PT-2020-17060

Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11 Description The issue allows an unauthenticated attacker to remotely retrieve administrative hashed credentials due to unrestricted access to the log downloader functionality. This can be achieved via the...

CVE-2020-28930: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...

CVE-2020-28931: Cross-Site Request Forgery (CSRF)

Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website...

PT-2020-17062

Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11 Description The issue is related to the lack of an anti-CSRF token in the administrative interface, allowing an unauthenticated attacker to force an administrator to execute external POST requests by...

EPSON EPS TSE Server Authorization Issues Vulnerability

EPSON EPS TSE Server is a server from EPSON Japan. EPSON EPS TSE Server 8 suffers from an authorization issue vulnerability that arises from unrestricted access to the logdownloader function allowing an unauthenticated attacker to remotely retrieve management hash certificates via maintenance...

CVE-2020-28929: Missing Authentication for Critical Function

Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI...

EPSON EPS TSE Server Cross-Site Request Forgery Vulnerability

EPSON EPS TSE Server is a server from EPSON Japan. EPSON EPS TSE Server 8 suffers from a cross-site request forgery vulnerability that stems from a lack of anti-csrf tokens throughout the administration interface, allowing an unauthenticated attacker to exploit the vulnerability by visiting a...

PT-2020-17061

Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11 Description A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php allows an authenticated attacker to inject a JavaScript payload in the user...

EPSON EPS TSE Server Cross-Site Scripting Vulnerability

EPSON EPS TSE Server is a server from EPSON Japan. A cross-site scripting vulnerability exists in EPSON EPS TSE Server 8 that stems from a cross-site scripting XSS issue with the update user and delete user functions in settings users.php, which could be exploited by authenticated attackers to...

EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path

Exploit Title: EPSON Status Monitor 3 'EPSONPMRPCV406' - Unquoted Service Path Exploit Author : SamAlucard Exploit Date: 2020-27-11 Vendor : SEIKO EPSON Corp Version : EPSONPMRPCV406 8.0 Vendor Homepage : https://epson.com Tested on OS: Windows 7 Pro Analyze PoC : ============== C:\sc qc...

EPSON Status Monitor 3 (EPSON_PM_RPCV4_06) - Unquoted Service Path Vulnerability

Exploit Title: EPSON Status Monitor 3 'EPSONPMRPCV406' - Unquoted Service Path Exploit Author : SamAlucard Vendor : SEIKO EPSON Corp Version : EPSONPMRPCV406 8.0 Vendor Homepage : https://epson.com Tested on OS: Windows 7 Pro Analyze PoC : ============== C:\sc qc EPSONPMRPCV406 SC...

CVE-2020-5674

Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2020-5674

Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2020-5674

Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2020-5674

Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2020-5674

CVE-2020-5674 affects SEIKO EPSON installer components, where an insecure DLL search path (CWE-427) could let an attacker load a Trojan horse DLL from an unspecified directory and obtain privileges during installation. Public documentation (NVD, JVN) describes the vulnerability as an untrusted se...

CVE-2020-5674: Uncontrolled Search Path Element

Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

PT-2020-18634

Name of the Vulnerable Software and Affected Versions SEIKO EPSON products affected versions not specified Description The issue concerns an untrusted search path vulnerability in the installers of multiple SEIKO EPSON products. This vulnerability allows an attacker to gain privileges via a Troja...

The installers of multiple SEIKO EPSON products may insecurely load Dynamic Link Libraries

Overview The installers of multiple products by SEIKO EPSON CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated wi...