THREATIST.IORead the docs 83 records
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the instal…
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration.
Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared.
Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.
By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware.
Multiple Brother driver installers for Windows contain a privilege escalation vulnerability.
An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker.
An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device.
An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling.
An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address.
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device.
An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable de…
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash.
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers).
API keys for some cloud services are hardcoded in the "main" binary.
There are several hidden accounts.
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users.
Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege.
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.
Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path traversal vulnerability.
User passwords are decrypted and stored on memory before any user logged in.
User passwords are decrypted and stored on memory before any user logged in.
User passwords are decrypted and stored on memory before any user logged in.
Affected devices create coredump files when crashed, storing them with world-readable permission.