CVE-2024-27162

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the reference URL.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-271636.5Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests toCVE-2024-271647.1Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference URL.CVE-2024-271657.8Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability. A local attacker can get root privileges. CVE-2024-271667.4Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected pCVE-2024-271677.4Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories. A local attacker can inject CVE-2024-271687.1It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass auCVE-2024-271698.4Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, providCVE-2024-27176.1A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been declared as problematic. This vulnerability affectCVE-2024-271707.4It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get aCVE-2024-271717.4A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for thCVE-2024-271729.8Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference URL.CVE-2024-271739.8Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This