CVE-2024-27177

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-271787.2An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerab CVE-2024-271794.7Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected CVE-2024-27186.1A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been rated as problematic. This issue affects some unkn CVE-2024-271806.7An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL.CVE-2024-271818.8In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows acces CVE-2024-271824.9In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any CVE-2024-271836.1XSS vulnerability in DJ-HelpfulArticles component for Joomla.CVE-2024-271846.1Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..CVE-2024-271859.1The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.CVE-2024-271866.1The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.CVE-2024-271877.5Improper Access Controls allows backend users to overwrite their username when disallowed.CVE-2024-271885.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue aff