nchsoftware vulnerabilities

Recent CVEs affecting nchsoftware products. 34 tracked.

nchsoftware has 34 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 29. Most recent: 2021-07-25. Highest priority: CVE-2020-11561 (score 56/100).

CVE-2021-37470 MEDIUM 5.4 UPGRADE In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field
CVE-2021-37467 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
CVE-2021-37466 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
CVE-2021-37465 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
CVE-2021-37464 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
CVE-2021-37463 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
CVE-2021-37462 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
CVE-2021-37461 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected)
CVE-2021-37460 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
CVE-2021-37459 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
CVE-2021-37458 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
CVE-2021-37457 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
CVE-2021-37456 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
CVE-2021-37455 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
CVE-2021-37454 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
CVE-2021-37453 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
CVE-2021-37451 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
CVE-2021-37450 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
CVE-2021-37449 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
CVE-2021-37448 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
CVE-2021-37447 HIGH 8.1 UPGRADE In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.
CVE-2021-37446 MEDIUM 4.3 UPGRADE In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.
CVE-2021-37445 MEDIUM 6.5 UPGRADE In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.
CVE-2021-37444 HIGH 8.8 UPGRADE NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZI
CVE-2021-37443 HIGH 8.1 UPGRADE NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file
CVE-2021-37442 MEDIUM 6.5 UPGRADE NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.
CVE-2020-13476 MEDIUM 4.8 UPGRADE NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.
CVE-2020-13474 MEDIUM 6.5 UPGRADE In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to acces
CVE-2020-13473 MEDIUM 5.5 UPGRADE NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the con
CVE-2020-11561 HIGH 8.8 DOWNGRADE In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-priv
CVE-2020-11560 HIGH 7.8 DOWNGRADE NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration fi
CVE-2019-16330 MEDIUM 5.4 DOWNGRADE In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Order
CVE-2019-16282 MEDIUM 5.4 DOWNGRADE In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Qu
CVE-2010-5220 MEDIUM 6.9 DOWNGRADE Untrusted search path vulnerability in MEO Encryption Software 2.02 allows local users to gain privileges via

FAQ

How do I fix nchsoftware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is nchsoftware being exploited right now?

None of the tracked nchsoftware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which nchsoftware CVE should I patch first?

CVE-2020-11561 currently ranks highest (56/100): In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-priv.

Products

RSS feed for nchsoftware · ← Back to latest CVEs