CVE-2019-14339

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for the administrator web interface and WPA2-PSK key.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154266/Canon-PRINT-2.5.5-URI-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://play.google.com/store/apps/details?id=jp.co.canon.bsd.ad.pixmaprint&hl=en_USProduct, Third Party Advisory
http://packetstormsecurity.com/files/154266/Canon-PRINT-2.5.5-URI-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://play.google.com/store/apps/details?id=jp.co.canon.bsd.ad.pixmaprint&hl=en_USProduct, Third Party Advisory

Timeline

Published: Sep 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-14347.8An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak CVE-2019-143435.4TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.CVE-2019-143446.1TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI.CVE-2019-143459.8TemaTres 3.0 allows remote unprivileged users to create an administrator account CVE-2019-143468.8Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password.CVE-2019-143478.8Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account CVE-2019-143489.8The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seaso CVE-2019-143496.1EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for s CVE-2019-14357.8An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi CVE-2019-143506.1EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can in CVE-2019-143518.8EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 CVE-2019-143527.8In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crm_community/crm_userv