Authentication flaw

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

CVE-2020-10669

The Canon Oce Colorwave 500 printer web interface (version 4.0.0.0) is affected by CVE-2020-10669 due to an authentication bypass on /home.jsp. An unauthenticated attacker who can reach the device’s web UI can obtain copies of documents uploaded by users. The issue is confirmed in multiple source...

CVE-2020-10669

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

CVE-2020-10670

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version...

CVE-2020-10671

The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version...

CVE-2020-10667

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is maptemplatename. NOTE: this is fixed in the latest version...

Cross site request forgery (csrf)

The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version...

Cross site scripting

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version...

Cross site scripting

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version...

CVE-2019-16070

A number of stored Cross-site Scripting XSS vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs...

CVE-2020-10671

The CVE-2020-10671 entry concerns the Canon Oce Colorwave 500 printer (version 4.0.0.0). The web management interface is missing CSRF protections, enabling a logged-in administrator to be targeted by an attacker to perform administrative actions. The issue is described as system-wide and is noted...

CVE-2020-10670

The Canon Oce Colorwave 500 web application (version 4.0.0.0 ) is affected by CVE-2020-10670: a Reflected XSS in the settingId parameter of the settingDialogContent.jsp page. Root cause: lack of proper input validation/escaping on user-supplied data reflected in the response. Impact: potential cl...

CVE-2020-10668

The Canon Océ Colorwave 500 printer web app (version 4.0.0.0) is vulnerable to Reflected XSS in /home.jsp via the openSI parameter. Root cause is input from user-controlled parameter not being properly sanitized, per CVE-2020-10668. The issue is fixed in the latest version. If upgrading is possib...

CVE-2020-10668

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version...

CVE-2019-16070

A number of stored Cross-site Scripting XSS vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs...

CVE-2019-16070

NETSAS Enigma NMS 65.0.0 and earlier contains stored XSS vulnerabilities (CVE-2019-16070) in the WEB application, exploitable through web form inputs. Root cause per sources: lack/insufficient validation of client-side data in the web app. Impact described as client-side code execution; CVSS data...

CVE-2019-16065

A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user...

SAP Commerce Cross-Site Scripting Vulnerability (CNVD-2020-21059)

SAP Commerce is a cloud-based e-commerce platform from SAP, a German company. The product supports sales management, marketing management, order management and operations management , etc. SmartEdit Extension is one of the smart editor extension program . A cross-site scripting vulnerability exis...

pki-core cross-site scripting vulnerability

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in the Token Processing Service TPS of pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

Discourse < 2.4.0.beta6 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...