CVE-2024-27144 Pre-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. T...

CVE-2024-27144

CVE-2024-27144 affects Toshiba e-STUDIO/MFPs with web-based management. The vulnerability enables uploading files via the web interface without authentication, allowing overwriting of insecure files and enabling potential remote compromise; a local privilege escalation could lead to full printer ...

CVE-2024-27144 Pre-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. T...

PT-2024-21695 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue concerns a web interface in Toshiba printers that loads a JavaScript file containing insecure codes, making it vulnerable to XSS attacks. This file is loaded inside all...

Toshiba e-STUDIO Security Vulnerability

Toshiba e-STUDIO is a series of high-end office multifunction printers MFPs from Toshiba, Japan. A security vulnerability exists in Toshiba e-STUDIO, which originates from the fact that if user authentication is disabled, a malicious file can be executed by enabling the service from the MFP's web...

CVE-2024-5951

Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this...

CVE-2024-5952

Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability...

PT-2024-21675 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue allows unauthorized access and remote exploitation of Toshiba printers through the web interface without authentication, enabling an attacker to overwrite insecure files...

The vulnerability in the web interface for controlling the automation software of Cisco Finesse’s operator functions allows a hacker to perform cross-site scripting attacks.

The vulnerability of the web interface for controlling the automation software for Cisco Finesse operators is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created link...

PT-2024-21676 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue allows an attacker to remotely compromise Toshiba printers by exploiting the admin web interface's file upload functionality. This can lead to the overwrite of insecure...

The vulnerability in the web interface for controlling the automation software of Cisco Finesse’s operator functions allows a hacker to perform an SSRF attack.

The vulnerability in the web interface for controlling the automation software of Cisco Finesse operators is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using a specially created HTTP request...

CVE-2024-5906

A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...

CVE-2024-5560

CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a specially crafted HTTP request...

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests...

CVE-2024-37040

CWE-120: Buffer Copy without Checking Size of Input ‘Classic Buffer Overflow’ vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request...

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests...

CVE-2024-37037

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...

CVE-2024-37040

CWE-120: Buffer Copy without Checking Size of Input ‘Classic Buffer Overflow’ vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request...

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests...

CVE-2024-37038

CVE-2024-37038 affects Schneider Electric Sage RTU devices. The root cause is CWE-276: Incorrect Default Permissions, enabling an authenticated user with access to the device web interface to perform unauthorized file and firmware uploads by crafting crafted web requests. Impact stated across sou...