Lexmark Security Advisory: Cross Site Scripting vulnerabilitiesabre em uma nova guia (CVE-2019-19772, CVE-2019-19773)
Two Cross Site Scripting vulnerabilities have been identified in older Lexmark devices.
Stored Cross Site Scripting Vulnerabilityabre em uma nova guia (CVE-2019-18791)
A stored cross site scripting vulnerability has been identified in older Lexmark devices.
Lexmark Service Monitor directory traversal vulnerabilityabre em uma nova guia (CVE-2019-16758)
Lexmark Services Monitor, (LSM) contains a directory traversal vulnerability that can be exploited to extract files from the system on which LSM is installed.
SNMP Denial of Service Vulnerabilityabre em uma nova guia (CVE-2019-9931)
Some Lexmark printers contain a vulnerability in their SNMP service that can be exploited to crash the device.
Lexmark Overflow Vulnerabilitiesabre em uma nova guia (CVE-2019-9930, CVE-2019-9932, CVE-2019-9933)
Many older Lexmark devices contain overflow vulnerabilities that can lead to execution of arbitrary code on the device.
Cross Site Request Forgeryabre em uma nova guia (CVE-2019-10057)
Some older Lexmark devices embedded web server are vulnerable to a contain a cross site request forgery attack that allows a local account password to be changed without the knowledge of the authenticated user.
Account Lockoutabre em uma nova guia (CVE-2019-10058)
Account lockout functionality is missing from a few older Lexmark devices.
Information Disclosure via finger serviceabre em uma nova guia (CVE-2019-10059)
The finger service should be disabled, it provides unauthenticated access to device diagnostic information.
Information Disclosure Vulnerabilityabre em uma nova guia (CVE-2019-9934, CVE-2019-9935)
A few older Lexmark devices did not restrict access to sensitive menus in the embedded web server.
Shortcut Integrity vulnerabilityabre em uma nova guia (CVE-2019-6489)
Many older Lexmark multi-function devices contain a vulnerability that allows an unauthenticated user to purge stored shortcuts.
Information Disclosure Vulnerabilityabre em uma nova guia (CVE-2017-13771)
Exposure of network credentials in Scan to Network app in some Lexmark devices.
Information Disclosure Vulnerabilityabre em uma nova guia (CVE-2018-17944)
Credentials to external LDAP and SMTP servers stored in Lexmark devices can be extracted by the device administrator.
Directory Traversal Vulnerabilityabre em uma nova guia (CVE-2018-18894)
A directory traversal vulnerability has been identified in the embedded web server used in older generation Lexmark devices. The vulnerability allows unauthenticated access to sensitive files on the device.
Apache Tomcat vulnerabilityabre em uma nova guia (CVE-2018-8037)
Markvision Enterprise (MVE) uses Apache Tomcat which is vulnerable to an information disclosure bug that could allow an attacker to reuse session credentials from a previous user’s session in a new session.
Apache Tomcat Vulnerabilityabre em uma nova guia (CVE-2018-1336)
Markvision Enterprise (MVE) uses Apache Tomcat which is vulnerable to a bug that could allow an attacker to cause MVE to enter an infinite loop and produce a denial of service condition.
Buffer Overflow Vulnerabilityabre em uma nova guia (CVE-2018-15519, CVE-2018-15520)
Lexmark has identified a buffer overflow vulnerability in some models of multi-function devices handling of color fax jobs. This vulnerability allows an attacker with crafted fax data to create a denial of service condition, and in some situations to execute arbitrary code on an affected device.
Markvision Enterprise is vulnerable to Spring Data REST 2.6.6abre em uma nova guia (CVE-2017-8046)
Markvision Enterprise (MVE) uses Spring Data REST 2.6.6 which is vulnerable to malicious HTTP PATCH requests and with specially crafted JSON data will run arbitrary Java code.
KRACK Vulnerabilitiesabre em uma nova guia (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088)
Lexmark has learned of a series of weaknesses in WPA2, the protocol that secures all modern protected WiFi networks. This vulnerability can allow the disclosure of information that was assumed to be safely encrypted.
Pivotal Spring-LDAP vulnerabilityabre em uma nova guia (CVE-2017-8028)
Markvision Enterprise contains a vulnerability when configured to use TLS binding for LDAP that allows clients to logon with a valid username and any arbitrary password.
Spectre and Meltdown Vulnerabilitiesabre em uma nova guia (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754)
Lexmark has learned of a series of vulnerabilities reported in several CPU's that perform speculative execution. The vulnerabilities could at worst be used by an attacker to read arbitrary virtual memory across security boundaries. Lexmark devices are not affected by these vulnerabilities.
Orpheus' Lyre Vulnerabilityabre em uma nova guia (CVE-2017-11103)
A vulnerability in Heimdal (an implementation of Kerberos 5) before release 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification.
WannaCry Ransomware Vulnerabilityabre em uma nova guia (MS17-010, CVE-2017-0143)
Lexmark devices are not vulnerable to WannaCry ransomware or to the following associated exploits: EternalBlue, EternalSynery, EternalRomance, EternalChampion. This attack propagates through Microsoft SMBv1 servers.
Linux kernel udp.c vulnerabilityabre em uma nova guia (CVE-2016-10229)
A vulnerability in udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic on affected devices.
Xalan Java Vulnerabilityabre em uma nova guia (CVE-2014-0107)
Markvision Enterprise contains a vulnerability that allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources.
File Upload Vulnerabilityabre em uma nova guia (CVE-2016-3092)
Markvision Enterprise contains a vulnerability that allows remote attackers to cause a denial of service.
Remote code execution vulnerabilityabre em uma nova guia (CVE-2016-6918)
Markvision Enterprise contains a vulnerability that allows an unauthenticated remote attacker to upload files and execute arbitrary commands with the privilege of the Markvision Enterprise application.
XLS parsing buffer overflow vulnerabilityabre em uma nova guia (CVE-2016-4335)
A vulnerability was discovered in the XLS parsing function that provides the potential for an attacker to execute arbitrary code on an affected devices.
Arbitrary code execution vulnerabilities in Lexmark Perceptive Document Filtersabre em uma nova guia (CVE-2016-5646, CVE-2016-4336, CVE-2016-4335)
Lexmark has learned of three separate vulnerabilities in Lexmark Perceptive Document Filters that, under certain circumstances, could lead to arbitrary code execution.
Out of Service Memory Erase Failureabre em uma nova guia (CVE-2016-3145)
Under certain circumstances some Lexmark printers will fail to erase stored information when requested.
Glibc Getaddrinfo() Stack Buffer Overflowabre em uma nova guia (CVE-2015-7547)
Lexmark has learned of a vulnerability in the “glibc” client side resolver library that provides the potential for an attacker to execute arbitrary code on an affected system.
Markvision Java Serialization Vulnerabilityabre em uma nova guia (CVE-2016-1487)
Markvision Enterprise contains a vulnerability that allows for unauthenticated remote execution of commands on the MVE server.
Race Condition During Initializationabre em uma nova guia (CVE-2016-1896)
Under certain circumstances during initialization, some Lexmark printers have a race condition that allows unauthenticated access to device functions.
Logjam Vulnerability in Diffie-Hellman Key Exchangeabre em uma nova guia (CVE-2015-4000)
Lexmark has learned of a vulnerability on some implementations of the SSL/TLS protocol that allows an attacker to compromise the communicators over that protocol.
FREAK: Factoring Attack on RSA-Export Vulnerabilityabre em uma nova guia (CVE-2015-0204)
Lexmark has learned of a vulnerability in some implementations of the SSL/TLS protocol that allows an attacker to compromise communications over that protocol.
GHOST Glibc Buffer Overflow Vulnerabilityabre em uma nova guia (CVE-2015-0235)
Lexmark has learned of a vulnerability in the "glibc" library that provides the potential for an attacker to execute arbitrary code on an affected system.
Markvision Input Validation Vulnerabilityabre em uma nova guia (CVE-2014-9375)
Markvision Enterprise contains a vulnerability that allows uploaded ZIP files to be unpacked into arbitrary locations.
Markvision Remote Code Execution Vulnerabilityabre em uma nova guia (CVE-2014-8741)
MarkVision Enterprise contains a vulnerability that allows an unauthenticated remote attacker to upload files and execute arbitrary commands with the privilege of the MarkVision Enterprise application.
Markvision Input Validation Vulnerabilityabre em uma nova guia (CVE-2014-8742)
MarkVision Enterprise contains a vulnerability that allows an unauthenticated remote attacker to download arbitrary files from the MarkVision Enterprise platform.
POODLE Vulnerabilityabre em uma nova guia (CVE-2014-3566)
Lexmark has learned of a vulnerability in the SSLv3 protocol which allows an attacker with the ability to intercept and insert traffic (Man-In-The-Middle) to decrypt a portion of the encrypted communication.
Bash "shellshock" Vulnerabilitiesabre em uma nova guia (CVE-2014-6271)
Lexmark has learned of a series of vulnerabilities in the open-source bash shell program that allows an attacker to execute arbitrary commands on a vulnerable system. No Lexmark devices or software products are affected by this vulnerability.
Open SSL CCS Injection Vulnerabilityabre em uma nova guia (CVE-2014-0224)
Lexmark has learned of a group of vulnerabilities in certain versions of the open-source OpenSSL library that can be exploited by a Man-In-The-Middle attack. Multiple Lexmark products are affected by this vulnerability.
Open SSL Heartbleed Vulnerabilityabre em uma nova guia (CVE-2014-0160)
Lexmark has learned of a vulnerability in certain versions of the open-source OpenSSL Library that allows unauthenticated access to private memory of printer devices and computer systems. Multiple Lexmark products are affected by this vulnerability.
HTML injection vulnerabilityabre em uma nova guia (CVE-2013-6033)
Some Lexmark Printers do not properly sanitize user supplied values for the "Contact" and "Location" settings. This vulnerability can be exploited to execute arbitrary HTML or script code in the browser of anyone viewing the devices embedded web server.
Password Reset vulnerabilityabre em uma nova guia (CVE-2013-6032)
Some Lexmark Printers and MarkNet devices will fail to authenticate a specially crafted password reset request. This vulnerability can be exploited to bypass authentication configured on the device.
Markvision Unauthorized access vulnerabilityabre em uma nova guia (CVE-2013-3055)
Markvision Enterprise contains a vulnerability that allows an unauthenticated remote attacker to access and modify configuration data and fleet management information, in addition to executing commands within the application.
Information leakage vulnerabilityabre em uma nova guia (CVE-2011-4538)
Some Lexmark Multifunction Devices include sensitive configuration values in exported settings files. This vulnerability can be exploited to enable unauthorized disclosure of device configuration information.
Email shortcut vulnerability Security Vulnerabilityabre em uma nova guia (CVE-2011-3269)
Some Lexmark Multifunction Devices allow the creation of email shortcuts that contain hidden recipients. This vulnerability can be exploited to enable unauthorized personnel to receive a covert copy of email sent by the device using the modified shortcut.
PJL Remote Buffer Overflow Security Vulnerabilityabre em uma nova guia (CVE-2010-0619)
Some Lexmark Laser Printers contain remote buffer overflow vulnerabilities in their PJL processing functionality. These vulnerabilities could potentially lead to remote code execution, but no malicious use of this vulnerability is known.
FTP Denial of Service Security Vulnerabilityabre em uma nova guia (CVE-2010-0618)
Some Lexmark Printers and MarkNet devices contain denial of service vulnerabilities in the FTP service. These vulnerabilities can be exploited with repeated aborted FTP connections to the printer, causing the printer to ignore incoming TCP network connections to multiple services.
HTTP Denial of service vulnerabilityabre em uma nova guia (CVE-2010-0101)
Some Lexmark Printers and MarkNet Devices contain a denial of service vulnerability in their HTTP service. This vulnerability can be exploited to crash the printer.
SSL Denial of service vulnerabilityabre em uma nova guia (CVE-2004-0079)
Some Lexmark Printers and MarkNet Devices contain a denial of service vulnerability in their SSL/TLS processing. This vulnerability can be exploited to crash the printer.