CVE-2023-47297

A settings manipulation vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands, including editing system security auditing configurations...

CVE-2023-47032

Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserService SOAP API function...

CVE-2023-47295

A CSV injection vulnerability exists in NCR Terminal Handler version 1.5.1 . The flaw stems from insufficient validation of text field input , allowing an attacker to inject a crafted payload into any text field that accepts strings. Successful exploitation can lead to the execution of arbitrary ...

CVE-2023-47031

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization SOAP API component...

CVE-2023-47030

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists...

CVE-2023-47298

An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application including their usernames, roles, security groups and account statuses...

CVE-2023-47030

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists...

CVE-2023-47031

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization SOAP API component...

CVE-2023-47030: Improper Control of Generation of Code

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists...

CVE-2023-47294: Improper Access Control

An issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete user accounts via a crafted session cookie...

CVE-2023-47032

A Password Vulnerability exists in NCR Atleos Terminal Handler version 1.5.1 . A remote attacker can execute arbitrary code by sending a crafted script to the UserService SOAP API function. To mitigate this risk, it is recommended to disable the UserService SOAP API function until a patch is avai...

CVE-2023-47032

Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserService SOAP API function...

CVE-2023-47298

NCR Terminal Handler version 1.5.1 is vulnerable to an improper authorization issue within its SOAP API endpoint . A low-level privileged authenticated attacker can query this endpoint to extract sensitive information about all application users, including usernames, roles, security groups, and a...

PT-2025-26608 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: A settings manipulation issue allows attackers to execute arbitrary commands, including editing system security auditing configurations. Recommendations: For NCR Terminal Handler version 1.5.1,...

CVE-2023-47031: Improper Access Control

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization SOAP API component...

CVE-2023-47295: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings...

CVE-2023-47032: Improper Control of Generation of Code

Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserService SOAP API function...

CVE-2023-47298: Exposure of Sensitive Information to an Unauthorized Actor

An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application including their usernames, roles, security groups and account statuses...

CVE-2023-47295

A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings...

CVE-2023-47294

NCR Terminal Handler v1.5.1 is vulnerable to an Improper Access Control issue (CWE-284) caused by insufficient session cookie validation. This flaw allows low-level privileged authenticated attackers to use a crafted session cookie to arbitrarily deactivate, lock, and delete user accounts . A pub...