Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-37402 State: PUBLISHED Published: 2021-07-22T16:19:12 Last Updated: 2024-08-04T01:16:04.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Jul/33
CVE ID: CVE-2021-37403 State: PUBLISHED Published: 2021-07-22T16:19:27 Last Updated: 2024-08-04T01:16:04.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Jul/33
CVE ID: CVE-2021-37404 State: PUBLISHED Published: 2022-06-13T07:00:16 Last Updated: 2024-08-04T01:16:03.989Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: CWE-787 Description: There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/2h56ztcj3ojc66qzf1nno88vjw9vd4wo - https://security.netapp.com/advisory/ntap-20220715-0007/
CVE ID: CVE-2021-37405 State: REJECTED Published: N/A Last Updated: 2025-02-13T16:28:26.946Z Description: No description available.
CVE ID: CVE-2021-37409 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:46:34.504Z Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products Problem Types: escalation of privilege Description: Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00002.html
CVE ID: CVE-2021-37412 State: PUBLISHED Published: 2021-09-15T16:26:03 Last Updated: 2024-08-04T01:16:03.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-040.txt
CVE ID: CVE-2021-37413 State: PUBLISHED Published: 2022-05-19T14:59:45 Last Updated: 2024-08-04T01:16:03.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login script does not verify and sanitize user-provided strings. Additional Analyst Notes: - CVE Program Container: References: - https://www.grandcom.sk - https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-37413.md
CVE ID: CVE-2021-37414 State: PUBLISHED Published: 2021-09-10T14:27:21 Last Updated: 2024-08-04T01:16:03.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/improper-access-control.html - https://www.manageengine.com/products/desktop-central/help/introduction/release_notes.html
CVE ID: CVE-2021-37415 State: PUBLISHED Published: 2021-09-01T05:29:11.000Z Last Updated: 2025-10-21T23:25:35.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com - https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302
CVE ID: CVE-2021-37416 State: PUBLISHED Published: 2021-08-30T18:18:14 Last Updated: 2024-08-04T01:16:03.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. Additional Analyst Notes: - CVE Program Container: References: - https://blog.stmcyber.com/vulns/cve-2021-37416/
CVE ID: CVE-2021-37417 State: PUBLISHED Published: 2021-08-30T18:25:43 Last Updated: 2024-08-04T01:16:04.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.stmcyber.com/vulns/cve-2021-37417/
CVE ID: CVE-2021-37418 State: REJECTED Published: 2021-09-10T14:43:36 Last Updated: 2021-09-10T14:43:36 Description: No description available.
CVE ID: CVE-2021-37419 State: PUBLISHED Published: 2021-09-21T12:53:52 Last Updated: 2024-08-04T01:16:04.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release - https://blog.stmcyber.com/vulns/cve-2021-37419/
CVE ID: CVE-2021-37420 State: PUBLISHED Published: 2021-09-21T12:52:25 Last Updated: 2024-08-04T01:16:03.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release - https://blog.stmcyber.com/vulns/cve-2021-37420/
CVE ID: CVE-2021-37421 State: PUBLISHED Published: 2021-08-30T18:30:22 Last Updated: 2024-08-04T01:16:03.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6104-released-with-an-important-security-fixes - https://blog.stmcyber.com/vulns/cve-2021-37421/
CVE ID: CVE-2021-37422 State: PUBLISHED Published: 2021-09-10T15:06:01 Last Updated: 2024-08-04T01:16:03.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release
CVE ID: CVE-2021-37423 State: PUBLISHED Published: 2021-09-10T14:55:33 Last Updated: 2024-08-04T01:16:03.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release
CVE ID: CVE-2021-37424 State: PUBLISHED Published: 2021-09-21T12:50:36 Last Updated: 2024-08-04T01:16:04.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release
CVE ID: CVE-2021-37425 State: PUBLISHED Published: 2021-08-10T21:16:31 Last Updated: 2024-08-04T01:16:03.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key. Additional Analyst Notes: - CVE Program Container: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - https://www.redteam-pentesting.de/advisories/rt-sa-2021-002 - https://www.altova.com/mobiletogether - http://seclists.org/fulldisclosure/2021/Aug/12
CVE ID: CVE-2021-37436 State: PUBLISHED Published: 2021-07-24T22:46:21 Last Updated: 2024-08-04T01:16:04.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive information via a series of complex hardware and software attacks. NOTE: reportedly, there were vendor marketing statements about safely removing personal content via a factory reset. Also, the vendor has reportedly indicated that they are working on mitigations. Additional Analyst Notes: - CVE Program Container: References: - https://arstechnica.com/gadgets/2021/07/passwords-in
s. Additional Analyst Notes: - CVE Program Container: References: - https://arstechnica.com/gadgets/2021/07/passwords-in-amazon-echo-dots-live-on-even-after-you-factory-reset-them/ - https://dl.acm.org/doi/pdf/10.1145/3448300.3467820 - https://news.ycombinator.com/item?id=27943730 - https://www.cpomagazine.com/data-privacy/is-it-possible-to-make-iot-devices-private-amazon-echo-dot-does-not-wipe-personal-content-after-factory-reset/
CVE ID: CVE-2021-37438 State: REJECTED Published: 2021-07-25T20:14:49 Last Updated: 2021-07-25T20:18:21 Description: No description available.
CVE ID: CVE-2021-37439 State: PUBLISHED Published: 2021-07-25T20:14:38 Last Updated: 2024-08-04T01:16:03.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/Flexiserver_6.00_LFI.md - https://www.nchsoftware.com/flexi/index.html
CVE ID: CVE-2021-37440 State: PUBLISHED Published: 2021-07-25T20:14:28 Last Updated: 2024-08-04T01:16:03.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md - https://www.nch.com.au/pbx/index.html
CVE ID: CVE-2021-37441 State: PUBLISHED Published: 2021-07-25T20:14:17 Last Updated: 2024-08-04T01:16:03.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_LFI.md - https://www.nch.com.au/pbx/index.html
CVE ID: CVE-2021-37442 State: PUBLISHED Published: 2021-07-25T20:14:05 Last Updated: 2024-08-04T01:16:03.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_LFI.md - https://www.nch.com.au/ivm/index.html
CVE ID: CVE-2021-37443 State: PUBLISHED Published: 2021-07-25T20:13:45 Last Updated: 2024-08-04T01:16:04.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_LFI.md - https://www.nch.com.au/ivm/index.html
CVE ID: CVE-2021-37444 State: PUBLISHED Published: 2021-07-25T20:13:36 Last Updated: 2024-08-04T01:16:03.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function. Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/ivm/index.html - https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_RCE.md
CVE ID: CVE-2021-37445 State: PUBLISHED Published: 2021-07-25T20:13:20 Last Updated: 2024-08-04T01:16:04.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md - https://www.nch.com.au/conference/index.html
CVE ID: CVE-2021-37446 State: PUBLISHED Published: 2021-07-25T20:13:10 Last Updated: 2024-08-04T01:16:03.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md - https://www.nch.com.au/conference/index.html
CVE ID: CVE-2021-37447 State: PUBLISHED Published: 2021-07-25T20:12:55 Last Updated: 2024-08-04T01:16:04.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md - https://www.nch.com.au/conference/index.html
CVE ID: CVE-2021-37448 State: PUBLISHED Published: 2021-07-25T20:12:46 Last Updated: 2024-08-04T01:16:04.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/ivm/index.html - https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE ID: CVE-2021-37449 State: PUBLISHED Published: 2021-07-25T20:12:33 Last Updated: 2024-08-04T01:16:04.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/ivm/index.html - https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE ID: CVE-2021-37450 State: PUBLISHED Published: 2021-07-25T20:12:22 Last Updated: 2024-08-04T01:16:04.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/ivm/index.html - https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE ID: CVE-2021-37451 State: PUBLISHED Published: 2021-07-25T20:12:13 Last Updated: 2024-08-04T01:16:04.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/ivm/index.html - https://github.com/0xfml/poc/blob/main/NCH/IVM_5.12_XSS.md
CVE ID: CVE-2021-37452 State: PUBLISHED Published: 2021-07-25T20:12:03 Last Updated: 2024-08-04T01:16:04.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/conference/index.html - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_CC.md
CVE ID: CVE-2021-37453 State: PUBLISHED Published: 2021-07-25T20:11:53 Last Updated: 2024-08-04T01:16:04.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37454 State: PUBLISHED Published: 2021-07-25T20:11:44 Last Updated: 2024-08-04T01:16:04.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37455 State: PUBLISHED Published: 2021-07-25T20:11:32 Last Updated: 2024-08-04T01:16:03.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37456 State: PUBLISHED Published: 2021-07-25T20:11:22 Last Updated: 2024-08-04T01:16:04.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37457 State: PUBLISHED Published: 2021-07-25T20:11:10 Last Updated: 2024-08-04T01:16:04.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37458 State: PUBLISHED Published: 2021-07-25T20:10:44 Last Updated: 2024-08-04T01:16:04.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37459 State: PUBLISHED Published: 2021-07-25T20:10:33 Last Updated: 2024-08-04T01:16:04.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37460 State: PUBLISHED Published: 2021-07-25T20:10:22 Last Updated: 2024-08-04T01:16:04.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37461 State: PUBLISHED Published: 2021-07-25T20:10:12 Last Updated: 2024-08-04T01:16:04.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37462 State: PUBLISHED Published: 2021-07-25T20:10:02 Last Updated: 2024-08-04T01:16:04.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/pbx/index.html - https://github.com/0xfml/poc/blob/main/NCH/Axon_2.22_XSS.md
CVE ID: CVE-2021-37463 State: PUBLISHED Published: 2021-07-25T20:09:53 Last Updated: 2024-08-04T01:16:03.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/conference/index.html - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE ID: CVE-2021-37464 State: PUBLISHED Published: 2021-07-25T20:09:41 Last Updated: 2024-08-04T01:16:04.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/conference/index.html - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE ID: CVE-2021-37465 State: PUBLISHED Published: 2021-07-25T20:09:33 Last Updated: 2024-08-04T01:16:04.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/conference/index.html - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE ID: CVE-2021-37466 State: PUBLISHED Published: 2021-07-25T20:09:19 Last Updated: 2024-08-04T01:16:04.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/conference/index.html - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE ID: CVE-2021-37467 State: PUBLISHED Published: 2021-07-25T20:09:07 Last Updated: 2024-08-04T01:16:04.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected). Additional Analyst Notes: - CVE Program Container: References: - https://www.nch.com.au/conference/index.html - https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_XSS.md
CVE ID: CVE-2021-37468 State: PUBLISHED Published: 2021-07-25T20:08:47 Last Updated: 2024-08-04T01:16:04.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/ReflectCRM_3.01_CC.md - https://www.nchsoftware.com/crm/index.html
CVE ID: CVE-2021-37469 State: PUBLISHED Published: 2021-07-25T20:08:26 Last Updated: 2024-08-04T01:16:04.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_LFI.md - https://www.nch.com.au/webdictate/index.html