CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

CVE-2024-37364

Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information such as hotel invoice content with PII, and potentially create unauthorized room keys, by entering a guest-search quote character and then...

CVE-2022-24287

A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3 UC06, SIMATIC PCS 7 V9.1 All versions V9.1 SP1 UC01, SIMATIC WinCC Runtime Professional V16 and earlier All versions, SIMATIC WinCC Runtime Professional V17 All versions V17 Upd4,...

CVE-2024-36498

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

CVE-2024-36498

The Image Access Scan2Net software (versions 7.40 and earlier , 7.42 and earlier , and 7.42B and earlier ) is vulnerable to a stored cross-site scripting (XSS) flaw due to improper input sanitization. An attacker with Poweruser or Admin privileges can use the **

CVE-2024-47947

The software Image Access Scan2Net (versions 7.40, 7.42, and 7.42B and earlier) is vulnerable to stored cross-site scripting (XSS) due to missing input sanitization. An attacker with Poweruser or Admin privileges can exploit the "Edit Disclaimer Text" function located at https://$SCANNER/cgi/admi...

CVE-2024-36498: Improper Neutralization of Input During Web Page Generation

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

CVE-2024-47947: Improper Neutralization of Input During Web Page Generation

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

PT-2024-32909 · Unknown · Scanwizard

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to missing input sanitization, allowing an attacker to perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit...

CVE-2024-28140

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and...

CVE-2024-28140

The Image Access Scan2Net scanner device is vulnerable to a violation of the least privilege principle (CWE-250). By default, the device boots into a kiosk mode that opens the Scan2Net interface in a web browser running with root privileges . Additionally, several other applications on the device...

CVE-2024-28140 Violation of Least Privilege Principle

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and...

Image Access Scan2Net 安全漏洞

Image Access Scan2Net is a scanning software from the German company Image Access. A security vulnerability exists in Image Access Scan2Net, which originates when the scanner device boots into kiosk mode by default and opens the Scan2Net interface in a browser window. The browser is running with...

CVE-2024-28140: Execution with Unnecessary Privileges

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and...

CVE-2023-52952

A vulnerability has been identified in HiMed Cockpit 12 pro J31032-K2017-H259 All versions = V11.5.1 = V11.5.1 = V11.5.1 = V11.5.1 V11.6.2. The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to...

CVE-2023-52952

A vulnerability has been identified in HiMed Cockpit 12 pro J31032-K2017-H259 All versions = V11.5.1 = V11.5.1 = V11.5.1 = V11.5.1 V11.6.2. The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to...

CVE-2023-52952

CVE-2023-52952 affects Siemens HiMed Cockpit devices (12 pro, 14 pro+, 18 pro, 18 pro+) with versions V11.5.1 up to but not including V11.6.2. The Kiosk Mode exposes a restricted desktop environment escape vulnerability that could allow an unauthenticated local attacker to escape the restricted e...

CVE-2023-52952

A vulnerability has been identified in HiMed Cockpit 12 pro J31032-K2017-H259 All versions = V11.5.1 = V11.5.1 = V11.5.1 = V11.5.1 V11.6.2. The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to...

PT-2024-14789 · Unknown · Himed Cockpit 18 Pro +2

Name of the Vulnerable Software and Affected Versions: HiMed Cockpit 12 pro versions 11.5.1 through 11.6.2 HiMed Cockpit 14 pro+ versions 11.5.1 through 11.6.2 HiMed Cockpit 18 pro versions 11.5.1 through 11.6.2 HiMed Cockpit 18 pro+ versions 11.5.1 through 11.6.2 Description: A restricted deskto...

New Windows Malware Locks Computer in Kiosk Mode

Clever: A malware campaign uses the unusual method of locking users in their browser's kiosk mode to annoy them into entering their Google credentials, which are then stolen by information-stealing malware. Specifically, the malware "locks" the user's browser on Google's login page with no obviou...