🚨 CVE-2021-37454
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
🎖@cveNotify
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
🎖@cveNotify
www.nch.com.au
Axon Virtual VoIP PBX & SIP Server Software for Businesses
Axon Virtual SIP-enabled PBX Software works as a full featured telephone switch for small business and call center environments for analog or VoIP.
🚨 CVE-2021-37453
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
🎖@cveNotify
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
🎖@cveNotify
www.nch.com.au
Axon Virtual VoIP PBX & SIP Server Software for Businesses
Axon Virtual SIP-enabled PBX Software works as a full featured telephone switch for small business and call center environments for analog or VoIP.
🚨 CVE-2021-37452
NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.
🎖@cveNotify
NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.
🎖@cveNotify
www.nch.com.au
Telephone Conference Calling Software - Free Download
Quickly download this professional telephone conference server to quickly and easily create and use conference calling. All you need is a telephone and the internet.
🚨 CVE-2021-37451
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
🎖@cveNotify
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
🎖@cveNotify
GitHub
poc/IVM_5.12_XSS.md at main · 0xfml/poc
advisories/bugs/exploits/pocs etc. Contribute to 0xfml/poc development by creating an account on GitHub.
🚨 CVE-2021-37450
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
🎖@cveNotify
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
🎖@cveNotify
GitHub
poc/IVM_5.12_XSS.md at main · 0xfml/poc
advisories/bugs/exploits/pocs etc. Contribute to 0xfml/poc development by creating an account on GitHub.
🚨 CVE-2021-37439
NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.
🎖@cveNotify
NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.
🎖@cveNotify
GitHub
poc/Flexiserver_6.00_LFI.md at main · 0xfml/poc
advisories/bugs/exploits/pocs etc. Contribute to 0xfml/poc development by creating an account on GitHub.
🚨 CVE-2021-37449
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
🎖@cveNotify
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
🎖@cveNotify
GitHub
poc/IVM_5.12_XSS.md at main · 0xfml/poc
advisories/bugs/exploits/pocs etc. Contribute to 0xfml/poc development by creating an account on GitHub.
🚨 CVE-2021-37448
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
🎖@cveNotify
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
🎖@cveNotify
GitHub
poc/IVM_5.12_XSS.md at main · 0xfml/poc
advisories/bugs/exploits/pocs etc. Contribute to 0xfml/poc development by creating an account on GitHub.
🚨 CVE-2021-37447
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
🎖@cveNotify
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
🎖@cveNotify
www.nch.com.au
Telephone Conference Calling Software - Free Download
Quickly download this professional telephone conference server to quickly and easily create and use conference calling. All you need is a telephone and the internet.
🚨 CVE-2021-37446
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
🎖@cveNotify
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
🎖@cveNotify
www.nch.com.au
Telephone Conference Calling Software - Free Download
Quickly download this professional telephone conference server to quickly and easily create and use conference calling. All you need is a telephone and the internet.
🚨 CVE-2021-37445
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
🎖@cveNotify
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
🎖@cveNotify
www.nch.com.au
Telephone Conference Calling Software - Free Download
Quickly download this professional telephone conference server to quickly and easily create and use conference calling. All you need is a telephone and the internet.
🚨 CVE-2021-37444
NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function.
🎖@cveNotify
NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function.
🎖@cveNotify
www.nch.com.au
IVM Free Voicemail, Call Attendant & IVR Phone Software
IVM is a powerful IVR software for interactive voice response, voicemail & call attendant phone systems; supporting caller ID logging and multi-line support.
🚨 CVE-2021-37443
NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
🎖@cveNotify
NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
🎖@cveNotify
www.nch.com.au
IVM Free Voicemail, Call Attendant & IVR Phone Software
IVM is a powerful IVR software for interactive voice response, voicemail & call attendant phone systems; supporting caller ID logging and multi-line support.
🚨 CVE-2021-37442
NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
🎖@cveNotify
NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
🎖@cveNotify
www.nch.com.au
IVM Free Voicemail, Call Attendant & IVR Phone Software
IVM is a powerful IVR software for interactive voice response, voicemail & call attendant phone systems; supporting caller ID logging and multi-line support.
🚨 CVE-2021-35516
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
🎖@cveNotify
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
🎖@cveNotify
🚨 CVE-2021-35517
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
🎖@cveNotify
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
🎖@cveNotify
🚨 CVE-2021-31859
Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream.
🎖@cveNotify
Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream.
🎖@cveNotify
Ysoft
Build Better Ways of Working | Y Soft
Y Soft provides intelligent enterprise office solutions that help businesses and their people build better ways of working now and for the future.
🚨 CVE-2020-15496
Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
🎖@cveNotify
Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
🎖@cveNotify
🚨 CVE-2021-35030
A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.
🎖@cveNotify
A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.
🎖@cveNotify
Zyxel
Zyxel security advisory for XSS vulnerability of GS1900 series switches | Zyxel
Zyxel has released hotfixes addressing a cross-site scripting (XSS) vulnerability in the GS1900 series of switches and will include the patch in its next regular firmware update in October. Users are advised to install the applicable firmware updates for…
🚨 CVE-2021-22144
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
🎖@cveNotify
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
🎖@cveNotify
Discuss the Elastic Stack
Elasticsearch 7.13.3 and 6.8.17 Security Update
Elasticsearch Denial of Service issue (ESA-2021-15) An uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch…