Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
680 results · page 8 of 14
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24883 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authCVE-2023-27520 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpMedium 6.5
Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
- Product
- SEIKO EPSON printers/network interface Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege CVE-2023-23572 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
- Product
- SEIKO EPSON printers/network interface Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated CVE-2023-23594 · Other software · Sato-global · reported by MITRECritical 9.8
An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes.
- Product
- Cl4nx Plus Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd2n1rly8br52rx.cloudfront.nethackandpwn.com
Mar 29, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers.CVE-2022-43608 · Other software · Canon · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16032.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.canonzerodayinitiative.com
Mar 28, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.CVE-2022-24674 · Other software · Canon · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusa.canon.comzerodayinitiative.com
Mar 28, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.CVE-2022-24673 · Other software · Canon · reported by zdi-disclosures@trendmicro.comCritical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusa.canon.comzerodayinitiative.com
Mar 28, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.CVE-2022-24672 · Other software · Canon · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusa.canon.comzerodayinitiative.com
Mar 24, 2023In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-terminator.CVE-2023-21028 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-terminator. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-180680572
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24913 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24911 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24909 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24907 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24906 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24876 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24872 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24870 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24868 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24867 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24866 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege VulnerabilityCVE-2023-24864 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24863 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24858 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24857 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24856 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-23413 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-23406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-23403 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 21, 2023 Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could beCVE-2023-24575 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could be exploited by malicious users to compromise the affected system
- Product
- Dell Multifunction Printer E525w Driver and Software Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-21801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-21693 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.7
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-21684 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 10, 2023Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).CVE-2022-44261 · Other software · Averydennison · reported by MITREMedium 6.1
Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
- Product
- Monarch Printer M9855 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows CVE-2022-48311 · Other software · HP · reported by MITRECritical 9
**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows authenticated attacker to inject their own script into the page via HTTP configuration page. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Deskjet 2540 A9u23b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers.CVE-2023-24040 · Other software · Opengroup · reported by MITREHigh 7.1
dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers. This allows low-privileged local users to inject arbitrary printer names via the $HOME/.printers file. This injection allows those users to manipulate the control flow and disclose memory contents on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Common Desktop Environment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Dec 31, 2022A vulnerability was found in Exciting Printer and classified as critical.CVE-2017-20156 · Other software · Exciting · reported by VulDBMedium 5.5
A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.
- Product
- Printer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or eCVE-2022-45796 · Other software · SHARP · reported by ART@zuso.aiCritical 9.1
Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System (Monochrome) 200 or earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlier, 401 or earlier allows remote attackers to execute arbitrary commands via unspecified vectors.
- Product
- SHARP multifunction printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgglobal.sharp
Dec 12, 2022Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.CVE-2022-43780 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.5
Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.
- Product
- Certain HP ENVY, OfficeJet, and DeskJet printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 12, 2022Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.CVE-2022-2794 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.5
Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.
- Product
- Certain HP PageWide Pro printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 12, 2022A potential security vulnerability has been identified for certain HP multifunction printers (MFPs).CVE-2021-3821 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial of Service when running HP Workpath solutions on potentially affected products.
- Product
- HP FutureSmart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 4, 2022Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilegCVE-2022-41830 · Other software · KYOCERA Document Solutions Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
- Product
- Kyocera Document Solutions MFPs and printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkyoceradocumentsolutions.co.jp
Dec 4, 2022Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product setCVE-2022-41807 · Other software · KYOCERA Document Solutions Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product settings without authentication by sending a specially crafted request. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
- Product
- Kyocera Document Solutions MFPs and printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkyoceradocumentsolutions.co.jp
Dec 4, 2022Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log inCVE-2022-41798 · Other software · KYOCERA Document Solutions Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with guessed session information. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
- Product
- Kyocera Document Solutions MFPs and printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkyoceradocumentsolutions.co.jp
Sep 1, 2022A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instanCVE-2020-27784 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free().
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 24, 2022PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal.CVE-2022-32427 · Other software · Printerlogic · reported by MITREHigh 8.8
PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename could exploit this to escalate privileges or distribute malicious content. This issue has been resolved in PrinterLogic Windows Client 25.0.0688 and all affected are advised to upgrade.
- Product
- Windows Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.printercloud.comprinterlogic.com
Apr 4, 2022Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, thrCVE-2022-1026 · Other software · Kyocera · reported by cve@rapid7.comHigh 8.6
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
- Product
- Multifunction Printer Net Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkyoceradocumentsolutions.comrapid7.com
Feb 15, 2022RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 221CVE-2021-33945 · Other software · Ricoh · reported by MITRECritical 9.8
RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 221SF, SP 220SFNw, SP 221SFNw v1.06 were discovered to contain a stack buffer overflow in the file /etc/wpa_supplicant.conf. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
- Product
- SP 320dn Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw,CVE-2021-20877 · Other software · Canon · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Canon laser printers and small office multifunctional printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticateCVE-2021-42642 · Other software · Printerlogic · reported by MITREHigh 7.5
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.