CVE-2019-19772

CVE-2019-19772 affects Lexmark printers with an embedded web server that is vulnerable to reflected Cross-Site Scripting (XSS). Root cause: lack of proper validation of client-side data in the web application, enabling an attacker to inject and execute script in a user’s browser. Impact per sourc...

CVE-2019-19772

Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=ENUS...

CVE-2019-19773

CVE-2019-19773 describes a stored cross-site scripting (XSS) vulnerability in the embedded web server of older Lexmark devices/printers. The issue arises from improper validation in web server handling of client data, leading to possible client-side code execution within affected interfaces. Mult...

CVE-2019-19773

Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=ENUS...

Cross site scripting

Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser...

CVE-2019-18791

Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser...

CVE-2019-18791

The CVE-2019-18791 issue affects Lexmark printer MS812 and older Lexmark devices, due to a stored XSS in the embedded web server. The root cause is insufficient validation of client-side data by the web application, allowing an attacker to expose session credentials and other information via the ...

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to perform arbitrary actions on the vulnerable device.

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 is related to a predictable algorithm for token generation. Exploiting this vulnerability allows an attacker operating remotely to perform arbitrary...

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to gain unauthorized access to protected information.

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 is related to security flaws in the software mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

The vulnerability of the embedded web-server microprogramming software of Moxa EDS-G516E and Moxa EDS-510E switches allows a hacker to execute arbitrary code or cause malfunctions in the device’s functionality.

The vulnerability of the embedded web-server microprogramming software for Moxa EDS-G516E and Moxa EDS-510E switches is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure using a specially crafted...

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to intercept administrator credentials and other confidential information, gaining access to the control system.

The vulnerability of the embedded web-server microprogramming system controllers from Moxa, models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660, stems from the default use of the HTTP protocol during the implementation of the “Basic HTTP Authentication” method. Exploiting this vulnerability...

The vulnerability of the UDPmessageSetting component within the embedded web-server software of Moxa EDS-G516E and Moxa EDS-510E switches allows a attacker to cause service interruptions.

The vulnerability of the UDPmessageSetting component in the embedded web-server software of Moxa EDS-G516E and Moxa EDS-510E switches is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause service interruptions by modifying the configuration file...

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the embedded web-server microprogramming software for Moxa MGate models MB3170, MB3180, MB3270, MB3280, MB3480, and MB3660 lies in a buffer overflow issue during the processing of input data using the Content-Length header. Exploiting this vulnerability allows an attacker to...

The vulnerability of the PTPSettingEnable component in the embedded web-server software of Moxa EDS-G516E and Moxa EDS-510E switches allows a hacker to cause a service failure.

The vulnerability of the PTPSettingEnable component in the embedded web-server software of Moxa EDS-G516E and Moxa EDS-510E switches is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause service interruptions by modifying the configuration file remote...

The vulnerability of the embedded web-server microprogramming software in Moxa PT-7528 and Moxa PT-7828 Ethernet switches allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the embedded web-server microprogramming software for Moxa PT-7528 and Moxa PT-7828 switches is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or trigger a service failure using a specially crafted...

Lexmark Printer CSRF Vulnerability (TE921)

Some Lexmark devices embedded web server contain a cross-site request forgery CSRF attack vulnerability that allows a local account password to be changed without the knowledge of the authenticated user. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a...

ZTE MF910 – An end of life router, running lots of vivacious hidden code

You might be here because you saw our talk at Defcon 27. You might want to watch that for the full rundown! The ZTE MF910 is a really interesting router for reversing, mainly because it’s full of nice debug calls, and underused functionality. Also, it’s never going to get patched, and it’s really...

Embedthis GoAhead Buffer Overflow Vulnerability

Embedthis Software GoAhead is an embedded Web server from Embedthis Software, USA. A buffer overflow vulnerability exists in the http.c file in Embedthis GoAhead versions prior to 4.1.1 and 5.x versions prior to 5.0.1. The vulnerability stems from a network system or product performing operations...

CVE-2019-6325

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery...

CVE-2019-6326

HP Color LaserJet Pro M280-M281 Multifunction Printer series before v. 20190419, HP LaserJet Pro MFP M28-M31 Printer series before v. 20190426 may have embedded web server attributes which may be potentially vulnerable to Buffer Overflow...