CVE-2021-37449 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected). |
CVE-2021-37448 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored). |
CVE-2021-37447 | High | 8.1 | 2021-07-25 | In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion. |
CVE-2021-37446 | Medium | 4.3 | 2021-07-25 | In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading. |
CVE-2021-37445 | Medium | 6.5 | 2021-07-25 | In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading. |
CVE-2021-37444 | High | 8.8 | 2021-07-25 | NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a Z… |
CVE-2021-37443 | High | 8.1 | 2021-07-25 | NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion. |
CVE-2021-37442 | Medium | 6.5 | 2021-07-25 | NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files. |
CVE-2021-37470 | Medium | 5.4 | 2021-07-25 | In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field t… |
CVE-2021-37467 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected). |
CVE-2021-37466 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected). |
CVE-2021-37465 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected). |
CVE-2021-37464 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored). |
CVE-2021-37463 | Medium | 5.4 | 2021-07-25 | In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored). |
CVE-2021-37462 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected). |
CVE-2021-37461 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected). |
CVE-2021-37460 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected). |
CVE-2021-37459 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored). |
CVE-2021-37458 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored). |
CVE-2021-37457 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored). |
CVE-2021-37456 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored). |
CVE-2021-37455 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored). |
CVE-2021-37454 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored). |
CVE-2021-37453 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored). |
CVE-2021-37451 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected). |
CVE-2021-37450 | Medium | 5.4 | 2021-07-25 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected). |
CVE-2020-13476 | Medium | 4.8 | 2020-12-28 | NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module. |
CVE-2020-13474 | Medium | 6.5 | 2020-12-28 | In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/E… |
CVE-2020-13473 | Medium | 5.5 | 2020-12-28 | NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file. |
CVE-2020-11560 | High | 7.8 | 2020-04-07 | NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file. |
CVE-2020-11561 | High | 8.8 | 2020-04-07 | In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item"… |
CVE-2019-16330 | Medium | 5.4 | 2019-10-17 | In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenti… |
CVE-2019-16282 | Medium | 5.4 | 2019-10-14 | In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged u… |
CVE-2010-5220 | | | 2012-09-06 | Untrusted search path vulnerability in MEO Encryption Software 2.02 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current wor… |