CVSS: 9.8EPSS: 96%CPEs: 6EXPL: 13CVE-2023-27350 – PaperCut MF/NG Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2023-27350
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. • https://github.com/horizon3ai/CVE-2023-27350 https://www.exploit-db.com/exploits/51391 https://www.exploit-db.com/exploits/51452 https://github.com/adhikara13/CVE-2023-27350 https://github.com/imancybersecurity/CVE-2023-27350-POC https://github.com/ThatNotEasy/CVE-2023-27350 https://github.com/Jenderal92/CVE-2023-27350 https://github.com/MaanVader/CVE-2023-27350-POC https://github.com/ASG-CASTLE/CVE-2023-27350 https://github.com/rasan2001/CVE-2023-27350-Ongoing-Exploitation-o • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 0CVE-2019-12135
https://notcve.org/view.php?id=CVE-2019-12135
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector. Una vulnerabilidad sin especificar en la aplicación server in PaperCut MF y NG versiones 18.3.8 y versiones anteriores 19.0.3 y anteriores, permiten que un atacante remoto ejecute códigos arbitrarios mediante un vector sin especificar. • https://www.papercut.com/products/mf/release-history https://www.papercut.com/products/ng/release-history •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-8948
https://notcve.org/view.php?id=CVE-2019-8948
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. PaperCut MF, en versiones anteriores a la 18.3.6, y PaperCut NG, en versiones anteriores a la 18.3.6, permiten la inyección de scripts mediante la interfaz de usuario, también conocida como PC-15163. • https://www.papercut.com/products/mf/release-history https://www.papercut.com/products/ng/release-history • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.0EPSS: 0%CPEs: 28EXPL: 0CVE-2014-2658
https://notcve.org/view.php?id=CVE-2014-2658
Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors. Vulnerabilidad no especificada en Papercut MF y NG anterior a 14.1 (Build 26983) permite a atacantes causar una denegación de servicio a través de vectores desconocidos. • http://secunia.com/advisories/58037 http://www.papercut-mf.com/release-history http://www.papercut.com/release-history https://exchange.xforce.ibmcloud.com/vulnerabilities/92649 •
CVSS: 6.8EPSS: 0%CPEs: 28EXPL: 0CVE-2014-2659
https://notcve.org/view.php?id=CVE-2014-2659
Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of administrators via unspecified vectors. Vulnerabilidad de CSRF en la interfaz de usuario de administración en Papercut MF y NG anterior a 14.1 (Build 26983) permite a atacantes remotos secuestrar la autenticación de administradores a través de vectores no especificados. • http://secunia.com/advisories/58037 http://www.papercut-mf.com/release-history http://www.papercut.com/release-history https://exchange.xforce.ibmcloud.com/vulnerabilities/92648 • CWE-352: Cross-Site Request Forgery (CSRF) •