Vulnerabilities

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices.

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation.

An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary command…

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine.

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG.

PaperCut NG/MF contains an observable timing discrepancy in its authentication component.

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component.

An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows.

An issue was discovered in the PaperCut Hive Ricoh embedded application.

An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4).

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices.

The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking.

Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields.

PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management.

A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF.

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability.

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.

An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled.

An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled.

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.

PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability.

This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attack…

This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server.

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.