Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-27173
Publication date:
14/06/2024
Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27174
Publication date:
14/06/2024
Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27169
Publication date:
14/06/2024
Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, providing administrative access. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27170
Publication date:
14/06/2024
It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27171
Publication date:
14/06/2024
A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27166
Publication date:
14/06/2024
Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27167
Publication date:
14/06/2024
Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories. A local attacker can inject a malicious Sendmail configuration file. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27168
Publication date:
14/06/2024
It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27164
Publication date:
14/06/2024
Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27165
Publication date:
14/06/2024
Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability. A local attacker can get root privileges. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27163
Publication date:
14/06/2024
Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password in clear-text and compromise the printer. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27160
Publication date:
14/06/2024
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024
Subscribe to Vulnerabilities