73 matches found
CVE-2024-1222
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls...
CVE-2024-9672
A reflected cross-site scripting XSS vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur...
CVE-2024-9672
CVE-2024-9672 describes a reflected XSS in PaperCut NG/MF. The vulnerability arises in the product where a user must click a malicious link, enabling JavaScript payload execution in the victim’s browser. Concrete details available in the connected documents show the affected software (PaperCut NG...
CVE-2024-9672 Reflected XSS in PaperCut MF
A reflected cross-site scripting XSS vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur...
CVE-2024-9672 Reflected XSS in PaperCut MF
A reflected cross-site scripting XSS vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur...
PaperCut MF < 23.0.9 Multiple Vulnerabilities
The version of PaperCut MF installed on the remote Windows host is affected by multiple vulnerabilities, as follows: - An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must...
The vulnerability of the web printing function in the control systems for printing in PaperCut MF and PaperCut NG allows a violator to trigger a service failure.
The vulnerability of the web printing function in the control tools for printing in PaperCut MF and PaperCut NG is related to the failure to implement measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow an attacker to cause servic...
PaperCut MF handleServiceException Cross-Site Scripting Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut MF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
PaperCut MF EmailRenderer Server-Side Template Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut MF. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EmailRenderer class. The iss...
PaperCut MF pc-upconnector-service Server-Side Request Forgery Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PaperCut MF. Authentication is not required to exploit this vulnerability. The specific flaw exists within the pc-upconnector-service service, which listens on TCP port 9151 by default. The...
PaperCut MF < 20.1.10 / 21.x < 21.2.14 / 22.x < 22.1.5 / 23.x < 23.0.7 Multiple Vulnerabilities
The version of PaperCut MF installed on the remote Windows host is affected by multiple vulnerabilities, as follows: - This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut...
CVE-2024-1882
CVE-2024-1882 affects PaperCut NG/MF: an authenticated admin can create a malicious payload on the PaperCut NG/MF application server, potentially enabling remote code execution. The consolidated sources describe a server‑side resource injection type vulnerability with high impact (C/H/I/A all hig...
PaperCut NG Security Vulnerability
PaperCut NG is a suite of next-generation printer control software from PaperCut Australia. A security vulnerability exists in PaperCut NG/MF that stems from the presence of a server-side request forgery SSRF vulnerability that allows an attacker to trick a server-side application into making HTT...
PaperCut MF and PaperCut NG Security Vulnerabilities
PaperCut MF and PaperCut NG are both products of PaperCut Australia.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control software.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control...
CVE-2023-31046
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...
Path traversal
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...
CVE-2023-31046
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...
CVE-2023-31046
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach...
CVE-2023-31046
The CVE-2023-31046 issue affects PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. It is a Path Traversal vulnerability where, under certain conditions, an authenticated attacker could obtain read‑only access to the server filesystem by crafting requests like GET /ui/static/..//.., which r...