CVE Vulnerability Catalog

Vasion Print Virtual Appliance Host and Application contain a protection mechanism failure in the file_get_contents() function. An administrator can set a printer hostname to a malicious server that redirects to internal endpoints such as the AWS EC2 metadata service, enabling theft of IAM keys and further pivoting.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script. An unauthenticated attacker can exploit the lack of validation of the printer host address to send requests to internal services.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 contain a blind SSRF vulnerability in the console_release/hp/log_off_single_sign_on.php script exploitable by an unauthenticated user. The application builds a URL from the printer host name and sends a curl request without validation, whitelist, or private-network filtering.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 contain a blind SSRF vulnerability in the console_release/hp/installApp.php script exploitable by an unauthenticated user. The application builds a URL from the printer host name and sends a curl request without validation, whitelist, or private-network filtering.

Vasion Print Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 contains an /api-gateway/identity/search-groups endpoint that does not require authentication. An unauthenticated remote attacker can enumerate all group objects for a tenant, and the response includes internal identifiers.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the hostname `pl-local.com` and is used by the appliance to terminate TLS connections on ports 80/443. Because the key is hardcoded, any attacker who can gain container-level access can simply read the files and obtain the private key. With the private key, the attacker can decrypt TLS traffic, perform man-in-the-middle attacks, or forge TLS certificates. This enables impersonation of the appliance’s web UI, interception of credentials, and unrestricted access to any services that trust the certificate. The same key is identical across all deployed appliances meaning a single theft compromises the confidentiality of every Vasion Print installation.

Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.

Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

There is a reflected cross-site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

There is a reflected cross-site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

There is a reflected cross-site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

Esri Portal for ArcGIS 11.4 and below has a reflected cross-site scripting (XSS) vulnerability. A remote authenticated attacker with administrative access can supply a crafted string that executes arbitrary JavaScript code in the browser.

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources.

In the Payeer Android application version 2.5.0, an improper access control vulnerability exists in the PIN change authentication flow. A local attacker with root access can dynamically instrument the app to bypass the current PIN verification and directly modify the authentication PIN. This allows unauthorized users to change the PIN without knowing the original/current PIN.

A stored cross-site scripting (XSS) vulnerability was found in FairSketch RISE Ultimate Project Manager & CRM 3.9.4. An administrator can inject malicious JavaScript code when creating new folders via the file explorer in the admin dashboard.