Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Jul 29, 2019An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4.CVE-2018-17213 · Other software · Printeron · reported by MITREHigh 8.8
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks.
- Product
- Central Print Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2019An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4.CVE-2018-17211 · Other software · Printeron · reported by MITREMedium 5.3
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request.
- Product
- Central Print Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2019An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4.CVE-2018-17210 · Other software · Printeron · reported by MITREHigh 8.8
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass the session checks (that would otherwise logout a low-privileged user) by calling the core print job components directly via crafted HTTP GET and POST requests.
- Product
- Central Print Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2019An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-sideCVE-2018-17169 · Other software · Printeron · reported by MITREHigh 7.7
An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2019PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page.CVE-2018-17168 · Other software · Printeron · reported by MITREMedium 6.5
PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by following a link, can be tricked into making unwanted changes to a printer (Disable, Approve, etc).
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in theCVE-2018-17167 · Other software · Printeron · reported by MITREMedium 5.4
PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in the clustering configuration, (2) "name" field in the Edit Group configuration, (3) "Rule Name" field in the Access Control configuration, (4) "Service Name" in the Service Configuration, or (5) First Name or Last Name field in the Edit Account configuration.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2018PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.CVE-2018-19936 · Other software · Printeron · reported by MITREMedium 6.5
PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
May 17, 2018PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user CVE-2018-10327 · Other software · Printeron · reported by MITREHigh 7
PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user by reading the cps_config.xml file.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) descripCVE-2018-10326 · Other software · Printeron · reported by MITREMedium 5.4
PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.