EUVD-2020-21318

Malware in sbrugna...

CVE-2020-28931

Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website...

CVE-2020-28929

Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI...

CVE-2020-28930

A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...

CVE-2020-28931

Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website...

CVE-2020-28930

A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...

Cross site scripting

A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...

Integer overflow

Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI...

Cross site request forgery (csrf)

Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website...

CVE-2020-28930

CVE-2020-28930 is an XSS flaw in EPSON EPS TSE Server 8 (21.0.11) affecting the settings/users.php “update user” and “delete user” paths. An authenticated attacker can inject JavaScript on the user management page that is executed by an administrator. The CVSSv3.1 base score is 5.4 (AV:N/AC:L/PR:...

CVE-2020-28930

A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...

CVE-2020-28929

Technical details about CVE-2020-28929 are not publicly provided in the supplied documents; monitor for updates from sources to determine affected products, impact, and fixes.

CVE-2020-28929

Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI...

CVE-2020-28931: Cross-Site Request Forgery (CSRF)

Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website...

CVE-2020-28930: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...

CVE-2020-28929: Missing Authentication for Critical Function

Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 21.0.11 allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI...

PT-2020-17060

Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11 Description The issue allows an unauthenticated attacker to remotely retrieve administrative hashed credentials due to unrestricted access to the log downloader functionality. This can be achieved via the...

PT-2020-17061

Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11 Description A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php allows an authenticated attacker to inject a JavaScript payload in the user...

PT-2020-17062

Name of the Vulnerable Software and Affected Versions EPSON EPS TSE Server 8 version 21.0.11 Description The issue is related to the lack of an anti-CSRF token in the administrative interface, allowing an unauthenticated attacker to force an administrator to execute external POST requests by...