Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-36251	Description: The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. CVSS: HIGH (7.5) EPSS Score: 0.04% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-36249	Description: Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. CVSS: HIGH (7.4) EPSS Score: 0.05% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-35244	Description: There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. CVSS: CRITICAL (9.1) EPSS Score: 0.04% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-34021	Description: Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution. CVSS: MEDIUM (6.8) EPSS Score: 0.04% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-33616	Description: Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. CVSS: MEDIUM (5.3) EPSS Score: 0.04% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-33610	Description: "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. CVSS: CRITICAL (9.1) EPSS Score: 0.09% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-11694	Description: Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, and Thunderbird < 128.5. CVSS: MEDIUM (6.1) EPSS Score: 0.04% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-11693	Description: The executable file warning was not presented when downloading .library-ms files. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. CVSS: CRITICAL (9.8) EPSS Score: 0.05% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-11692	Description: An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. CVSS: MEDIUM (4.3) EPSS Score: 0.05% Source: CVE November 27th, 2024 (5 months ago)
CVE-2024-11691	Description: Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver. This bug only affected the application on Apple M series hardware. Other platforms were unaffected. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, and Thunderbird < 128.5. CVSS: HIGH (8.8) EPSS Score: 0.04% Source: CVE November 27th, 2024 (5 months ago)