Vulnerabilidades de Ricoh Company, Ltd.
CVEs publicadas que afetam produtos de Ricoh Company, Ltd.: 10 registro(s), com severidade, exploração e correções.
RICOH Web Image Monitor 1ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール 1RICOH Streamline NX 1Multiple printer drivers 1Multiple MFPs 1See "References" section 1Multiple laser printers and MFPs which implement Ricoh Web Image Monitor 1Multiple laser printers and MFPs which implement Web Image Monitor 1Ricoh printers and Multifunction Printers (MFPs) 1SP 330DN 1SP 221 1SP C252SF 1Aficio SP 3500SF 1
CVE-2026-101040
Média · 6.5
CWE-404 28/09/2026
Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service
A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart Form-Data Parser. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-63226
Média · 5.8
CWE-923 23/07/2026
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not…
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.
CVE-2026-56809
Média · 6.1
CWE-79 30/06/2026
Cross-site Scripting (XSS) em Ricoh Company, Ltd. Multiple laser printers and MFPs which implement Ricoh Web Image Monitor
Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who accesses a crafted URL.
CVE-2026-50100
Alta · 7.8
CWE-427 15/06/2026
Uncontrolled Search Path Element em Ricoh Company, Ltd. Multiple printer drivers
Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is exploited, an attacker who can log in to a computer running an affected printer driver could elevate privileges by using a specially crafted driver.
CVE-2026-41226
Média · 4.7
CWE-601 30/04/2026
Open Redirect em Ricoh Company, Ltd. Multiple laser printers and MFPs which implement Web Image Monitor
Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack.
CVE-2026-26050
Alta · 7.8
CWE-427 20/02/2026
Uncontrolled Search Path Element em Ricoh Company, Ltd. ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール
The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges.
CVE-2019-25324
Média · 6.1
CWE-79 12/02/2026
RICOH Web Image Monitor 1.09 - HTML Injection
RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to inject malicious HTML code. Attackers can exploit the entryNameIn and entryDisplayNameIn parameters to insert arbitrary HTML content, potentially enabling cross-site scripting attacks.
CVE-2026-24466
Média · 6.7
CWE-428 09/02/2026
Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co…
Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
CVE-2025-53869
Baixa · 3.7
CWE-295 29/01/2026
Improper Certificate Validation em Brother Industries, Ltd. Multiple MFPs
Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the set of root certificates used by the product with a set of arbitrary certificates.
CVE-2026-21409
Média · 5.9
CWE-639 09/01/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Ricoh Company, Ltd. RICOH Streamline NX
Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and its user, and some crafted request is processed by the product, the user's registration information and/or OIDC (OpenID Connect) tokens may be retrieved.