PT-2021-11919

Name of the Vulnerable Software and Affected Versions: Pax Technology PAXSTORE versions prior to 7.0.8 20200511171508 Description: The issue concerns incorrect access control, allowing password revalidation in sensitive operations to be bypassed remotely by an authenticated attacker. This can be...

CVE-2020-36125: Missing Authentication for Critical Function

Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly...

CVE-2020-36126: Authorization Bypass Through User-Controlled Key

Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them, including third-party users, application and payment...

CVE-2020-36128: Authentication Bypass by Spoofing

Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token called X-Terminal-Token to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its...

CVE-2020-36127: Improper Certificate Validation

Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the...