CVE-2024-36498: Improper Neutralization of Input During Web Page Generation

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

CVE-2024-28140

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and...

CVE-2024-28140

The Image Access Scan2Net scanner device is vulnerable to a violation of the least privilege principle (CWE-250). By default, the device boots into a kiosk mode that opens the Scan2Net interface in a web browser running with root privileges . Additionally, several other applications on the device...

CVE-2024-28140 Violation of Least Privilege Principle

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and...

CVE-2024-28140: Execution with Unnecessary Privileges

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and...

Image Access Scan2Net 安全漏洞

Image Access Scan2Net is a scanning software from the German company Image Access. A security vulnerability exists in Image Access Scan2Net, which originates when the scanner device boots into kiosk mode by default and opens the Scan2Net interface in a browser window. The browser is running with...

Malicious code in kiosk-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7f59314a206c7faa0082a49930dfe6b18851236824c9539436bf92a3f71a08a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10893 Malicious code in kiosk-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7f59314a206c7faa0082a49930dfe6b18851236824c9539436bf92a3f71a08a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-51829

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in figoliquinn Mobile Kiosk mobile-kiosk allows Stored XSS.This issue affects Mobile Kiosk: from n/a through = 1.3.0...

CVE-2024-51829

CVE-2024-51829: WordPress Mobile Kiosk vulnerability in Figoli Quinn & Associates Mobile Kiosk plugin (WordPress plugin Mobile Kiosk, versions up to 1.3.0) allows Stored XSS due to improper input neutralization during web page generation. Affected: Figoli Quinn & Associates Mobile Kiosk (n/a thro...

CVE-2024-51829 WordPress Mobile Kiosk plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in figoliquinn Mobile Kiosk mobile-kiosk allows Stored XSS.This issue affects Mobile Kiosk: from n/a through = 1.3.0...

CVE-2024-51829 WordPress Mobile Kiosk plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Figoli Quinn & Associates Mobile Kiosk allows Stored XSS.This issue affects Mobile Kiosk: from n/a through 1.3.0...

WordPress plugin Mobile Kiosk 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

PT-2024-34956 · Figoli Quinn & Associates · Figoli Quinn & Associates Mobile Kiosk

Name of the Vulnerable Software and Affected Versions: Figoli Quinn & Associates Mobile Kiosk versions n/a through 1.3.0 WordPress Mobile Kiosk Plugin version 1.3.0 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site...

CVE-2024-51829: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in figoliquinn Mobile Kiosk mobile-kiosk allows Stored XSS.This issue affects Mobile Kiosk: from n/a through = 1.3.0...

WordPress Mobile Kiosk plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Mobile Kiosk versions = 1.3.0...

WordPress Mobile Kiosk Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Mobile Kiosk Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51829 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7924bf5d9424 Credits SOPROBRO Required privilege Contributor...

CVE-2023-52952

A vulnerability has been identified in HiMed Cockpit 12 pro J31032-K2017-H259 All versions = V11.5.1 = V11.5.1 = V11.5.1 = V11.5.1 V11.6.2. The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to...

CVE-2023-52952

A vulnerability has been identified in HiMed Cockpit 12 pro J31032-K2017-H259 All versions = V11.5.1 = V11.5.1 = V11.5.1 = V11.5.1 V11.6.2. The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to...

CVE-2023-52952

CVE-2023-52952 affects Siemens HiMed Cockpit devices (12 pro, 14 pro+, 18 pro, 18 pro+) with versions V11.5.1 up to but not including V11.6.2. The Kiosk Mode exposes a restricted desktop environment escape vulnerability that could allow an unauthenticated local attacker to escape the restricted e...