CVSS: 10.0EPSS: 0%CPEs: 265EXPL: 0CVE-2023-26070
https://notcve.org/view.php?id=CVE-2023-26070
10 Apr 2023 — Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4). • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26070.pdf • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 265EXPL: 0CVE-2023-26063 – Lexmark MC3224i pagemaker NAME Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-26063
10 Apr 2023 — Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the pagemaker service. When parsing the NAME element, the process does not properly validate user-supplied data, which can result in a type confusion condition. An attacker can leverage this v... • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26063.pdf • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 10.0EPSS: 0%CPEs: 265EXPL: 0CVE-2023-26064 – Lexmark MC3224i putinterval Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-26064
10 Apr 2023 — Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the putinterval method. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerabilit... • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26064.pdf • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 265EXPL: 0CVE-2023-26065 – Lexmark MC3224i putinterval Integer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-26065
10 Apr 2023 — Certain Lexmark devices through 2023-02-19 have an Integer Overflow. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the PostScript putinterval command. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker c... • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26065.pdf • CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 0%CPEs: 265EXPL: 0CVE-2023-26066 – Lexmark MC3224i pagemark Out-Of-Bounds Read Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-26066
10 Apr 2023 — Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the pagemark service. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage th... • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26066.pdf • CWE-129: Improper Validation of Array Index •
CVSS: 10.0EPSS: 0%CPEs: 256EXPL: 0CVE-2023-23560
https://notcve.org/view.php?id=CVE-2023-23560
23 Jan 2023 — In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. En ciertos productos Lexmark hasta el 12 de enero de 2023, puede ocurrir SSRF debido a la falta de validación de entrada. • https://publications.lexmark.com/publications/security-alerts/CVE-2023-23560.pdf • CWE-20: Improper Input Validation CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 54%CPEs: 256EXPL: 1CVE-2023-22960
https://notcve.org/view.php?id=CVE-2023-22960
23 Jan 2023 — Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. Los productos Lexmark hasta el 10 de enero de 2023 tienen un control inadecuado de la frecuencia de interacción. • https://github.com/t3l3machus/CVE-2023-22960 • CWE-284: Improper Access Control CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.1EPSS: 0%CPEs: 240EXPL: 0CVE-2022-29850
https://notcve.org/view.php?id=CVE-2022-29850
25 Aug 2022 — Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. Varios productos de Lexmark hasta el 2022-04-27 permiten a un atacante que ya ha comprometido un dispositivo Lexmark afectado mantener la persistencia a través de los reinicios • https://publications.lexmark.com/publications/security-alerts/CVE-2022-29850.pdf • CWE-20: Improper Input Validation CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 10.0EPSS: 8%CPEs: 472EXPL: 0CVE-2021-44734 – Lexmark MC3224i Web Configuration File Code Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44734
20 Jan 2022 — Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device. Una vulnerabilidad en el saneo de entradas del servidor web integrado en los dispositivos Lexmark versiones hasta 07-12-2021, que puede conllevar a una ejecución de código remota en el dispositivo This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not re... • https://support.lexmark.com/alerts • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 12%CPEs: 240EXPL: 0CVE-2021-44735 – Lexmark MC3224i Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44735
20 Jan 2022 — Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. Una vulnerabilidad de inyección de comandos del servidor web integrado en los dispositivos Lexmark versiones hasta 07-12-2021 This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the pro... • https://support.lexmark.com/alerts • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •