PaperCut

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG.

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files.

This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges.

An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage.

PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability.

PaperCut NG allows for unauthenticated XMLRPC commands to be run by default.

This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server.

This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attack…

A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1.

PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.

An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector.

PaperCut NG/MF contains an observable timing discrepancy in its authentication component.

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component.

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation.

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability.

An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary command…

A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF.

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution.