CVE-2021-37440

NCH Axon PBX v2.22 and earlier are affected by a path traversal vulnerability in the logprop function, where a request parameter logprop?file=/.. can disclose arbitrary files. This is a file disclosure vulnerability caused by improper handling of the dot-dot sequence and is cataloged as CVE-2021-...

CVE-2021-37441

NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring...

CVE-2021-37441

CVE-2021-37441 affects NCH Axon PBX v2.22 and earlier. The vulnerability is a path-traversal flaw in the logdelete function, exploitable via the logdelete?file=/.. parameter, enabling access to or deletion of arbitrary files outside the intended directory. The connected sources confirm the affect...

CVE-2021-37442

NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files...

CVE-2021-37442

CVE-2021-37442 affects NCH IVM Attendant v5.12 and earlier. The vulnerability is a directory traversal flaw exploitable through the parameter viewfile?file=/.., enabling an authenticated attacker to read files on the system due to improper path handling. Documents consistently describe this as a ...

CVE-2021-37443

NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion...

CVE-2021-37443

CVE-2021-37443 affects NCH IVM Attendant (Windows) and is due to a path traversal vulnerability in the logdeleteselected check0 parameter used for file deletion, allowing an attacker to delete files. Affected: NCH IVM Attendant v5.12 and earlier. Exploitation details beyond this are not provided ...

CVE-2021-37444

CVE-2021-37444 affects NCH IVM Attendant v5.12 and earlier. A directory-traversal weakness occurs when uploading plugins via ZIP archives, where a ZIP element with a pathname pointing to the Windows startup folder or to files used by built-in Out-Going Message or Autodial functions can lead to co...

CVE-2021-37444

NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt...

CVE-2021-37445

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading...

CVE-2021-37445

This entry describes a directory traversal vulnerability in NCH Quorum v2.03 and earlier. An authenticated user can read files by abusing logprop?file=/.., enabling traversal to access local files. The affected product is NCH Quorum (teleconference server software); the vulnerability is triggered...

CVE-2021-37446

Summary: CVE-2021-37446 affects NCH Quorum v2.03 and earlier, where an authenticated user can perform directory traversal via the parameter documentprop?file=/.. to read files. This is a path traversal flaw that could expose sensitive files on the remote system. Other connected sources reiterate ...

CVE-2021-37446

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading...

CVE-2021-37447

In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion...

CVE-2021-37447

CVE-2021-37447 concerns NCH Quorum v2.03 and earlier. An authenticated user can perform directory traversal via the parameter documentdelete?file=/.., enabling file deletion on the affected system. The core issue is a path traversal in a function responsible for file deletion, allowing access bey...

CVE-2021-37448

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name stored...

CVE-2021-37448

CVE-2021-37448 affects NCH IVM Attendant v5.12 and earlier. The root cause is stored XSS in the Mailbox name due to insufficient input filtering for special characters, enabling execution of client-side code. Affected software is NCH IVM Attendant; impact is cross-site scripting with potential fo...

CVE-2021-37449

CVE-2021-37449 affects NCH IVM Attendant (Windows) prior to or including v5.12. The vulnerability is a cross-site scripting (XSS) in the web interface, exploitable through the parameter /ogmlist?folder= on the IVR/attendant UI due to insufficient input validation. The CNVD/NVD entries describe an...

CVE-2021-37449

Cross Site Scripting XSS exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= reflected...

CVE-2021-37450

CVE-2021-37450 describes a reflected (and potentially stored) cross-site scripting vulnerability in NCH IVM Attendant v5.12 and earlier , exploitable via the parameter/url path /ogmprop?id= . Multiple connected sources corroborate an XSS condition caused by inadequate input validation in the IVR/...