CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-50916
https://notcve.org/view.php?id=CVE-2023-50916
Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. It allows administrators to configure the backup location of the database used by the application. Attempting to change this location to a UNC path via the GUI is rejected due to the use of a \ (backslash) character, which is supposed to be disallowed in a pathname. Intercepting and modifying this request via a proxy, or sending the request directly to the application endpoint, allows UNC paths to be set for the backup location. Once such a location is set, Kyocera Device Manager attempts to confirm access and will try to authenticate to the UNC path; depending on the configuration of the environment, this may authenticate to the UNC with Windows NTLM hashes. • https://www.kyoceradocumentsolutions.us/en/about-us/pr-and-award-certifications/press/kyocera-device-manager-cve-2023-50196-vulnerability-solution-update.html https://www.trustwave.com/en-us/resources/security-resources/security-advisories https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-001_kyocera-v2.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 1CVE-2023-34259 – Kyocera TASKalfa 4053ci 2VG_S000.002.561 Path Traversal / Denial Of Service
https://notcve.org/view.php?id=CVE-2023-34259
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even files that require root privileges. NOTE: this issue exists because of an incomplete fix for CVE-2020-23575. Las impresoras Kyocera TASKalfa 4053ci hasta 2VG_S000.002.561 permiten /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal para leer archivos arbitrarios en el sistema de archivos, incluso archivos que requieren privilegios de root. NOTA: este problema existe debido a una solución incompleta para CVE-2020-23575. Kyocera TASKalfa 4053ci versions 2VG_S000.002.561 and below suffers from path traversal, user enumeration, and denial of service vulnerabilities. • https://sec-consult.com/vulnerability-lab https://seclists.org/fulldisclosure/2023/Jul/15 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-34260 – Kyocera TASKalfa 4053ci 2VG_S000.002.561 Path Traversal / Denial Of Service
https://notcve.org/view.php?id=CVE-2023-34260
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed by a directory reference such as %2fetc%00index.htm to try to read the /etc directory. Las impresoras Kyocera TASKalfa 4053ci hasta 2VG_S000.002.561 permiten una denegación de servicio (interrupción del servicio) a través de /wlmdeu%2f%2e%2e%2f%2e%2e seguido de una referencia de directorio como %2fetc%00index.htm para intentar leer el directorio /etc. Kyocera TASKalfa 4053ci versions 2VG_S000.002.561 and below suffers from path traversal, user enumeration, and denial of service vulnerabilities. • https://sec-consult.com/vulnerability-lab https://seclists.org/fulldisclosure/2023/Jul/15 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-34261 – Kyocera TASKalfa 4053ci 2VG_S000.002.561 Path Traversal / Denial Of Service
https://notcve.org/view.php?id=CVE-2023-34261
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht einloggen" error rather than a falsch error. Las impresoras Kyocera TASKalfa 4053ci hasta 2VG_S000.002.561 permiten la identificación de cuentas de usuario válidas mediante la enumeración de nombres de usuario porque conducen a un error "nicht einloggen" en lugar de un error falso. Kyocera TASKalfa 4053ci versions 2VG_S000.002.561 and below suffers from path traversal, user enumeration, and denial of service vulnerabilities. • https://sec-consult.com/vulnerability-lab https://seclists.org/fulldisclosure/2023/Jul/15 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25954
https://notcve.org/view.php?id=CVE-2023-25954
KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 and earlier are vulnerable to improper intent handling. When a malicious app is installed on the victim user's Android device, the app may send an intent and direct the affected app to download malicious files or apps to the device without notification. • https://jvn.jp/en/vu/JVNVU98434809 https://play.google.com/store/apps/details?id=com.kyocera.kyoprint https://play.google.com/store/apps/details?id=com.kyocera.kyoprintolivetti https://play.google.com/store/apps/details?id=com.kyocera.kyoprinttautax https://www.kyoceradocumentsolutions.com/en/our-business/security/information/2023-04-11.html • CWE-668: Exposure of Resource to Wrong Sphere •