Secunia Logo  
 Vulnerability InformationVulnerability ScanningCommunityBlog - new entry!Corporate InformationOnline ShopCustomer Login  
 Secunia AdvisoriesSecunia ResearchBinary Analysis  
Home > Vulnerability Information > Secunia Advisories > HP LaserJet Printers / Digital Senders Cross-Site Scripting Vulnerabilities
Secunia Advisories
Advisories
Search
Advisories by Product
Advisories by Vendor
Historic Advisories
Mailing Lists
Report Vulnerability
Contact Form
Business Solutions Restricted
Partner Solutions Restricted
About


Secunia PSI WorldMap 		 
HP LaserJet Printers / Digital Senders Cross-Site Scripting Vulnerabilities
Secunia Advisory: SA36969
Advisory Toolbox:
Issue ticket
Save in to-do list
Mark as handled
Exploit information
Download as PDF
Review actions
Add comment
Release Date: 2009-10-08
Popularity: 1,037 views

Critical:
Less critical
Impact: Cross Site Scripting
Where: From remote
Solution Status: Unpatched

OS:HP 9200C Digital Sender
HP CM8050/8060 MFP
HP Color LaserJet 3000 Series
HP Color LaserJet 3600 Series
HP Color LaserJet 3800 Series
HP Color LaserJet 4700 Series
HP Color LaserJet 4730 Series
HP Color LaserJet 6040 MFP
HP Color LaserJet CP3505 Series
HP Color LaserJet CP4005 Series
HP Color LaserJet CP6015
HP DS9250c Digital Sender
HP LaserJet 2410 / 2420 / 2430
HP LaserJet 4240 / 4250 / 4340 Series
HP LaserJet 4345 Series
HP LaserJet 4350 Series
HP LaserJet 9040 / 9050 Series
HP LaserJet M3027/3035 MFP
HP LaserJet M5025/5035 MFP
HP LaserJet P3005 Series
HP LaserJet P4014
HP LaserJet P4015
HP LaserJet P4515
HP Laserjet Printer 5200 Series
Secunia CVSS-2 Score: Available in Secunia business solutions

Subscribe: Instant alerts on relevant vulnerabilities


Advisory Content (Page 1 of 3)[ 1 ] [ 2 ] [ 3 ]

Description:
Some vulnerabilities have been reported in multiple HP LaserJet printers, HP Color LaserJet printers, and HP Digital Senders, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "Product_URL" and "Tech_URL" parameters to support_param.html/config is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is returned.

Please see the vendor's advisory for a full list of affected products and versions.

Change Page:
[ 1 ] [ 2 ] [ 3 ]


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Today
New advisories: 6
New vulnerabilities: 13
Updated advisories: 9

Moderately // 6 views
Joomla LyftenBloggie Component "author" SQL Injection Vulnerability
Less // 41 views
DotNetNuke Cross-Site Scripting and Information Disclosure
Moderately // 74 views
Ubuntu update for php5
Moderately // 74 views
Joomla GCalendar Component "gcid" SQL Injection
Moderately // 63 views
RADIO istek scripti Information Disclosure Security Issue
Highly // 89 views
Gentoo update for PEAR-Net_Traceroute

26th Nov, 2009
New advisories: 15
New vulnerabilities: 37
Updated advisories: 48

Moderately // 265 views
Ingate Firewall and SIParator Multiple Vulnerabilities
Moderately // 326 views
SugarCRM Multiple Vulnerabilities
Moderately // 302 views
Serenity "MplayInputFile()" M3U Playlist Buffer Overflow
Moderately // 263 views
Debian update for poppler

Solutions | More...  

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Ubuntu update for php5 // 71 views
2. Joomla GCalendar Component "gcid" SQL Injection // 64 views
3. RADIO istek scripti Information Disclosure Security Issue // 51 views
4. Internet Explorer Layout Handling Memory Corruption Vulnerability // 49 views
5. Kaspersky Anti-Virus 2010 klavemu.kdl Denial of Service Vulnerability // 39 views
6. Internet Explorer Charset Inheritance Cross-Site Scripting Vulnerability // 37 views
7. DotNetNuke Cross-Site Scripting and Information Disclosure // 35 views
8. Adobe Flash Player Multiple Vulnerabilities // 33 views
9. Gentoo update for PEAR-Net_Traceroute // 27 views
10. Microsoft Windows CryptoAPI Two Spoofing Vulnerabilities // 26 views



Contact | Terms & Conditions and Copyright | Report Vulnerability | Press | Jobs (open positions) | About Secunia
Copyright Secunia 2002-2009