CVE-2024-47549

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-644 CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-47554.8The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2024-475506.7Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escal CVE-2024-475529.8Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 CVE-2024-475539.9A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate u CVE-2024-475544.3Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively CVE-2024-475558.3Missing Authentication - User & System Configuration CVE-2024-475569.8Pre-Auth RCE via Path Traversal CVE-2024-475579.8Pre-Auth RCE via Path Traversal CVE-2024-475588.8Authenticated RCE via Path Traversal CVE-2024-475598.8Authenticated RCE via Path Traversal CVE-2024-47565.4The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2024-475607.8RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended