Vulnerabilidades do Newell Brands DYMO ID

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Newell Brands DYMO ID: 2 registro(s), com versões afetadas e correções.

CVE-2026-102262 Alta · 7.3 CWE-22 05/10/2026

Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0.

CVE-2026-101893 Média · 4.4 CWE-611 05/10/2026

Newell Brands DYMO ID document parsing failing file type extension authentication check

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.