Nch Axon Pbx vulnerabilities

CVE-2021-37441 [HIGH] CWE-22 CVE-2021-37441: NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. su NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.

CVE-2018-11551 [HIGH] CWE-426 CVE-2018-11551: AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote att AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.

CVE-2018-11552 [MEDIUM] CWE-79 CVE-2018-11552: There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" fi There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application.

CVE-2021-37440 [MEDIUM] CWE-22 CVE-2021-37440: NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. su NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.