CVSS: 9.8EPSS: 96%CPEs: 6EXPL: 13CVE-2023-27350 – PaperCut MF/NG Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2023-27350
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. • https://github.com/horizon3ai/CVE-2023-27350 https://www.exploit-db.com/exploits/51391 https://www.exploit-db.com/exploits/51452 https://github.com/adhikara13/CVE-2023-27350 https://github.com/imancybersecurity/CVE-2023-27350-POC https://github.com/ThatNotEasy/CVE-2023-27350 https://github.com/Jenderal92/CVE-2023-27350 https://github.com/MaanVader/CVE-2023-27350-POC https://github.com/ASG-CASTLE/CVE-2023-27350 https://github.com/rasan2001/CVE-2023-27350-Ongoing-Exploitation-o • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 4%CPEs: 6EXPL: 0CVE-2023-27351 – PaperCut NG SecurityRequestFilter Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-27351
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. • https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 https://www.zerodayinitiative.com/advisories/ZDI-23-232 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 0CVE-2019-12135
https://notcve.org/view.php?id=CVE-2019-12135
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector. Una vulnerabilidad sin especificar en la aplicación server in PaperCut MF y NG versiones 18.3.8 y versiones anteriores 19.0.3 y anteriores, permiten que un atacante remoto ejecute códigos arbitrarios mediante un vector sin especificar. • https://www.papercut.com/products/mf/release-history https://www.papercut.com/products/ng/release-history •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-8948
https://notcve.org/view.php?id=CVE-2019-8948
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. PaperCut MF, en versiones anteriores a la 18.3.6, y PaperCut NG, en versiones anteriores a la 18.3.6, permiten la inyección de scripts mediante la interfaz de usuario, también conocida como PC-15163. • https://www.papercut.com/products/mf/release-history https://www.papercut.com/products/ng/release-history • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.0EPSS: 0%CPEs: 28EXPL: 0CVE-2014-2658
https://notcve.org/view.php?id=CVE-2014-2658
Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors. Vulnerabilidad no especificada en Papercut MF y NG anterior a 14.1 (Build 26983) permite a atacantes causar una denegación de servicio a través de vectores desconocidos. • http://secunia.com/advisories/58037 http://www.papercut-mf.com/release-history http://www.papercut.com/release-history https://exchange.xforce.ibmcloud.com/vulnerabilities/92649 •