Oliver Matula

يُعتبر PaperCut Print Deploy، وهو مكون اختياري مدمج في PaperCut NG/MF، عرضة لهجمات «الرجل في الوسط» (man-in-the-middle) إذا لم يتم تكوينه بشكل صحيح باستخدام شهادة موثوقة. وقد تؤدي الوثائق غير الكافية حول تكوين SSL إلى تكوين غير صحيح لتثبيت العميل، مما قد يعرض الاتصالات بين العملاء والخادم للخطر.

The issue is related to incorrect access controls for the file ResetUserInfo.php, allowing an unauthenticated attacker to change the password of arbitrary users.

The issue is a cross-site scripting (XSS) vulnerability in the SideForStudent.php file, specifically via the `modname` parameter. This allows for potential malicious script injection and execution.

The issue is related to errors in SSH key management, allowing a remote attacker to connect to the system with root privileges via IPv6. This is due to the presence of a default SSH key pair in all devices. An attacker could exploit this by opening an SSH connection via IPv6 using the extracted key materials, gaining access to the system with root privileges. The vulnerability is only exploitable over IPv6.

A vulnerability exists in the system shell due to incorrect symbolic link verification of directory paths, allowing an authenticated, local attacker to overwrite sensitive system files by providing crafted user input to specific symbolic link CLI commands. The attacker would need valid device credentials to exploit this issue. Successful exploitation could allow the attacker to overwrite system files that should be restricted.