ROS-20250513-02

The RED OS kiosk mode vulnerability is due to improper constraints. Exploitation of the vulnerability could allow an attacker to execute arbitrary commands on the system outside of the imposed restrictions Information about the vulnerability was received from Alexander Starikov - researcher at...

PT-2025-15: Kiosk restriction bypass in RED OS

The vulnerability was identified in RedOS, versions 7.3.5-20241106.3. The discovered vulnerability in the RedOS kiosk utility due to incorrect restrictions. Exploitation of the vulnerability may allow an attacker to execute arbitrary commands on the system outside the imposed restrictions...

CVE-2024-29500

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...

PT-2025-30559

Уязвимость режима «киоск» пакета redos-kiosk-utils операционной системы РЕД ОС связана с недостатками ограничений загрузки файлов опасного типа. Эксплуатация уязвимости может позволить нарушителю выполнить произвольные команды...

CVE-2024-52925

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives...

CVE-2024-52925

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives...

CVE-2024-52925

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives...

CVE-2024-52925

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives...

PT-2025-8705

Name of the Vulnerable Software and Affected Versions OPSWAT MetaDefender Kiosk versions prior to 4.7.0 Description The issue allows arbitrary code execution by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives. Recommendations For versions prior to 4.7.0, updat...

CVE-2024-52925: Improper Control of Generation of Code

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives...

OPSWAT MetaDefender KIOSK 代码注入漏洞

OPSWAT MetaDefender KIOSK is a digital security guard from OPSWAT USA. A security vulnerability exists in OPSWAT MetaDefender KIOSK versions prior to 4.7.0. An attacker can exploit the vulnerability to execute arbitrary code...

CVE-2024-37364

Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information such as hotel invoice content with PII, and potentially create unauthorized room keys, by entering a guest-search quote character and then...

CVE-2022-24287

A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3 UC06, SIMATIC PCS 7 V9.1 All versions V9.1 SP1 UC01, SIMATIC WinCC Runtime Professional V16 and earlier All versions, SIMATIC WinCC Runtime Professional V17 All versions V17 Upd4,...

Malicious code in kiosk-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0cf98cf99dad32c045dfb31f81bc76a17bf67597b85b27273856761d7b3d31e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Topaz Signature Pad as COM Port Device Disappears after Logoff

Topaz Signature will disappear after users log off on a kiosk workstation. The environment contained: Citrix Virtual Apps and Desktops version 2203 CUx Desktop of Server VDA, any supported OS Citrix Workspace App 2402 CUx Windows 10/Windows 11...

CVE-2024-36498

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

CVE-2024-36498

The Image Access Scan2Net software (versions 7.40 and earlier , 7.42 and earlier , and 7.42B and earlier ) is vulnerable to a stored cross-site scripting (XSS) flaw due to improper input sanitization. An attacker with Poweruser or Admin privileges can use the **

CVE-2024-47947

The software Image Access Scan2Net (versions 7.40, 7.42, and 7.42B and earlier) is vulnerable to stored cross-site scripting (XSS) due to missing input sanitization. An attacker with Poweruser or Admin privileges can exploit the "Edit Disclaimer Text" function located at https://$SCANNER/cgi/admi...

PT-2024-32909 · Unknown · Scanwizard

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to missing input sanitization, allowing an attacker to perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit...

CVE-2024-47947: Improper Neutralization of Input During Web Page Generation

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...