Eaton UPS 9PX 8000 SP Password Disclosure Vulnerability (CNVD-2019-22860)

The Eaton UPS 9PX 8000 SP is a power management device from Eaton USA. The Eaton UPS 9PX 8000 SP suffers from a password disclosure vulnerability that originates from a web page displayed by the device containing a clear-text password, which can be retrieved by an attacker by browsing the source...

CVE-2018-9281

Eaton UPS 9PX 8000 SP product is affected by CVE-2018-9281, which involves a CSRF vulnerability in the change-password functionality that can force a logged-in administrator to silently update the password. The same flaw also enables Reflected Cross-Site Scripting in affected forms, potentially e...

CVE-2018-9279

CVE-2018-9279 affects Eaton UPS 9PX 8000 SP devices. The web UI exposes the user password in cleartext and the password can be retrieved by inspecting the page source. Multiple sources (NVD/NES plugins, CNVD) describe this disclosure vulnerability. The connected documents do not provide a remedia...

PT-2018-18955

Name of the Vulnerable Software and Affected Versions Eaton UPS 9PX 8000 SP devices affected versions not specified Description The issue concerns the disclosure of user passwords. The web page displayed by the appliance contains the password in cleartext, allowing passwords to be retrieved by...

CVE-2018-9280: Insufficiently Protected Credentials

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance contains the password in cleartext. Passwords of the read and write users could be retrieved by browsing the source code of the webpage...

PT-2018-18957

Name of the Vulnerable Software and Affected Versions Eaton UPS 9PX 8000 SP devices affected versions not specified Description The administration panel of the device is susceptible to a CSRF attack on the change-password functionality, allowing an attacker to silently update the password of a...

PT-2018-18956

Name of the Vulnerable Software and Affected Versions Eaton UPS 9PX 8000 SP devices affected versions not specified Description An issue was discovered where the appliance discloses the SNMP version 3 user's password. The password is displayed in cleartext on the web page and can also be retrieve...

CVE-2018-9279: Insufficiently Protected Credentials

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be retrieved by browsing the source code of the webpage...

CVE-2018-9281: Improper Neutralization of Input During Web Page Generation

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable t...

sp-ark.org XSS vulnerability

Open Bug Bounty ID: OBB-686390 Description| Value ---|--- Affected Website:| sp-ark.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

RICOH SP 4510SF Cross-Site Scripting Vulnerability

The RICOH SP 4510SF is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address addition area of the RICOH SP 4510SF, which arises from the program failing to properly validate user-submitted input. An attacker can exploit this vulnerability by...

HPSBHF03595 rev. 6 - LoJax UEFI Rootkit

Potential Security Impact Elevation of Privilege, Information Disclosure, Loss of Confidentiality, Loss of Integrity. Source: HP, HP Product Security Response Team PSRT Reported by: ESET Research VULNERABILITY SUMMARY HP has identified a potential security vulnerability with a UEFI rootkit LoJax...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-19871)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /plus/feedbackajax.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to execute JavaScript code with the help of the onhashchange attribute in the 'msg'...

camarasaltinho.sp.gov.br XSS vulnerability

Open Bug Bounty ID: OBB-679277 Description| Value ---|--- Affected Website:| camarasaltinho.sp.gov.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-17001

On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

Cross site scripting

On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17001

On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17001

The CVE-2018-17001 entry concerns the Ricoh SP 4510SF printer with HTML Injection and Stored XSS in the web UI. Specifically, the vulnerability arises in the address-adding workflow via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi, where insufficient input validation e...

PT-2018-13821

Name of the Vulnerable Software and Affected Versions RICOH SP 4510SF printer affected versions not specified Description A security issue has been found related to HTML Injection and Stored XSS in the process of adding addresses. This issue is associated with the entryNameIn parameter used in th...

CVE-2018-17001: Improper Neutralization of Input During Web Page Generation

On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...