Ncr Terminal Handler vulnerabilities
9 vulnerabilities
Known vulnerabilities in Ncr Terminal Handler, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2023-47298ncrterminal_handler
EPSS score0.27%
An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application including their usernames, roles, security groups and account statuses.CVE-2023-47294ncrterminal_handlerEPSS score0.33%
An issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, lock, and delete user accounts via a crafted session cookie.CVE-2023-47030ncrterminal_handlerEPSS score0.73%
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists.CVE-2023-47031ncrterminal_handlerEPSS score0.62%
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization SOAP API component.CVE-2023-47032ncrterminal_handlerEPSS score0.82%
Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserService SOAP API function.CVE-2023-47029ncrterminal_handlerEPSS score0.72%
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted POST request to the UserService componentCVE-2023-47297ncrterminal_handlerEPSS score0.51%
A settings manipulation vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands, including editing system security auditing configurations.CVE-2023-47295ncrterminal_handlerEPSS score0.60%
A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings.CVE-2023-47022ncrterminal_handlerEPSS score0.34%
Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection.