CVE-2023-4818 | High | 7.6 | 2024-01-15 | PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be u… |
CVE-2023-42137 | High | 7.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malici… |
CVE-2023-42136 | High | 7.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account pr… |
CVE-2023-42135 | Medium | 6.8 | 2024-01-15 | PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the in… |
CVE-2023-42134 | Medium | 6.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code… |
CVE-2023-27199 | Medium | 6.7 | 2023-07-05 | PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization ch… |
CVE-2023-27198 | Medium | 6.8 | 2023-07-05 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow the execution of arbitrary commands by using the exec service and including a specific wo… |
CVE-2023-27197 | Medium | 6.7 | 2023-07-05 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.5.02_20220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported functi… |
CVE-2022-26582 | High | 7.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attack… |
CVE-2022-26581 | Medium | 6.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an unauthorized attacker to perform privileged actions through the execution of specifi… |
CVE-2022-26580 | Medium | 6.8 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in the ADB daemon she… |
CVE-2022-26579 | Medium | 6.0 | 2022-12-16 | PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacker must have shell a… |
CVE-2020-36128 | High | 8.2 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Term… |
CVE-2020-36127 | Medium | 6.5 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an adm… |
CVE-2020-36126 | High | 8.1 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketpl… |
CVE-2020-36125 | High | 7.1 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypa… |
CVE-2020-36124 | Medium | 6.5 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the privat… |