Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
100 results · page 1 of 2
Oct 1, 2026Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbiCVE-2024-58388 · Other software · Sharp Corporation · reported by VulnCheckHigh 8.7
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../<path> to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.
- Product
- Multiple Multifunction Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compierrekim.github.io
Sep 29, 2026Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96420 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 4.7
Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Aug 3, 2026Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configurCVE-2026-63563 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 6.9
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accessed without user authentication. Products intended for the Japanese market are not affected.
- Product
- Sharp MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.jp.sharpglobal.sharp
Aug 3, 2026Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared.CVE-2026-63545 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpLow 2.4
Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users.
- Product
- Sharp MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.jp.sharpglobal.sharp
Aug 3, 2026Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.CVE-2026-60011 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 6.9
Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.
- Product
- Sharp MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.jp.sharpglobal.sharp
Jun 25, 2026Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc.CVE-2026-56129 · Other software · Dynabook Inc. · reported by vultures@jpcert.or.jpMedium 6.8
Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory.
- Product
- Generic IO & Memory Access driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.jp.sharpglobal.sharp
Feb 14, 2026In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_haps: Fix memory leaks in add/remove routines toshiba_haps_add() leaCVE-2026-23176 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_haps: Fix memory leaks in add/remove routines toshiba_haps_add() leaks the haps object allocated by it if it returns an error after allocating that object successfully. toshiba_haps_remove() does not free the object pointed to by toshiba_haps before clearing that pointer, so it becomes unreachable allocated memory. Address these memory leaks by using devm_kzalloc() for allocating the memory in question.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 26, 2024Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-sCVE-2024-36254 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers).CVE-2024-36249 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
- Product
- Multiple MFPs (multifunction printers)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability.CVE-2024-48870 · Other software · Toshiba Tec Corporation · reported by vultures@jpcert.or.jpMedium 6.2
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.
- Product
- e-STUDIO 908
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability.CVE-2024-47801 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.CVE-2024-47549 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.CVE-2024-47406 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpCritical 9.1
Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs provide configuration related APIs.CVE-2024-47005 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability.CVE-2024-45842 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 5.3
Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retrieved when processing crafted HTTP requests.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-boCVE-2024-45829 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 4.9
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability.CVE-2024-43424 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOCVE-2024-42420 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOAP messages. Crafted HTTP requests may cause affected products crashed.
- Product
- Sharp Digital Full-color MFPs and Monochrome MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quiCVE-2024-41028 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quirks[] together with the standard DMI matching functions, it must be terminated by a empty entry. Since this entry is missing, an array out-of-bounds access occurs every time the quirk list is processed. Fix this by adding the terminating empty entry.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 14, 2024Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root.CVE-2024-3498 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.8
Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer.CVE-2024-3497 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 8.8
Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer.CVE-2024-3496 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 8.8
Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker with admin access can install rogue applications.CVE-2024-27180 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.7
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Admin cookies are written in clear-text in logs.CVE-2024-27179 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 4.7
Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker can get Remote Code Execution by overwriting files.CVE-2024-27178 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.2
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker can get Remote Code Execution by overwriting files.CVE-2024-27177 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.2
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024An attacker can get Remote Code Execution by overwriting files.CVE-2024-27176 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.2
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability.CVE-2024-27175 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 4.4
Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Remote Command program allows an attacker to get Remote Code Execution.CVE-2024-27174 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Critical 9.8
Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code.CVE-2024-27173 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Critical 9.8
Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Remote Command program allows an attacker to get Remote Code Execution.CVE-2024-27172 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Critical 9.8
Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution.CVE-2024-27171 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.4
A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file.CVE-2024-27170 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.4
It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Toshiba printers provides API without authentication for internal access.CVE-2024-27169 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 8.4
Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, providing administrative access. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024It appears that some hardcoded keys are used for authentication to internal API.CVE-2024-27168 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.1
It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Toshiba printers use Sendmail to send emails to recipients.CVE-2024-27167 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.4
Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories. A local attacker can inject a malicious Sendmail configuration file. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Coredump binaries in Toshiba printers have incorrect permissions.CVE-2024-27166 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.4
Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability.CVE-2024-27165 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.8
Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability. A local attacker can get root privileges. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Toshiba printers contain hardcoded credentials.CVE-2024-27164 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.1
Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API.CVE-2024-27163 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.5
Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password in clear-text and compromise the printer. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Toshiba printers provide a web interface that will load the JavaScript file.CVE-2024-27162 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.1
Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024all the Toshiba printers have programs containing a hardcoded key used to encrypt files.CVE-2024-27161 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.2
all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs.CVE-2024-27160 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.2
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs.CVE-2024-27159 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.2
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024All the Toshiba printers share the same hardcoded root password.CVE-2024-27158 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.4
All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024The sessions are stored in clear-text logs.CVE-2024-27157 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.8
The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024The session cookies, used for authentication, are stored in clear-text logs.CVE-2024-27156 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.8
The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability.CVE-2024-27155 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.7
The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024Passwords are stored in clear-text logs.CVE-2024-27154 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.2
Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability.CVE-2024-27153 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.4
The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.