ITV: New rules to prevent children’s ‘smart’ toys from being hacked

In the run up to Christmas we were asked by ITV's Chris Choi to demonstrate some of the security fails we see in kids toys all the time. We showed him our research on My Friend Cayla, and Tekstra Toucan amongst others, and made the point that while manufacturers need standards and codes of practi...

RICOH MP C1803 JPN Printer - Cross-Site Scripting

Exploit Title: RICOH MP C1803 JPN Printer - Cross-Site Scripting Date: 2018-09-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link : https://www.ricoh.co.jp/mfp/mpc/1803/ Software : RICOH Printer Product Version: MP C1803 JPN Vulernability Type : Code Injectio...

RICOH Aficio MP 301 Cross-Site Scripting Vulnerability

The RICOH Aficio MP 301 is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address add area in the RICOH Aficio MP 301. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

RICOH MP C6003 Cross-Site Scripting Vulnerability

The RICOH MP C6003 is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address addition area of the RICOH MP C6003. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

RICOH Aficio MP 305+ Cross-Site Scripting Vulnerability

The RICOH Aficio MP 305+ is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address add area in the RICOH Aficio MP 305+. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

Ricoh MP C2003 Cross-Site Scripting Vulnerability

The Ricoh MP C2003 is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address addition area of the Ricoh MP C2003. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

RICOH MP C307 Cross-Site Scripting Vulnerability

The RICOH MP C307 is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address addition area of the RICOH MP C307. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

RICOH MP C406Z Cross-Site Scripting Vulnerability

The RICOH MP C406Z is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address add area in the RICOH MP C406Z. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

CVE-2018-17315

On the RICOH MP C2003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17316

On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17311

On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17312

On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17313

On the RICOH MP C307 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17314

On the RICOH Aficio MP 305+ printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

Cross site scripting

On the RICOH MP C6003 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

Cross site scripting

On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

Cross site scripting

On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17309

The CVE-2018-17309 entry concerns the Ricoh MP C406Z multifunction printer. Affected component: the address management web interface, specifically the /web/entry/en/address/adrsSetUserWizard.cgi endpoint. Vulnerability type: HTML Injection and Stored XSS in the area where addresses are added via ...

CVE-2018-17311

CVE-2018-17311 affects the Ricoh MP C6503 Plus web interface, specifically the /web/entry/en/address/adrsSetUserWizard.cgi endpoint. The vulnerability is HTML Injection and Stored XSS via the entryNameIn parameter when adding addresses, enabling arbitrary script/HTML execution in the affected UI....

CVE-2018-17316

CVE-2018-17316 affects the Ricoh MP C6003 printer. The vulnerability is in the address-adding functionality: HTML Injection and Stored XSS triggered via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi. Affected component/file path is the web UI endpoint for address manage...