Canon Oce Colorwave 500 vulnerabilities

5 vulnerabilities

Known vulnerabilities in Canon Oce Colorwave 500, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2020-10667canonoce_colorwave_500_firmware
EPSS score
1.76%
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable parameter is map(template_name). NOTE: this is fixed in the latest version.6.1CVE-2020-10668canonoce_colorwave_500_firmware
EPSS score
1.42%
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version.7.5CVE-2020-10669canonoce_colorwave_500_firmware
EPSS score
3.55%
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the latest version.6.1CVE-2020-10670canonoce_colorwave_500_firmware
EPSS score
0.86%
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version.8.8CVE-2020-10671canonoce_colorwave_500_firmware
EPSS score
0.70%
The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version.