Nchsoftware

Records34All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Nchsoftware records in CISA KEV

No Nchsoftware vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Axon Pbx 10 records LOW Quorum 8 records LOW Ivm Attendant 7 records MEDIUM Express Invoice 4 records MEDIUM Express Accounts 2 records LOW Express Accounts Accounting 1 record LOW Meo Encryption Software 1 record LOW Webdictate 1 record LOW

Records

34 records

TI-2021-15374 CVE-2021-37444 · GHSA-jxmw-mmc4-3375

NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon…

MEDIUM 42

NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01935 Published 2021-07-25 No fix listed CWE-22

TI-2020-09278 CVE-2020-11561 · GHSA-5rmh-f225-qfjh

In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL…

MEDIUM 42

In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02206 Published 2020-04-07 No fix listed CWE-425

TI-2021-15377 CVE-2021-37447 · GHSA-5f35-m38v-fx5q

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via…

LOW 38

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/..

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01584 Published 2021-07-25 No fix listed CWE-22

TI-2021-15373 CVE-2021-37443 · GHSA-98ff-8p4p-47qw

NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.

LOW 38

NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01246 Published 2021-07-25 No fix listed CWE-22

TI-2020-09277 CVE-2020-11560 · GHSA-5rwc-h8m7-5hcc

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

LOW 36

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00999 Published 2020-04-07 No fix listed CWE-522

TI-2021-15375 CVE-2021-37445 · GHSA-6c69-w7wc-qm57

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via…

LOW 32

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/..

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01431 Published 2021-07-25 No fix listed CWE-22

TI-2021-15372 CVE-2021-37442 · GHSA-83w5-49r2-whcp

NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/..

LOW 31

NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/..

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01214 Published 2021-07-25 No fix listed CWE-22

TI-2020-10568 CVE-2020-13474 · GHSA-3pjh-8rj7-xm2h

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a…

LOW 30

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00755 Published 2020-12-28 No fix listed CWE-425

TI-2010-04918 CVE-2010-5220 · GHSA-w739-7hwv-8r74

Untrusted search path vulnerability in MEO Encryption Software 2.02 allows local users to…

LOW 30

Untrusted search path vulnerability in MEO Encryption Software 2.02 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains…

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00363 Published 2012-09-06 No fix listed

TI-2021-15400 CVE-2021-37470 · GHSA-mjf7-37pm-5wf4

In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient…

LOW 25

In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00585 Published 2021-07-25 No fix listed CWE-79

TI-2021-15397 CVE-2021-37467 · GHSA-97ch-c87j-pv6w

In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).

LOW 25

In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15396 CVE-2021-37466 · GHSA-wqm2-557c-9f7f

In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).

LOW 25

In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15395 CVE-2021-37465 · GHSA-h87x-pp5f-2j2c

In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).

LOW 25

In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15394 CVE-2021-37464 · GHSA-x45v-6f95-pwxq

In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).

LOW 25

In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15393 CVE-2021-37463 · GHSA-whhr-6mwm-777h

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).

LOW 25

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15392 CVE-2021-37462 · GHSA-6vcf-779f-fqxh

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15391 CVE-2021-37461 · GHSA-cjm3-84jp-72rj

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15390 CVE-2021-37460 · GHSA-2vhc-x6qx-p838

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15389 CVE-2021-37459 · GHSA-hjqj-7pgg-p4w5

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00622 Published 2021-07-25 No fix listed CWE-79

TI-2021-15388 CVE-2021-37458 · GHSA-6q5j-v2m7-pmxq

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00622 Published 2021-07-25 No fix listed CWE-79

TI-2021-15387 CVE-2021-37457 · GHSA-mmq7-4wfx-jq6v

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00622 Published 2021-07-25 No fix listed CWE-79

TI-2021-15386 CVE-2021-37456 · GHSA-wr7f-jq3g-39hr

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15385 CVE-2021-37455 · GHSA-fvmx-p232-v8f7

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15384 CVE-2021-37454 · GHSA-xr96-frvr-5w4p

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

TI-2021-15383 CVE-2021-37453 · GHSA-68x8-8r67-v8mj

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).

LOW 25

Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00589 Published 2021-07-25 No fix listed CWE-79

Open these records in search →

Critical	0
High	5
Medium	29
Low	0
No CVSS	0