Epson: >> Eps Tse Server 8 Firmware >> 21.0.11 Security Vulnerabilities
Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to force an administrator to execute external POST requests by visiting a malicious website.
CVSS Score
8.8
EPSS Score
0.004
Published
2020-12-16
Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI.
CVSS Score
9.8
EPSS Score
0.02
Published
2020-12-16
A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator.
CVSS Score
5.4
EPSS Score
0.004
Published
2020-12-16