# CVEs published 2021-07-25

34 CVEs were published on July 25, 2021: 0 critical, 0 high. Days are UTC.

- [CVE-2021-37439](https://cve.now/CVE-2021-37439.md): NCH FlexiServer v6.00 suffers from a syslog?file=/.. (no CVSS)
- [CVE-2021-37440](https://cve.now/CVE-2021-37440.md): NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. (no CVSS)
- [CVE-2021-37441](https://cve.now/CVE-2021-37441.md): NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. (no CVSS)
- [CVE-2021-37442](https://cve.now/CVE-2021-37442.md): NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. (no CVSS)
- [CVE-2021-37443](https://cve.now/CVE-2021-37443.md): NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion. (no CVSS)
- [CVE-2021-37444](https://cve.now/CVE-2021-37444.md): NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. (no CVSS)
- [CVE-2021-37445](https://cve.now/CVE-2021-37445.md): In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. (no CVSS)
- [CVE-2021-37446](https://cve.now/CVE-2021-37446.md): In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. (no CVSS)
- [CVE-2021-37447](https://cve.now/CVE-2021-37447.md): In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. (no CVSS)
- [CVE-2021-37448](https://cve.now/CVE-2021-37448.md): Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored). (no CVSS)
- [CVE-2021-37449](https://cve.now/CVE-2021-37449.md): Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected). (no CVSS)
- [CVE-2021-37450](https://cve.now/CVE-2021-37450.md): Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected). (no CVSS)
- [CVE-2021-37451](https://cve.now/CVE-2021-37451.md): Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected). (no CVSS)
- [CVE-2021-37452](https://cve.now/CVE-2021-37452.md): NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configur (no CVSS)
- [CVE-2021-37453](https://cve.now/CVE-2021-37453.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored). (no CVSS)
- [CVE-2021-37454](https://cve.now/CVE-2021-37454.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored). (no CVSS)
- [CVE-2021-37455](https://cve.now/CVE-2021-37455.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored). (no CVSS)
- [CVE-2021-37456](https://cve.now/CVE-2021-37456.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored). (no CVSS)
- [CVE-2021-37457](https://cve.now/CVE-2021-37457.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored). (no CVSS)
- [CVE-2021-37458](https://cve.now/CVE-2021-37458.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored). (no CVSS)
- [CVE-2021-37459](https://cve.now/CVE-2021-37459.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored). (no CVSS)
- [CVE-2021-37460](https://cve.now/CVE-2021-37460.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected). (no CVSS)
- [CVE-2021-37461](https://cve.now/CVE-2021-37461.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected). (no CVSS)
- [CVE-2021-37462](https://cve.now/CVE-2021-37462.md): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected). (no CVSS)
- [CVE-2021-37463](https://cve.now/CVE-2021-37463.md): In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored). (no CVSS)
- [CVE-2021-37464](https://cve.now/CVE-2021-37464.md): In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored). (no CVSS)
- [CVE-2021-37465](https://cve.now/CVE-2021-37465.md): In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected). (no CVSS)
- [CVE-2021-37466](https://cve.now/CVE-2021-37466.md): In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected). (no CVSS)
- [CVE-2021-37467](https://cve.now/CVE-2021-37467.md): In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected). (no CVSS)
- [CVE-2021-37468](https://cve.now/CVE-2021-37468.md): NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files. (no CVSS)
- [CVE-2021-37469](https://cve.now/CVE-2021-37469.md): In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. (no CVSS)
- [CVE-2021-37470](https://cve.now/CVE-2021-37470.md): In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. (no CVSS)
- [CVE-2021-3663](https://cve.now/CVE-2021-3663.md): Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii (CVSS 5.3, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-23413](https://cve.now/CVE-2021-23413.md): Denial of Service (DoS) (CVSS 5.3, jszip)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.