PT-2017-15209

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.0.0 through 4.2.4 Description A session fixation issue allows remote attackers to perform arbitrary operations. Recommendations For Cybozu Garoon versions 4.0.0 through 4.2.4, update to a version that contains a fix fo...

CVE-2017-2145: Session Fixation

Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors...

PT-2017-9362

Name of the Vulnerable Software and Affected Versions Corega CG-WLR300NX firmware version 1.20 and earlier Description The issue allows an attacker on the same network segment to bypass access restrictions and perform arbitrary operations. Recommendations For Corega CG-WLR300NX firmware version...

CVE-2016-7811: Improper Access Control

Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations via unspecified vectors...

CVE-2016-4854

Cross-site request forgery CSRF vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors...

PT-2017-8552

Name of the Vulnerable Software and Affected Versions L-04D firmware versions V10a through V10b Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators, enabling them to perform arbitrary operations. The exact vectors used for...

CVE-2017-2101

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors...

CVE-2017-2101

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors...

PT-2017-15168

Name of the Vulnerable Software and Affected Versions AppGoat versions 3.0.0 and earlier Description The issue allows remote attackers to bypass authentication, enabling them to perform arbitrary operations. The exact vectors used for this bypass are not specified. Recommendations For AppGoat...

CVE-2017-2101: Improper Authentication

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors...

Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to authentication bypass

Overview AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains an authentication bypass vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/CC...

CG-WLR300NX fails to restrict access permissions

Overview CG-WLR300NX provided by Corega Inc is a wireless LAN router. CG-WLR300NX fails to restrict access permissions. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

WordPress plugin "Welcart e-Commerce" vulnerable to session management

Overview WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a vulnerability in session management. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

TYPO3 CMS Access Check Vulnerability

TYPO3 CMS is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 CMS versions 4.3.0 through 8.1.0 that stems from the program failing to properly perform access checks. An attacker can exploit the...

CG-WLBARGS does not properly perform authentication

Overview CG-WLBARGS provided by Corega Inc is a wireless LAN router. CG-WLBARGS does not properly perform authentication. Kousuke Kawahira of DWANGO Co.,Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

Unspecified Vulnerability in WordPress Plugin WPML

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.WPML is one of the multi-language plug-ins. A security vulnerability exists in the WordPress WPML plugin prior to...

CVE-2013-3601

Affected software: Coursemill Learning Management System (LMS) 6.6. Vulnerability: inadequate restriction of JSP function calls allows remote authenticated users (via Student role) to perform arbitrary JSP operations by supplying an op parameter. Impact: privilege escalation to execute restricted...

Design/Logic Flaw

NEC Universal RAID Utility 1.40 Rev 680 and earlier, 2.31 Rev 1492 and earlier, and 2.5 Rev 2244 and earlier does not provide access control, which allows remote attackers to perform arbitrary RAID disk operations via unspecified vectors...

CVE-2013-0706

CVE-2013-0706 affects NEC Universal RAID Utility and its older revisions: 1.40 Rev 680 and earlier, 2.31 Rev 1492 and earlier, and 2.5 Rev 2244 and earlier. The root cause is that the utility does not provide proper access control, enabling a remote unauthenticated attacker to perform arbitrary R...