Yokogawa Rental & Lease Corporation Security Vulnerabilities

glpi -- Unauthenticated File Deletion

MITRE Corporation reports: In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and...

CVE-2024-27164

Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference...

CVE-2024-27174

Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this...

KB5015807: Windows 10 Version 20H2 / 21H1 / 21H2 Security Update (July 2022)

The remote Windows host is missing security update 5015807. It is, therefore, affected by multiple vulnerabilities: A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2022-22024, ...

KB5005627: Windows 8.1 and Windows Server 2012 R2 September 2021 Security Update

The remote Windows host is missing security update 5005627 or cumulative update 5005613. It is, therefore, affected by multiple vulnerabilities : An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the...

KB4598297: Windows Server 2012 January 2021 Security Update

The remote Windows host is missing security update 4598297 or cumulative update 4598278. It is, therefore, affected by multiple vulnerabilities : An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2020-17087, CVE-2021-1648,...

CVE-2024-27151

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. As for the affected products/models/versions, see the reference...

CVE-2024-27153

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference...

CVE-2024-27147

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference...

CVE-2024-27146

The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference...

CVE-2024-27179

Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference...

CVE-2024-27180

An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference...

CVE-2024-27165

Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability. A local attacker can get root privileges. As for the affected products/models/versions, see the reference...

CVE-2024-27159

All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for...

KB5005566: Windows 10 version 1909 / Windows Server 1909 Security Update (September 2021)

The remote Windows host is missing security update 5005566. It is, therefore, affected by multiple vulnerabilities : An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2021-36954, CVE-2021-36955, CVE-2021-36963, CVE-2021-36964,...

KB5005569: Windows 10 version 1507 LTS September 2021 Security Update

The remote Windows host is missing security update 5005569. It is, therefore, affected by multiple vulnerabilities : An memory corruption vulnerability exists. An attacker can exploit this to corrupt the memory and cause unexpected behaviors within the system/application. ...

KB5000808: Windows 10 Version 1909 March 2021 Security Update

The remote Windows host is missing security update 5000808. It is, therefore, affected by multiple vulnerabilities : An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2021-1640, CVE-2021-1729, CVE-2021-24090, CVE-2021-24095,...

KB4598275: Windows 8.1 and Windows Server 2012 R2 January 2021 Security Update

The remote Windows host is missing security update 4598275 or cumulative update 4598285. It is, therefore, affected by multiple vulnerabilities : An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. (CVE-2021-1637,...

Language Security Updates for Microsoft SharePoint Server 2016 (December 2020)

The Microsoft SharePoint Server 2016 installation on the remote host is missing language security updates. It is, therefore, affected by a Microsoft SharePoint Information Disclosure Vulnerability (CVE-2020-17089) Note that Nessus has not tested for this issue but has instead relied only on the...

Security Updates for Microsoft Sharepoint 2016 (May 2021)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-28474, CVE-2021-31181) Microsoft SharePoint Information Disclosure...

Security Updates for Microsoft Sharepoint 2016 (April 2021)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: Microsoft SharePoint Denial of Service Update (CVE-2021-28450) Microsoft Word Remote Code Execution Vulnerability...

Security Updates for Microsoft SharePoint Server 2019 (November 2020)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : An Information Disclosure Vulnerability exists in Microsoft SharePoint. (CVE-2020-16979, CVE-2020-17017) A Spoofing Vulnerability exists...

Security Updates for Microsoft Exchange Server (April 2021)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: A remote code execution vulnerability. An attacker could exploit this to execute unauthorized arbitrary code. (CVE-2021-28483, CVE-2021-28482, ...

glpi -- SQL Injection in Search API

MITRE Corporation reports: In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or...

glpi -- able to read any token through API user endpoint

MITRE Corporation reports: In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or...

CVE-2024-27161

all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with other vulnerabilities and difficult...

CVE-2024-27173

Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is...

CVE-2024-27177

An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower...

CVE-2019-1387

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code....

CVE-2024-27148

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference...

CVE-2024-27143

Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote printer. Using this vulnerability will allow any attacker to get a root access on a remote Toshiba printer. This vulnerability can be executed in combination.....

CVE-2024-27144

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer....

CVE-2024-3498

Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference...

CVE-2024-27175

Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference...

CVE-2024-27172

Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference...

CVE-2024-27170

It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected products/models/versions, see the reference...

CVE-2024-27166

Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/versions, see the reference...

KB5036910: Windows 11 version 22H2 / Windows Server version 23H2 Security Update (April 2024)

The remote Windows host is missing security update 5036910. It is, therefore, affected by multiple vulnerabilities SmartScreen Prompt Security Feature Bypass Vulnerability (CVE-2024-29988) Secure Boot Security Feature Bypass Vulnerability (CVE-2024-20669, CVE-2024-26168, CVE-2024-26171, ...

KB5005568: Windows 10 Version 1809 and Windows Server 2019 September 2021 Security Update

The remote Windows host is missing security update 5005568. It is, therefore, affected by multiple vulnerabilities : An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2021-36954, CVE-2021-36955, CVE-2021-36963, CVE-2021-36964,...

KB5001389: Windows Server 2008 Security Update (Apr 2021)

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities: Microsoft Internet Messaging API Remote Code Execution Vulnerability (CVE-2021-27089) Windows Kernel Information Disclosure Vulnerability (CVE-2021-27093, CVE-2021-28309) Windows...

IBM Rational Focal Point RequestAccessController Servlet File Disclosure

Nessus was able to exploit a file disclosure vulnerability in the RequestAccessController serlvet on the remote IBM Focal Point install. A remote attacker could leverage this vulnerability to view sensitive files (such as configuration...

IBM Rational Focal Point Login Servlet File Disclosure

Nessus was able to exploit a file disclosure vulnerability in the Login servlet on the remote IBM Focal Point install. A remote attacker could potentially use this vulnerability to view sensitive files (such as configuration...

Security Updates for Microsoft Sharepoint 2016 (June 2021)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-26420, CVE-2021-31963, CVE-2021-31964, CVE-2021-31966) ...

Security Updates for Exchange (September 2017)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An...

CVE-2024-27150

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference...

CVE-2024-27149

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference...

CVE-2024-27141

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication......

CVE-2024-27158

All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference...

CVE-2024-27157

The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference...

CVE-2024-27155

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. As for the affected products/models/versions, see the reference...