CVSS: 9.8EPSS: 97%CPEs: 6EXPL: 14CVE-2023-27350 – PaperCut MF/NG Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2023-27350
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. • https://github.com/horizon3ai/CVE-2023-27350 https://www.exploit-db.com/exploits/51391 https://www.exploit-db.com/exploits/51452 https://github.com/adhikara13/CVE-2023-27350 https://github.com/imancybersecurity/CVE-2023-27350-POC https://github.com/ThatNotEasy/CVE-2023-27350 https://github.com/Jenderal92/CVE-2023-27350 https://github.com/MaanVader/CVE-2023-27350-POC https://github.com/ASG-CASTLE/CVE-2023-27350 https://github.com/rasan2001/CVE-2023-27350-Ongoing-Exploitation-o • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 3%CPEs: 6EXPL: 0CVE-2023-27351 – PaperCut NG SecurityRequestFilter Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-27351
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. • https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 https://www.zerodayinitiative.com/advisories/ZDI-23-232 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 0CVE-2019-12135
https://notcve.org/view.php?id=CVE-2019-12135
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector. Una vulnerabilidad sin especificar en la aplicación server in PaperCut MF y NG versiones 18.3.8 y versiones anteriores 19.0.3 y anteriores, permiten que un atacante remoto ejecute códigos arbitrarios mediante un vector sin especificar. • https://www.papercut.com/products/mf/release-history https://www.papercut.com/products/ng/release-history •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-8948
https://notcve.org/view.php?id=CVE-2019-8948
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. PaperCut MF, en versiones anteriores a la 18.3.6, y PaperCut NG, en versiones anteriores a la 18.3.6, permiten la inyección de scripts mediante la interfaz de usuario, también conocida como PC-15163. • https://www.papercut.com/products/mf/release-history https://www.papercut.com/products/ng/release-history • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2657
https://notcve.org/view.php?id=CVE-2014-2657
Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs. Una vulnerabilidad no especificada en la funcionalidad print release en PaperCut MF anterior a la versión 14.1 (Build 26983), presenta un impacto no especificado y vectores remotos, relacionados con MFPs integrados. • http://www.papercut-mf.com/release-history https://exchange.xforce.ibmcloud.com/vulnerabilities/92650 •