Angel Browser vulnerable in the WebView class

Overview Angel Browser is a web browser for Android devices. Angel Browser contains a vulnerability in the WebView class. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

FileMaker Pro fails to verify SSL server certificates

Overview FileMaker Pro contains a function to encrypt communications with the FileMaker Server. FileMaker Pro fails to verify the SSL server certificate. Impact A man-in-the-minddle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Upgrade the software Upgrade to t...

Yahoo! Browser vulnerable to address bar spoofing

Overview Yahoo! Browser contains an issue in displaying URL, which may result in the address bar being spoofed. Note that this vulnerability is different from JVN55074201. Keita Haga of keitahaga.com reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

OpenPNE vulnerable to cross-site scripting

Overview The management screen in OpenPNE contains an issue in the processing of data input into the "mobile version color scheme configuration" item, which may result in a cross-site scripting vulnerability. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

Sleipnir Mobile for Android loads arbitrary Extension API

Overview Sleipnir Mobile for Android has an Extension mechanism to customize browser functions, and this Extension function makes calls to an Extension API. Sleipnir Mobile for Android contains an issue that may allow a specially crafted web page to load an arbitrary Extension API. Keita Haga of...

OpenWnn for Android vulnerable to information disclosure

Overview OpenWnn for Android contains an issue in the access permissions for certain files. OpenWnn provided by OMRON SOFTWARE Co., Ltd. is a Japanese Input Method Editor IME. OpenWnn for Android contains an issue in the access permissions for certain files. Gaku Mochizuki of Mitsui Bussan Secure...

Lotus Domino vulnerable to denial-of-service (DoS)

Overview Lotus Domino provided by IBM contains a denial-of-service DoS vulnerability. Lotus Domino contains a denial-of-service DoS vulnerability due to an issue in processing HTTP requests. Ryouichi Ozawa of Oki Electric Industry Co., Ltd reported this vulnerability to IPA. JPCERT/CC coordinated...

OpenWnn/Flick support vulnerable to information disclosure

Overview OpenWnn/Flick support contains an issue in the access permissions for the certain files. OpenWnn/Flick support is a Japanese Input Method Editor IME for Android devices. OpenWnn/Flick support contains an issue in the access permissions for the certain files. Impact If a user of the...

Simeji vulnerable to information disclosure

Overview Simeji contains an issue in the access permissions for the certain files. Simeji is a Japanese Input Method Editor IME for Android devices. Simeji contains an issue in the access permissions for the certain files. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this...

ArtIME Japanese Input vulnerable to information disclosure

Overview ArtIME Japanese Input contains an issue in the access permissions for the certain files. ArtIME Japanese Input is a Japanese Input Method Editor IME for Android devices. ArtIME Japanese Input contains an issue in the access permissions for the certain files. Gaku Mochizuki of Mitsui Buss...

KindEditor (v.3.x->4.1.5) <= Multiple File/Shell Upload Vulnerability

This bug in KindEditor you can upload remote files .txt .html ...etc with multiple JSON upload langs type PHP / ASP / JSP / ASP.NET this bug found in old versions by some author , but is still work is latest version . - Latest V. is 4.1.5 , Released on Jan 19, 2013...

Multiple Cisco products vulnerable to denial-of-service (DoS)

Overview The SSH implementation in multiple Cisco products contains a denial-of-service DoS vulnerability. Hisashi Kojima, Masahiro Nakada of Fujitsu Laboratories Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

Nginx 'access.log'不安全文件权限漏洞

BUGTRAQ ID: 58105 CVECAN ID: CVE-2013-0337 nginx是一款使用非常广泛的高性能Web服务器。 在Gentoo上，/var/log/nginx全局可访问，目录内的日志文件也是全局可读，这可允许未授权用户读取日志文件。 0 Igor Sysoev nginx 厂商补丁： Igor Sysoev ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://nginx.net/...

imgboard vulnerable to cross-site scripting

Overview imgboard contains a cross-site scripting vulnerability. imgboard provided by imgboard.com CGI Download Center formerly 1998 t-club CGI Download Center is a bulletin board software that supports posting picture files. imgboard contains a cross-site scripting vulnerability. Yuji Tounai of...

Mandriva Linux Security Advisory : mysql (MDVSA-2013:007)

This is a maintenance and bugfix release that upgrades mysql to the latest version which resolves various upstream bugs and a total of 18 security related bugs CVE-2012-0572, CVE-2012-0574, CVE-2012-0578, CVE-2012-1702, CVE-2012-1705, CVE-2012-5060, CVE-2012-5096, CVE-2012-5611, CVE-2012-5612,...

Cybozu Garoon vulnerable to SQL injection

Overview Cybozu Garoon contains an SQL injection vulnerability. Cybozu Garoon provided by Cybozu is a groupware. Cybozu Garoon contains an SQL injection vulnerability. Ken Asai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

C-Panel Cross Site Scripting

No description provided by source. CPanel Non Persistent XSS Details ============= Product: Cpanel Security-Risk: High Remote-Exploit: yes Vendor-URL: http://www.cpanel.net Advisory-Status: NotPublished Credits ============= Discovered by: Rafay Baloch of RafayHackingArticlesRHA Affected Products...

phpwcms 'preg_replace()'multiple remote PHP code injection vulnerability-vulnerability warning-the black bar safety net

phpwcms is an open source content management system. phpwcms 1.5.4.6 and other versions in the realization on the presence of a plurality of code injection vulnerability, an authenticated remote attacker can use the"backend user""admin user""backend user"account exploit these...

JVN#65458431: concrete5 vulnerable to cross-site scripting

concrete5 is an open source content management system CMS. concrete5 contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version according to the information provided by the develope...

WikkaWiki vulnerable to cross-site scripting

Overview WikkaWiki contains a cross-site scripting vulnerability. WikkaWiki is an open source wiki written in PHP. WikkaWiki contains a cross-site scripting vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...