Skip to content
OpenAdvisories

Archive

25 July 2021

Vulnerabilities first published on this day (UTC), newest first.

← June 2021 2021 / July /25 August 2021 →
  1. 157
  2. 263
  3. 3 
  4. 4 
  5. 56
  6. 626
  7. 7108
  8. 866
  9. 961
  10. 102
  11. 115
  12. 1288
  13. 13139
  14. 14172
  15. 1583
  16. 1657
  17. 175
  18. 181
  19. 1961
  20. 20174
  21. 2185
  22. 2290
  23. 2320
  24. 241
  25. 2534
  26. 2662
  27. 2740
  28. 2828
  29. 2928
  30. 3016
  31. 316
All Critical High Medium Low Exploited only Public exploit

34 results · Feed

  • Unscored —
    CVE-2021-37439

    NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.

  • Unscored —
    CVE-2021-37440

    NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.

  • Unscored —
    CVE-2021-37441

    NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.

  • Unscored —
    CVE-2021-37442

    NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.

  • Unscored —
    CVE-2021-37443

    NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.

  • Unscored —
    CVE-2021-37444

    NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive…

  • Unscored —
    CVE-2021-37445

    In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file readin…

  • Unscored —
    CVE-2021-37446

    In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file r…

  • Unscored —
    CVE-2021-37447

    In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file…

  • Unscored —
    CVE-2021-37448

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).

  • Unscored —
    CVE-2021-37449

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).

  • Unscored —
    CVE-2021-37450

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).

  • Unscored —
    CVE-2021-37451

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).

  • Unscored —
    CVE-2021-37452

    NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading th…

  • Unscored —
    CVE-2021-37453

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).

  • Unscored —
    CVE-2021-37454

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).

  • Unscored —
    CVE-2021-37455

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).

  • Unscored —
    CVE-2021-37456

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).

  • Unscored —
    CVE-2021-37457

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).

  • Unscored —
    CVE-2021-37458

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).

  • Unscored —
    CVE-2021-37459

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).

  • Unscored —
    CVE-2021-37460

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).

  • Unscored —
    CVE-2021-37461

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).

  • Unscored —
    CVE-2021-37462

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).

  • Unscored —
    CVE-2021-37463

    In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).

  • Unscored —
    CVE-2021-37464

    In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).

  • Unscored —
    CVE-2021-37465

    In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).

  • Unscored —
    CVE-2021-37466

    In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).

  • Unscored —
    CVE-2021-37467

    In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).

  • Unscored —
    CVE-2021-37468

    NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration fil…

  • Unscored —
    CVE-2021-37469

    In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the…

  • Unscored —
    CVE-2021-37470

    In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated use…

  • Medium 5.3
    CVE-2021-3663

    Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii

    firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts

    firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  • Medium 5.3
    CVE-2021-23413

    Denial of Service (DoS)

    This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

    jszip node-jszip node-jszip Debian Ubuntu npm