CVE-2020-36124

CVE-2020-36124 affects Pax Technology PAXSTORE v7.0.8_20200511171508 and earlier. The issue is XML External Entity (XXE) injection that allows an authenticated attacker to compromise the private keys of a JWT token and reuse them to manipulate access tokens, enabling access to the platform as any...

CVE-2020-36125

Pax Technology PAXSTORE v7.0.8_20200511171508 and earlier are affected by an access-control vulnerability that lets an authenticated attacker bypass password re-verification in sensitive operations by directly requesting the endpoint. Root cause: improper access control in PaxSTORE; impact: remot...

CVE-2020-36127

PAX Technology PAXSTORE v7.0.8_20200511171508 and earlier are affected by an information disclosure vulnerability. The issue arises via the PUK signature functionality, where an administrator cannot view the current p12 certificate password, and when replacing the certificate the new p12 is retur...

CVE-2020-36128

CVE-2020-36128 affects Pax Technology PAXSTORE v7.0.8_20200511171508 and earlier. The vulnerability stems from token impersonation: each terminal uses an X-Terminal-Token to access the marketplace, and an attacker can intercept HTTPS requests to obtain the token assignment and craft a token to im...

CVE-2020-36126

PAX Technology PAXSTORE v7.0.8_20200511171508 and earlier versions are affected by an incorrect access control vulnerability that enables authenticated users to read/write data they do not own, potentially impersonating other users and causing unauthorized disclosure, modification, or destruction...