PT-2022-17226

Name of the Vulnerable Software and Affected Versions Kyocera d-COLOR MF3555 version 2XD S000.002.271 Description A cross-site scripting XSS issue was discovered. The Web Application does not properly check parameters sent in a "/dvcset/sysset/set.cgi" POST request via the arg01.Hostname field...

CVE-2022-25344: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application doesn't properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is the...

CVE-2015-7675

The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the 1 serverFileIds parameter to mobile/sendMsg or 2 arg01 parameter to human.aspx...

CVE-2015-7675: Exposure of Sensitive Information to an Unauthorized Actor

The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the 1 serverFileIds parameter to mobile/sendMsg or 2 arg01 parameter to human.aspx...