Vulnerability of the web interface for operating system management software FortiOS and the proxy server FortiProxy, which allows for the execution of arbitrary code.

The vulnerability in the web management interface of FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute...

PT-2024-10391

Name of the Vulnerable Software and Affected Versions Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC version 1.06 Description The issue concerns the request /goform/fromSetDDNS not properly handling special characters in user-provided parameters, allowing an attacker with access to the web...

CVE-2024-27162

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the...

CVE-2024-27162 DOM-based XSS

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the...

CVE-2024-27162

CVE-2024-27162 affects Toshiba printers with a web interface that loads an external JavaScript file containing insecure code. The DOM-based XSS vulnerability could allow an attacker with network access to steal an admin user’s cookies by exploiting the loaded script across the printer’s web pages...

CVE-2024-27162 DOM-based XSS

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the...

CVE-2024-27144 Pre-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. T...

CVE-2024-27144

CVE-2024-27144 affects Toshiba e-STUDIO/MFPs with web-based management. The vulnerability enables uploading files via the web interface without authentication, allowing overwriting of insecure files and enabling potential remote compromise; a local privilege escalation could lead to full printer ...

CVE-2024-27144 Pre-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. T...

PT-2024-21695 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue concerns a web interface in Toshiba printers that loads a JavaScript file containing insecure codes, making it vulnerable to XSS attacks. This file is loaded inside all...

Toshiba e-STUDIO Security Vulnerability

Toshiba e-STUDIO is a series of high-end office multifunction printers MFPs from Toshiba, Japan. A security vulnerability exists in Toshiba e-STUDIO, which originates from the fact that if user authentication is disabled, a malicious file can be executed by enabling the service from the MFP's web...

CVE-2024-5951

Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this...

CVE-2024-5952

Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability...

PT-2024-21675 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue allows unauthorized access and remote exploitation of Toshiba printers through the web interface without authentication, enabling an attacker to overwrite insecure files...

The vulnerability in the web interface for controlling the automation software of Cisco Finesse’s operator functions allows a hacker to perform cross-site scripting attacks.

The vulnerability of the web interface for controlling the automation software for Cisco Finesse operators is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created link...

The vulnerability in the web interface for controlling the automation software of Cisco Finesse’s operator functions allows a hacker to perform an SSRF attack.

The vulnerability in the web interface for controlling the automation software of Cisco Finesse operators is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using a specially created HTTP request...

PT-2024-21676 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue allows an attacker to remotely compromise Toshiba printers by exploiting the admin web interface's file upload functionality. This can lead to the overwrite of insecure...

CVE-2024-5906

A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...

CVE-2024-5560

CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a specially crafted HTTP request...

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests...