CVSS: 7.8EPSS: 0%CPEs: 382EXPL: 2CVE-2021-3438
https://notcve.org/view.php?id=CVE-2021-3438
A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalation of privilege. Un posible desbordamiento del búfer en los controladores de software para determinados productos HP LaserJet e impresoras de productos Samsung podría desencadenar una escalada de privilegios • https://github.com/CrackerCat/CVE-2021-3438 https://github.com/TobiasS1402/CVE-2021-3438 https://support.hp.com/us-en/document/ish_3900395-3833905-16 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2011-4785
https://notcve.org/view.php?id=CVE-2011-4785
Directory traversal vulnerability in the HP-ChaiSOE/1.0 web server on the HP LaserJet P3015 printer with firmware before 07.080.3, LaserJet 4650 printer with firmware 07.006.0, and LaserJet 2430 printer with firmware 08.113.0_I35128 allows remote attackers to read arbitrary files via unspecified vectors, a different vulnerability than CVE-2008-4419. Vulnerabilidad de salto de directorio en el servidor web HP-ChaiSOE/1.0 en la impresora HP LaserJet P3015 con firmware anterior a v07.080.3, impresora LaserJet 4650 con firmware v07.006.0, e impresora LaserJet 2430 con firmware v08.113.0_I35128 permite a atacantes remotos leer ficheros arbitrarios a través de vectores de ataque desconocidos, una vulnerabilidad diferente a CVE-2008-4419. • http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0116.html http://osvdb.org/78224 http://secunia.com/advisories/47457 http://www.securityfocus.com/archive/1/521160 http://www.securityfocus.com/archive/1/521165 http://www.securityfocus.com/bid/51329 https://exchange.xforce.ibmcloud.com/vulnerabilities/72227 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.1EPSS: 0%CPEs: 164EXPL: 1CVE-2009-0940
https://notcve.org/view.php?id=CVE-2009-0940
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders, permiten a atacantes remotos (1) imprimir documentos mediante vectores desconocidos, (2) modificar la configuración de red mediante una petición NetIPChange a hp/device/config_result_YesNo.html/config o (3) cambiar la contraseña mediante los parámetros Password y ConfirmPassword a hp/device/set_config_password.html/config. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566 http://osvdb.org/52847 http://osvdb.org/52848 http://osvdb.org/52849 http://www.louhinetworks.fi/advisory/HP_20090317.txt http://www.securityfocus.com/archive/1/501884/100/0/threaded http://www.securityfocus.com/bid/34143 http://www.vupen.com/english/advisories/2009/0754 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.6EPSS: 0%CPEs: 164EXPL: 0CVE-2009-0941
https://notcve.org/view.php?id=CVE-2009-0941
The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers to obtain access. El HP Embedded Web Server (EWS) en HP LaserJet Printers, Edgeline Printers, y Digital Senders no tiene contraseña de administración por defecto, lo que facilita a atacantes remotos el obtener acceso. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566 http://www.louhinetworks.fi/advisory/HP_20090317.txt http://www.securityfocus.com/archive/1/501884/100/0/threaded http://www.vupen.com/english/advisories/2009/0754 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.1EPSS: 0%CPEs: 21EXPL: 2CVE-2007-0161 – HP (Multiple Products) - PML Driver HPZ12 Privilege Escalation
https://notcve.org/view.php?id=CVE-2007-0161
The PML Driver HPZ12 (HPZipm12.exe) in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICE_CHANGE_CONFIG DACL permissions, which allows local users to gain privileges and execute arbitrary programs, as demonstrated by modifying the binpath argument, a related issue to CVE-2006-0023. El controlador PML HPZ12 (HPZipm12.exe) en los controladores todo en uno de HP, usado en múltiples productos HP, utiliza permisos no seguros SERVICE_CHANGE_CONFIG DACL, lo cual permite a un usuario local ganar privilegios y ejecutar programas de su elección, como se demostró con la modificación del argumento binpath, un asunto relacionado con CVE-2006-0023. • https://www.exploit-db.com/exploits/29403 http://osvdb.org/32654 http://secunia.com/advisories/23663 http://securityreason.com/securityalert/2128 http://secway.org/advisory/AD20070108.txt http://www.securityfocus.com/archive/1/456259/100/0/threaded http://www.securityfocus.com/bid/21935 http://www.vupen.com/english/advisories/2007/0094 https://exchange.xforce.ibmcloud.com/vulnerabilities/31361 •