Filtered by vendor Papercut Subscriptions
Filtered by product Papercut Ng Subscriptions

Search

Switch to Advanced Search (Beta)
Total 26 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-4568 1 Papercut 1 Papercut Ng 2024-11-21 6.5 Medium
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.
CVE-2023-3486 1 Papercut 2 Papercut Mf, Papercut Ng 2024-11-21 8.2 High
An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. This could exhaust system resources and prevent the service from operating as expected.
CVE-2023-31046 1 Papercut 2 Papercut Mf, Papercut Ng 2024-11-21 6.5 Medium
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach getStaticContent in UIContentResource.class in the static-content-files servlet.
CVE-2019-8948 1 Papercut 2 Papercut Mf, Papercut Ng 2024-11-21 N/A
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
CVE-2019-12135 1 Papercut 2 Papercut Mf, Papercut Ng 2024-11-21 N/A
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector.
CVE-2024-8405 1 Papercut 2 Papercut Mf, Papercut Ng 2024-10-03 6.1 Medium
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) attack. Note: This CVE has been split from CVE-2024-4712.