3918 matches found
Code injection
EPSON WF-2750 printers with firmware JP02I2 do not properly validate files before running updates, which allows remote attackers to cause a printer malfunction or send malicious data to the printer...
Design/Logic Flaw
On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites...
CVE-2018-14899
CVE-2018-14899 affects the EPSON WF-2750 printer with firmware JP02I2. The Web interface AirPrint Setup page is vulnerable to HTML injection, enabling redirection of users to malicious sites. Multiple connected sources (NVD entry, CNVD, CNVD-style EUVD/NASL references, and Nessus/OT plugin contex...
August 30, 2018—KB4346783 (OS Build 17134.254)
None None...
Command Execution Vulnerability in Dell Color Laser 1320c
The Dell Color Laser 1320c is a printer. A command execution vulnerability exists in the Dell Color Laser 1320c. An attacker could exploit the vulnerability to execute commands...
Microsoft Windows - Advanced Local Procedure Call (ALPC) Local Privilege Escalation
Microsoft Windows - Advanced Local Procedure Call ALPC Local Privilege Escalation Note: PoC will now hijack the print spooler service - spoolsv.exe - as it required less code then hijacking printfilterpipelinesvc.exe, which was shown in the original video demo Description of the vulnerability The...
RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for hardware platform in category web applications Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link :...
HP Jetdirect - Path Traversal Arbitrary Code Execution Exploit
Exploit for unix platform in category remote exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "rex/proto/pjl" class MetasploitModule 'HP Jetdirect Path Traversal Arbitrary Code Execution', 'Description...
RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)
RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Date: 2018-08-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link :...
HP Jetdirect Path Traversal Arbitrary Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "rex/proto/pjl" class MetasploitModule 'HP Jetdirect Path Traversal Arbitrary Code Execution', 'Description' = %q The module exploits a path traversal via...
RICOH MP C4504ex Cross Site Request Forgery
Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Date: 2018-08-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link :...
HP Jetdirect - Path Traversal Arbitrary Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "rex/proto/pjl" class MetasploitModule 'HP Jetdirect Path Traversal Arbitrary Code Execution', 'Description' = %q The module exploits a path traversal via...
RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)
Exploit Title: RICOH MP C4504ex Printer - Cross-Site Request Forgery Add Admin Date: 2018-08-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link :...
HP Jetdirect Path Traversal Arbitrary Code Execution
The module exploits a path traversal via Jetdirect to gain arbitrary code execution by writing a shell script that is loaded on startup to /etc/profile.d. Then, the printer is restarted using SNMP. Impacted printers: HP PageWide Managed MFP P57750dw HP PageWide Managed P55250dw HP PageWide Pro MF...
CVE-2018-15748
CVE-2018-15748 affects Dell 2335dn printers. The admin interface (Email Settings) may leak the SMTP/LDAP password to an authenticated attacker by viewing HTML source, with authentication possibly achievable via a blank default admin password. Affected versions include Printer Firmware 2.70.05.02,...
CVE-2018-15748
On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.152335dn MFP 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the HTML source code of t...
[SECURITY] Fedora 28 Update: lulzbot-marlin-firmware-1.1.8.62-1.fc28
Marlin firmware files for the Lulzbot family of 3D printers...
The vulnerability of microprogrammed software in HP PageWide, DesignJet, AMP, Deskjet, Envy, Ink Tank, Officejet, Photosmart, and Smart Tank printers arises from an operation that goes beyond buffer boundaries in memory, allowing attackers to execute arbitrary code.
The vulnerability of microprogrammed software on HP PageWide, DesignJet, AMP, Deskjet, Envy, Ink Tank, Officejet, Photosmart, and Smart Tank devices arises from operations that go beyond buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code ...
The vulnerability of microprogrammed software in HP PageWide, DesignJet, AMP, Deskjet, Envy, Ink Tank, Officejet, Photosmart, and Smart Tank printers arises from an operation that goes beyond buffer boundaries in memory, allowing attackers to execute arbitrary code.
The vulnerability of microprogrammed software on HP PageWide, DesignJet, AMP, Deskjet, Envy, Ink Tank, Officejet, Photosmart, and Smart Tank devices arises from operations that go beyond buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code ...
Podcast: Bugcrowd Founder on Printer Bugs, IoT Bounty Hunting, and New VDP Project
Bugcrowd has had a busy summer. Recently, the bug-bounty company partnered with HP to launch the first-ever bug bounty program for printers, with rewards of up to $10,000 for discovered vulnerabilities. Bugcrowd also recently announced Disclose.io, an open-sourced project to standardize best...