VendorsNCH Softwareivm_attendantany version
Vulnerabilities

NCH Software Nchsoftware Ivm Attendant any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

7CVEs
CVE-2021-37444
NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function.
Published 2021-07-25 · Modified
8.8EPSS 0.019
CVE-2021-37443
NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
Published 2021-07-25 · Modified
8.1EPSS 0.012
CVE-2021-37442
NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
Published 2021-07-25 · Modified
6.5EPSS 0.012
CVE-2021-37451
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
Published 2021-07-25 · Modified
5.4EPSS 0.006
CVE-2021-37450
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
Published 2021-07-25 · Modified
5.4EPSS 0.006
CVE-2021-37448
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
Published 2021-07-25 · Modified
5.4EPSS 0.005
CVE-2021-37449
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
Published 2021-07-25 · Modified
5.4EPSS 0.005