CVEs published July 25, 2021
34 CVEs were published on July 25, 2021: 0 critical, 0 high.
- Published
- 34
- Critical
- 0
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- firefly-iii/firefly-iii · grumpydictator/firefly-iii
- 1
- jszip
- 1
Medium, low and unrated 34
- CVE-2021-37439NCH FlexiServer v6.00 suffers from a syslog?file=/..
- CVE-2021-37440NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/..
- CVE-2021-37441NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/..
- CVE-2021-37442NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/..
- CVE-2021-37443NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
- CVE-2021-37444NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive.
- CVE-2021-37445In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/..
- CVE-2021-37446In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/..
- CVE-2021-37447In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/..
- CVE-2021-37448Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
- CVE-2021-37449Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
- CVE-2021-37450Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
- CVE-2021-37451Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
- CVE-2021-37452NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configur
- CVE-2021-37453Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
- CVE-2021-37454Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
- CVE-2021-37455Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
- CVE-2021-37456Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
- CVE-2021-37457Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
- CVE-2021-37458Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
- CVE-2021-37459Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
- CVE-2021-37460Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
- CVE-2021-37461Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
- CVE-2021-37462Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
- CVE-2021-37463In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
- CVE-2021-37464In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
- CVE-2021-37465In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
- CVE-2021-37466In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
- CVE-2021-37467In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
- CVE-2021-37468NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files.
- CVE-2021-37469In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/..
- CVE-2021-37470In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field.
- CVE-2021-3663Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-23413Denial of Service (DoS)jszip