WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product print✕
Overview 407 matches · 4 in Waratek scope · 2 protected · 5 exploited · 0 CISA KEV · 57 public PoC · 7 EPSS ≥ 0.5
407matches 4in Waratek scope1.0% 2protected0.5% 5exploited1.2% 0CISA KEV0.0% 57public PoC14.0% 7EPSS ≥ 0.51.7%
Protected by Waratek 2 0.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 0.5% Outside Waratek scope 0 0.0% Not applicable 403 99.0% Withdrawn CVE 0 0.0%
Critical 76 18.7% High 169 41.5% Medium 150 36.9% Low 12 2.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 0.5% partly blocked 0 0.0% not blocked 405 99.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 1.2% Working exploit published 53 13.0% Proof of concept only 33 8.1% Forecast only 1 0.2% No public exploit 315 77.4%
split by peak 70 / year
Not applicable: 403No exploit published: 2Protected by Waratek: 2 Low: 12Medium: 150High: 169Critical: 76 not blocked: 405blocked by ARMR today: 2 No public exploit: 315Forecast only: 1Proof of concept only: 33Working exploit published: 53Exploited: 5
19993 Not applicable3 High3 not blocked3 Working exploit published3 20000 20014 Not applicable4 High1 Medium3 not blocked4 Working exploit published1 No public exploit3 20023 Not applicable3 Medium3 not blocked3 No public exploit3 20031 Not applicable1 High1 not blocked1 Working exploit published1 20042 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20055 Not applicable5 High1 Medium4 not blocked5 Working exploit published2 No public exploit3 20069 Not applicable9 High7 Medium2 not blocked9 Working exploit published4 No public exploit5 20078 Not applicable8 High7 Medium1 not blocked8 Working exploit published4 No public exploit4 200826 Not applicable26 High15 Medium11 not blocked26 Working exploit published9 Forecast only1 No public exploit16 200916 Not applicable16 High7 Medium7 Low2 not blocked16 Working exploit published2 No public exploit14 20108 Not applicable8 High7 Medium1 not blocked8 Working exploit published3 No public exploit5 201120 Not applicable20 High18 Medium2 not blocked20 Working exploit published3 No public exploit17 201215 Not applicable15 High12 Medium2 Low1 not blocked15 Exploited1 Working exploit published4 No public exploit10 201315 Not applicable15 High4 Medium8 Low3 not blocked15 No public exploit15 201419 Not applicable19 High9 Medium7 Low3 not blocked19 No public exploit19 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20164 Not applicable4 Critical2 High1 Medium1 not blocked4 No public exploit4 20178 Not applicable8 Critical1 High4 Medium3 not blocked8 Working exploit published1 No public exploit7 201813 Not applicable13 Critical2 High6 Medium5 not blocked13 Working exploit published1 No public exploit12 201918 Not applicable18 Critical5 High6 Medium7 not blocked18 Exploited1 Working exploit published3 No public exploit14 202010 Protected by Waratek1 No exploit published1 Not applicable8 Critical3 High6 Low1 blocked by ARMR today1 not blocked9 Working exploit published1 No public exploit9 202120 Not applicable20 Critical4 High8 Medium8 not blocked20 Working exploit published3 No public exploit17 202226 Not applicable26 Critical5 High9 Medium12 not blocked26 Exploited1 Working exploit published3 Proof of concept only4 No public exploit18 202328 Not applicable28 Critical4 High10 Medium13 Low1 not blocked28 Proof of concept only4 No public exploit24 202423 Not applicable23 Critical5 High7 Medium11 not blocked23 Exploited1 Proof of concept only4 No public exploit18 202570 Not applicable70 Critical38 High9 Medium22 Low1 not blocked70 Working exploit published1 Proof of concept only10 No public exploit59 202632 Protected by Waratek1 No exploit published1 Not applicable30 Critical7 High11 Medium14 blocked by ARMR today1 not blocked31 Exploited1 Working exploit published3 Proof of concept only11 No public exploit17
1999200220052008201120142017202020232026
407 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 5 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2020-5674 High 2020-11-24 Not applicable No public exploit Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2020-15232 Critical 2020-10-02 Protected by Waratek No public exploit In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.
CVE-2020-15231 Critical 2020-10-02 No exploit published No public exploit In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.
CVE-2020-10561 Critical 2020-06-24 Not applicable No public exploit An issue was discovered on Xiaomi Mi Jia ink-jet printer < 3.4.6_0138. Injecting parameters to ippserver through the web management background, resulting in command execution vulnerabilities.
CVE-2020-5522 High 2020-01-27 Not applicable No public exploit The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2020-5521 High 2020-01-27 Not applicable No public exploit The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2020-5520 High 2020-01-27 Not applicable No public exploit The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2019-19363 High 2020-01-24 Not applicable Working exploit published An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected drivers and versions are: PCL6 Driver for Universal Print - Version 4.0 or later PS Driver for Universal Print - Version 4.0 or later PC FAX Generic Driver - All versions Generic PCL5 Driver - All versions RPCS Driver - All versions PostScript3 Driver - All versions PCL6 (PCL XL) Driver - All versions RPCS Raster Driver - All version
CVE-2019-6331 Low 2020-01-09 Not applicable No public exploit An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application configuration information.
CVE-2019-19032 High 2019-12-30 Not applicable Working exploit published XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload.
CVE-2018-7282 Critical 2019-12-06 Not applicable Exploited The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.
CVE-2019-18939 Critical 2019-11-14 Not applicable No public exploit eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request.
CVE-2019-12701 Medium 2019-10-02 Not applicable No public exploit A vulnerability in the file and malware inspection feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass the file and malware inspection policies on an affected system. The vulnerability exists because the affected software insufficiently validates incoming traffic. An attacker could exploit this vulnerability by sending a crafted HTTP request through an affected device. A successful exploit could allow the attacker to bypass the file and malware inspection policies and send malicious traffic through the affected device.
CVE-2019-14339 Medium 2019-09-05 Not applicable Working exploit published The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for the administrator web interface and WPA2-PSK key.
CVE-2018-20970 Medium 2019-08-21 Not applicable No public exploit The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
CVE-2017-18528 Medium 2019-08-20 Not applicable Working exploit published The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
CVE-2018-17213 High 2019-07-29 Not applicable No public exploit An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks.
CVE-2018-17211 Medium 2019-07-29 Not applicable No public exploit An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request.
CVE-2018-17210 High 2019-07-20 Not applicable No public exploit An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass the session checks (that would otherwise logout a low-privileged user) by calling the core print job components directly via crafted HTTP GET and POST requests.
CVE-2019-9505 Critical 2019-05-08 Not applicable No public exploit The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not sanitize special characters allowing for remote unauthorized changes to configuration files. An unauthenticated attacker may be able to remotely execute arbitrary code with SYSTEM privileges.
CVE-2018-5409 Critical 2019-05-08 Not applicable No public exploit The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.
CVE-2018-5408 High 2019-05-08 Not applicable No public exploit The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
CVE-2019-11565 Critical 2019-04-27 Not applicable No public exploit Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
CVE-2018-17169 High 2019-04-23 Not applicable No public exploit An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
CVE-2018-17168 Medium 2019-04-18 Not applicable No public exploit PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by following a link, can be tricked into making unwanted changes to a printer (Disable, Approve, etc).
CVE-2018-17167 Medium 2019-03-21 Not applicable No public exploit PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in the clustering configuration, (2) "name" field in the Edit Group configuration, (3) "Rule Name" field in the Access Control configuration, (4) "Service Name" in the Service Configuration, or (5) First Name or Last Name field in the Edit Account configuration.
CVE-2018-20106 High 2019-03-15 Not applicable No public exploit In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast.
CVE-2018-19936 Medium 2018-12-17 Not applicable No public exploit PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
CVE-2018-18006 Critical 2018-12-14 Not applicable No public exploit Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files.
CVE-2018-16710 Critical 2018-09-07 Not applicable No public exploit OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting OctoPrint onto the public internet is a terrible idea, and I really can't emphasize that enough.
CVE-2018-14902 High 2018-08-30 Not applicable No public exploit The ContentProvider in the EPSON iPrint application 6.6.3 for Android does not properly restrict data access. This allows an attacker's application to read scanned documents.
CVE-2018-14901 High 2018-08-30 Not applicable No public exploit The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.
CVE-2018-15748 High 2018-08-23 Not applicable No public exploit On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the HTML source code of the Email Settings webpage. In some cases, authentication can be achieved with the blank default password for the admin account. NOTE: the vendor indicates that this is an "End Of Support Life" product.
CVE-2018-12111 Medium 2018-06-11 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the /wt3/mydocs.php URI.
CVE-2018-10327 High 2018-05-17 Not applicable No public exploit PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user by reading the cps_config.xml file.
CVE-2018-10326 Medium 2018-05-17 Not applicable No public exploit PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest.
CVE-2017-16242 Medium 2018-03-22 Not applicable No public exploit An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices. The fingerprint authentication requirement for data access can be bypassed. An attacker with physical access can send a static packet to a serial port exposed on the PCB to unlock the key and get access to the data without possessing the required fingerprint.
CVE-2018-6644 High 2018-02-08 Not applicable No public exploit SBLIM Small Footprint CIM Broker (SFCB) 1.4.9 has a null pointer (DoS) vulnerability via a crafted POST request to the /cimom URI.
CVE-2018-5550 Medium 2018-02-08 Not applicable No public exploit Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allow untrusted users on the network to hijack a session cookie or perform other reflected XSS attacks on a currently logged-on user.
CVE-2017-3762 High 2018-01-26 Not applicable No public exploit Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system in which it is installed.
CVE-2014-3741 Critical 2017-10-23 Not applicable No public exploit The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
CVE-2015-3321 Medium 2017-10-03 Not applicable No public exploit Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and gain privileges via standard filesystem operations.
CVE-2017-14627 High 2017-09-23 Not applicable Working exploit published Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION tag), (2) name (inside the INFORMATION tag), (3) artist (inside the TRACK tag), or (4) default (inside the TEXT tag) parameter in an lpp project file.
CVE-2014-9514 Medium 2017-08-28 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in BMC Footprints Service Core 11.5.
CVE-2015-0839 High 2017-08-02 Not applicable No public exploit The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads.
CVE-2016-7818 High 2017-06-09 Not applicable No public exploit Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2017-2171 Medium 2017-05-22 Not applicable No public exploit Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
CVE-2010-4314 High 2017-03-11 Not applicable No public exploit Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the "name" parameter.
CVE-2016-4325 Critical 2016-05-14 Not applicable No public exploit Lantronix xPrintServer devices with firmware before 5.0.1-65 have hardcoded credentials, which allows remote attackers to obtain root access via unspecified vectors.
CVE-2016-3145 Medium 2016-04-22 Not applicable No public exploit Lexmark printers with firmware ATL before ATL.021.063, CB before CB.021.063, PP before PP.021.063, and YK before YK.021.063 mishandle Erase Printer Memory and Erase Hard Disk actions, which allows physically proximate attackers to obtain sensitive information via direct read operations on non-volatile memory.
CVE-2016-2393 High 2016-04-11 Not applicable No public exploit Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, which allows local users to gain privileges by invalidating local checks.
CVE-2016-1896 Critical 2016-01-27 Not applicable No public exploit Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.
CVE-2015-5631 Medium 2015-09-11 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in the Remote UI on Canon PIXMA MG7500 printers allows remote attackers to hijack the authentication of administrators.
CVE-2014-9003 Medium 2014-11-20 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as demonstrated by executing arbitrary commands using the c parameter in the rpc action.
CVE-2014-9002 High 2014-11-20 Not applicable No public exploit Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action.
CVE-2014-7875 High 2014-11-04 Not applicable No public exploit Unspecified vulnerability on the HP LaserJet CM3530 Multifunction Printer CC519A and CC520A with firmware before 53.236.2 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVE-2014-7129 Medium 2014-10-19 Not applicable No public exploit The Argus Leader Print Edition (aka com.argusleader.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-7122 Medium 2014-10-19 Not applicable No public exploit The Lansing State Journal Print (aka com.lansingjournal.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-2638 High 2014-10-10 Not applicable No public exploit Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2344.
CVE-2014-2637 High 2014-10-10 Not applicable No public exploit Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2342.
CVE-2014-2636 High 2014-10-10 Not applicable No public exploit Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2336.
CVE-2014-2635 High 2014-10-10 Not applicable No public exploit Unspecified vulnerability in HP Sprinter 12.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2343.
CVE-2014-8078 Low 2014-10-09 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 6.x-1.x before 6.x-1.19, 7.x-1.x before 7.x-1.3, and 7.x-2.x before 7.x-2.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to nodes.
CVE-2014-6842 Medium 2014-09-30 Not applicable No public exploit The Daily Advertiser Print (aka com.lafayettedailyadv.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5652 Medium 2014-09-09 Not applicable No public exploit The Kicksend Photo Prints (aka com.kicksend.android.print) application 1.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5545 Medium 2014-09-09 Not applicable No public exploit The Sprint jump (aka air.com.ilaz.appilas) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-2751 High 2014-04-10 Not applicable No public exploit SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2013-2693 Medium 2014-04-10 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in the Options in the WP-Print plugin before 2.52 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unspecified vectors.
CVE-2012-6108 Low 2014-02-15 Not applicable No public exploit HP Linux Imaging and Printing (HPLIP) before 3.13.2 uses world-writable permissions for /var/log/hp and /var/log/hp/tmp, which allows local users to delete log files via standard filesystem operations.
CVE-2013-2820 High 2014-01-15 Not applicable No public exploit The Sierra Wireless AirLink Raven X EV-DO gateway 4221_4.0.11.003 and 4228_4.0.11.003 allows remote attackers to reprogram the firmware via a replay attack using UDP ports 17336 and 17388.
CVE-2013-2819 High 2014-01-15 Not applicable No public exploit The Sierra Wireless AirLink Raven X EV-DO gateway 4221_4.0.11.003 and 4228_4.0.11.003 allows remote attackers to install Trojan horse firmware by leveraging cleartext credentials in a crafted (1) update or (2) reprogramming action.
CVE-2013-6402 Low 2014-01-05 Not applicable No public exploit base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
CVE-2013-6193 Medium 2013-12-17 Not applicable No public exploit Unspecified vulnerability on HP LaserJet M1522n and M2727; LaserJet Pro 100, 300, 400, CM1415fnw, CP1*, M121*, M1536dnf, and P1*; Color LaserJet CM* and CP*; and TopShot LaserJet Pro M275 printers allows remote attackers to cause a denial of service via unknown vectors.
CVE-2013-6427 Medium 2013-12-09 Not applicable No public exploit upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
CVE-2013-3708 Medium 2013-12-01 Not applicable No public exploit The id1.GetPrinterURLList function in Novell iPrint Client before 5.93 allows remote attackers to cause a denial of service via unspecified vectors.
CVE-2013-4325 Medium 2013-09-23 Not applicable No public exploit The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.
CVE-2013-4807 High 2013-08-05 Not applicable No public exploit Unspecified vulnerability on the HP LaserJet Pro P1102w, P1606dn, M1212nf MFP, M1213nf MFP, M1214nfh MFP, M1216nfh MFP, M1217nfw MFP, M1218nfs MFP, and CP1025nw with firmware before 2013-07-26 20130703 allows remote attackers to modify data via unknown vectors.
CVE-2013-4615 Medium 2013-06-21 Not applicable No public exploit The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to English/pages_MacUS/lan_set_content.html. NOTE: the vendor has apparently responded by stating "Canon believes that its printers will not have to deal with unauthorized access to the network from an external location as long as the printers are used in a secured environment."
CVE-2013-4614 Low 2013-06-21 Not applicable No public exploit English/pages_MacUS/wls_set_content.html on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers shows the Wi-Fi PSK passphrase in cleartext, which allows physically proximate attackers to obtain sensitive information by reading the screen of an unattended workstation.
CVE-2013-4613 High 2013-06-21 Not applicable No public exploit The default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers does not require authentication, which allows remote attackers to modify the configuration by visiting the Advanced page. NOTE: the vendor has apparently responded by stating "for user convenience, the default setting does not require a password. However, if a user has a particular concern about third parties accessing the user's home printer, the default setting can be changed to add a password."
CVE-2013-1091 High 2013-05-02 Not applicable No public exploit Stack-based buffer overflow in Novell iPrint Client before 5.90 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2012-5219 Medium 2013-04-28 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in HP Managed Printing Administration (MPA) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-5215 High 2013-03-09 Not applicable No public exploit Unspecified vulnerability on the HP LaserJet Pro M1212nf, M1213nf, M1214nfh, M1216nfh, M1217nfw, and M1219nf, and HotSpot LaserJet Pro M1218nfs, with firmware before 20130211; LaserJet Pro CP1025nw with firmware before 20130212; and LaserJet Pro P1102w and P1606dn with firmware before 20130213 allows remote attackers to modify data or cause a denial of service via unknown vectors.
CVE-2013-0200 Low 2013-03-06 Not applicable No public exploit HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.
CVE-2013-0415 Medium 2013-01-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Bind/Postinstall script for Bind package.
CVE-2013-0407 Medium 2013-01-17 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/DTrace Framework.
CVE-2012-0569 Low 2013-01-17 Not applicable No public exploit Unspecified vulnerability Oracle Sun Solaris 10 allows local users to affect confidentiality and integrity via unknown vectors related to Install/smpatch.
CVE-2012-0411 High 2012-12-24 Not applicable No public exploit Unspecified vulnerability in Novell iPrint Client before 5.82 allows remote attackers to execute arbitrary code via an op-client-interface-version action.
CVE-2012-4964 High 2012-11-28 Not applicable No public exploit The Samsung printer firmware before 20121031 has a hardcoded read-write SNMP community, which makes it easier for remote attackers to obtain administrative access via an SNMP request.
CVE-2012-2084 Medium 2012-11-22 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Printer, email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably the PATH_INFO.
CVE-2012-5334 High 2012-10-08 Not applicable Working exploit published SQL injection vulnerability in product_desc.php in Pre Printing Press allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVE-2012-5333 High 2012-10-08 Not applicable Working exploit published SQL injection vulnerability in page.php in Pre Printing Press allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-4756 Medium 2012-09-06 Not applicable No public exploit Multiple untrusted search path vulnerabilities in CyberLink LabelPrint 2.5.3602 allow local users to gain privileges via a Trojan horse (1) mfc71loc.dll or (2) mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .lpp file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2012-2017 High 2012-06-30 Not applicable No public exploit Unspecified vulnerability on HP Photosmart Wireless e-All-in-One B110, e-All-in-One D110, Plus e-All-in-One B210, eStation All-in-One C510, Ink Advantage e-All-in-One K510, and Premium Fax e-All-in-One C410 printers allows remote attackers to cause a denial of service via unknown vectors.
CVE-2011-2722 Low 2012-05-25 Not applicable No public exploit The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.
CVE-2012-1239 High 2012-04-06 Not applicable Working exploit published The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmware 30x through 302, 35x through 354, and 4xx through 421 allows remote attackers to bypass authentication and obtain administrative privileges via unspecified vectors.
CVE-2012-0773 High 2012-03-28 Not applicable Exploited The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and 11.x before 11.2.202.223 on Solaris; Flash Player before 11.1.111.8 on Android 2.x and 3.x; and AIR before 3.2.0.2070 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2011-4187 High 2012-02-21 Not applicable No public exploit Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173.
CVE-2011-4186 High 2012-02-21 Not applicable No public exploit Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.
CVE-2011-4185 High 2012-02-21 Not applicable No public exploit The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and CVE-2008-2436.
‹ prev page 3 of 5 next ›