CVE-2021-37460	Nch Axon PBX	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
CVE-2021-37459	Nch Axon PBX	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).

CVE-2021-37441HigJul 25, 2021
Nch
Axon PBX
risk 0.57cvss 8.8epss 0.01
NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.
CVE-2021-37447HigJul 25, 2021
Nch
Quorum
risk 0.53cvss 8.1epss 0.02
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
CVE-2021-37443HigJul 25, 2021
Nch
IVM Attendant
risk 0.53cvss 8.1epss 0.01
NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
CVE-2021-37445MedJul 25, 2021
Nch
Quorum
risk 0.42cvss 6.5epss 0.01
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
CVE-2021-37442MedJul 25, 2021
Nch
IVM Attendant
risk 0.42cvss 6.5epss 0.01
NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
CVE-2021-37440MedJul 25, 2021
Nch
Axon PBX
risk 0.42cvss 6.5epss 0.01
NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.
CVE-2021-37469MedJul 25, 2021
Nch
WebDictate
risk 0.42cvss 6.5epss 0.01
In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem.
CVE-2021-37452MedJul 25, 2021
Nch
Quorum
risk 0.36cvss 5.5epss 0.00
NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.
CVE-2021-37449MedJul 25, 2021
Nch
IVM Attendant
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
CVE-2021-37448MedJul 25, 2021
Nch
IVM Attendant
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
CVE-2021-37470MedJul 25, 2021
Nch
WebDictate
risk 0.35cvss 5.4epss 0.01
In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
CVE-2021-37467MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
CVE-2021-37466MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
CVE-2021-37465MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
CVE-2021-37464MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
CVE-2021-37463MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
CVE-2021-37462MedJul 25, 2021
Nch
Axon PBX
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
CVE-2021-37461MedJul 25, 2021
Nch
Axon PBX
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
CVE-2021-37460MedJul 25, 2021
Nch
Axon PBX
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
CVE-2021-37459MedJul 25, 2021
Nch
Axon PBX
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).

View all 31 CVEs →