Takayoshi Isayama

The issue allows remote attackers to obtain sensitive information via a crafted web site due to improper handling of XML documents.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators via unspecified vectors.

The issue allows default credentials to be set for wireless LAN connections when the PhotoShare function is enabled through a web browser. This could potentially allow unauthorized access to the device.

The issue allows authenticated attackers to bypass access restrictions and obtain unauthorized image data. The exact vectors used for the bypass are not specified.

The issue allows remote attackers to bypass access restrictions and modify switch configurations via SOAP requests.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue is related to a cross-site scripting (XSS) vulnerability in the implementation of the debug mode (devMode) in Apache Struts. This vulnerability can be exploited by a remote attacker to conduct inter-site script attacks. When the Struts2 debug mode is turned on, under certain conditions, an arbitrary script may be executed in the 'Problem Report' screen. Additionally, if JSP files are exposed to be accessed directly, it's possible to execute an arbitrary script.

The issue is related to a cross-site scripting (XSS) vulnerability. It is associated with the debug mode (devMode) of the Apache Struts platform, where the structure of web pages is not properly protected. This could allow a remote attacker to perform inter-site script attacks. The vulnerability can be exploited when the Struts2 debug mode is turned on under certain conditions, allowing an arbitrary script to be executed in the 'Problem Report' screen. Additionally, if JSP files are directly accessible, it is possible to execute an arbitrary script.

The issue is related to the ParametersInterceptor in Apache Struts, which does not properly restrict access to the getClass method. This allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request. The vulnerability exists due to an incomplete fix for a previous issue. It is related to the implementation of the getClass method, which has access control deficiencies when using the ParametersInterceptor with the class parameter. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted request.

The issue is related to the CookieInterceptor in Apache Struts, where an incomplete fix for a previous issue has led to a vulnerability. This vulnerability allows remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request, due to insufficient access restrictions when handling wildcard cookiesName values. The exploitation requires the application to be configured to accept all cookies, allowing access to the class parameter directly mapped to the getClass() method.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to cookies.

A directory traversal issue allows remote attackers to read arbitrary files via unspecified vectors.