CVE-2020-10668

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version...

CVE-2020-10670

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version...

CVE-2020-10671

The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version...

Cross site scripting

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version...

Cross site request forgery (csrf)

The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version...

Cross site scripting

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is maptemplatename. NOTE: this is fixed in the latest version...

CVE-2020-10671

The CVE-2020-10671 entry concerns the Canon Oce Colorwave 500 printer (version 4.0.0.0). The web management interface is missing CSRF protections, enabling a logged-in administrator to be targeted by an attacker to perform administrative actions. The issue is described as system-wide and is noted...

CVE-2020-10671

The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version...

CVE-2020-10670

The Canon Oce Colorwave 500 web application (version 4.0.0.0 ) is affected by CVE-2020-10670: a Reflected XSS in the settingId parameter of the settingDialogContent.jsp page. Root cause: lack of proper input validation/escaping on user-supplied data reflected in the response. Impact: potential cl...

CVE-2020-10670

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version...

CVE-2020-10668

The Canon Océ Colorwave 500 printer web app (version 4.0.0.0) is vulnerable to Reflected XSS in /home.jsp via the openSI parameter. Root cause is input from user-controlled parameter not being properly sanitized, per CVE-2020-10668. The issue is fixed in the latest version. If upgrading is possib...

CVE-2020-10667

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is maptemplatename. NOTE: this is fixed in the latest version...

CVE-2020-10667

Canon Oce Colorwave 500 printer web application (version 4.0.0.0) is affected by a Stored XSS in /TemplateManager/indexExternalLocation.jsp via the map(template_name) parameter. The root cause is insufficient input validation in the web interface, allowing injection of arbitrary client-side scrip...

CVE-2020-10667: Improper Neutralization of Input During Web Page Generation

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is maptemplatename. NOTE: this is fixed in the latest version...

CVE-2020-10668: Improper Neutralization of Input During Web Page Generation

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version...

FreeBSD -- Insufficient oce(4) ioctl(2) privilege checking

Problem Description: The driver-specific ioctl2 command handlers in oce4 failed to check whether the caller has sufficient privileges to perform the corresponding operation. Impact: The oce4 handler permits unprivileged users to send passthrough commands to device firmware...

PT-2020-12274

Name of the Vulnerable Software and Affected Versions Canon Oce Colorwave 500 version 4.0.0.0 Description The web application exposed by the Canon Oce Colorwave 500 printer is vulnerable to Reflected XSS in the "/home.jsp" API endpoint. The openSI parameter is vulnerable. Recommendations For...

FreeBSD-SA-20:05.if_oce_ioctl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:05.ifoceioctl Security Advisory The FreeBSD Project Topic: Insufficient oce4 ioctl2 privilege checking Category: core Module: oce4 Announced: 2020-03-19...

PT-2020-12273

Name of the Vulnerable Software and Affected Versions Canon Oce Colorwave 500 version 4.0.0.0 Description The web application exposed by the Canon Oce Colorwave 500 printer is vulnerable to Stored XSS in the "TemplateManager/indexExternalLocation.jsp" API endpoint. The vulnerable parameter is...

PT-2020-9764

Name of the Vulnerable Software and Affected Versions FreeBSD versions 12.1-STABLE before r356089 FreeBSD versions 12.1-RELEASE before 12.1-RELEASE-p3 FreeBSD versions 11.3-STABLE before r356090 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p7 Description The issue arises from driver specific...