BIGACE vulnerable to session fixation

Overview BIGACE contains a session fixation vulnerability. BIGACE is a content management system CMS. BIGACE contains a session fixation vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#60931933: BIGACE vulnerable to session fixation

BIGACE is a content management system CMS. BIGACE contains a session fixation vulnerability. Impact A remote unauthenticated attacker may impersonate a registered user. As a result, information disclosure or alteration may be possible. Solution Update the Software Apply the latest update accordin...

Monaca Debugger for Android information management vulnerability

Overview Monaca Debugger for Android contains an information management vulnerability. Monaca Debugger provided by Asial Corporation contains an issue where account information of the product or other information such as session IDs are saved in a log file. KuMaGa ShiRoIHi reported this...

JVN#56923652: Monaca Debugger for Android information management vulnerability

Monaca Debugger provided by Asial Corporation contains an issue where account information of the product or other information such as session IDs are saved in a log file. Impact Android applications with permissions to read system log files may obtain users credentials of Monaca or other...

Multiple Android devices vulnerable to denial-of-service (DoS)

Overview Multiple Android devices contains a denial-of-service DoS vulnerability. Multiple Android devices contain an issue when referencing specific system area, which may lead to a denial-of-service DoS. Tsukasa Oi of Fourteenforty Research Institue, Inc. reported this vulnerability to IPA...

JVN#74829345: Multiple Android devices vulnerable to denial-of-service (DoS)

Multiple Android devices contain an issue when referencing specific system area, which may lead to a denial-of-service DoS. Impact The device may crash as a result of accessing a specific file. Solution Update the software Update to the latest version according to the information provided by the...

BeZIP vulnerable to directory traversal

Overview BeZIP contains a directory traversal vulnerability. BeZIP provided by Be Graph Co.,Ltd. is a file compression/extraction software supporting ZIP and LZH formats. BeZIP contains a directory traversal vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this...

JVN#18223913: BeZIP vulnerable to directory traversal

BeZIP provided by Be Graph Co.,Ltd. is a file compression/extraction software supporting ZIP and LZH formats. BeZIP contains a directory traversal vulnerability. Impact An arbitrary file may be created or altered when extracting a specially crafted file. Solution Update the software Update to the...

Multiple Vulnerabilities in Hitachi JP1/File Transmission Server/FTP

Overview Hitachi JP1/File Transmission Server/FTP contains multiple vulnerabilities. FTP Bounce Attack in PASV mode Buffer overflow at file transmission Defect of the account information check in user authentication Impact A remote attacker could access arbitrary files in system. Solution Please...

Pebble vulnerable to open redirect

Overview Pebble contains an open redirect vulnerability. Pebble is an open source weblog system. Pebble contains an open redirect vulnerability. Takahisa Kishiya reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impa...

Pebble vulnerable to HTTP header injection

Overview Pebble contains an HTTP header injection vulnerability. Pebble is an open source weblog system. Pebble contains an HTTP header injection vulnerability. Takahisa Kishiya reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

Pebble vulnerability where entries may become unviewable

Overview Pebble contains a vulnerability where blog entries may become unviewable due to a specially crafted comment being posted. Pebble is an open source weblog system. Pebble contains an issue in the processing of comments that are posted on blog entries, which may lead to a vulnerability wher...

MosP kintai kanri vulnerable to authentication bypass

Overview MosP kintai kanri contains an authentication bypass vulnerability. MosP kintai kanri is an open source attendance management software. MosP kintai kanri contains an authentication bypass vulnerability. Masako Ohno reported this vulnerability to IPA. JPCERT/CC coordinated with the develop...

MosP kintai kanri fails to restrict access permissions

Overview MosP kintai kanri contains an issue where access permissions are not restricted. MosP kintai kanri is an open source attendance management software. MosP kintai kanri contains an issue where access permissions are not restricted. Masako Ohno reported this vulnerability to IPA. JPCERT/CC...

JVN#39563771: Pebble vulnerable to HTTP header injection

Pebble is an open source weblog system. Pebble contains an HTTP header injection vulnerability. Impact Forged information may be displayed on the user's web browser, arbitrary scripts may be executed or arbitrary values may be set for cookies. Solution Update the software Update to the latest...

JVN#52264310: MosP kintai kanri vulnerable to authentication bypass

MosP kintai kanri is an open source attendance management software. MosP kintai kanri contains an authentication bypass vulnerability. Impact An attacker with a MosP kintai kanri account may impersonate another user. As a result, information may be obtained and settings may be altered with the...

JVN#55398821: Pebble vulnerable to open redirect

Pebble is an open source weblog system. Pebble contains an open redirect vulnerability. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Update the software Update to the...

JVN#23465354: MosP kintai kanri fails to restrict access permissions

MosP kintai kanri is an open source attendance management software. MosP kintai kanri contains an issue where access permissions are not restricted. Impact A user's information may be obtained by another user with a MosP kintai kanri account. Solution Update the software Update to the latest...

JVN#75492883: Pebble vulnerability where entries may become unviewable

Pebble is an open source weblog system. Pebble contains an issue in the processing of comments that are posted on blog entries, which may lead to a vulnerability where blog entries may become unviewable. Impact A specially crafted comment being posted may cause an arbitrary blog entry to become...

Mac OS X OpenSSH vulnerable to denial-of-service (DoS)

Overview The OpenSSH implementation in Mac OS X is vulnerable to denial-of-service. The OpenSSH implementation in Mac OS X is vulnerable to denial-of-service. MASAKI KATAYAMA of Appirits inc Cyber Security Laboratory reported this vulnerability to IPA. JPCERT/CC coordinated with the developer und...

JVN#75345069: Mac OS X OpenSSH vulnerable to denial-of-service (DoS)

The OpenSSH implementation in Mac OS X is vulnerable to denial-of-service. Impact A remote attacker may cause a denial-of-service. Solution Update the software Update to the latest version according to the information provided by the developer. According to the developer, versions Mac OS X 10.6 a...

Tokyo BBS vulnerable to cross-site scripting

Overview Tokyo BBS contains a cross-site scripting vulnerability. Tokyo BBS provided by Come on Girls Interface contains a cross-site scripting vulnerability. Naohiko Tsuda reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#00322303: Tokyo BBS vulnerable to cross-site scripting

Tokyo BBS provided by Come on Girls Interface contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Apply a patch Apply the patch according to the information provided by the developer. The developer is no longer distributing...

Safari vulnerable to local file content disclosure

Overview Safari contains a vulnerability where a local file may be accessed from remote, which may result in a local file content disclosure. Masahiro YAMADA reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact B...

JVN#42676559: Safari vulnerable to local file content disclosure

Safari contains a vulnerability where a local file may be accessed from remote, which may result in a local file content disclosure. Impact By opening a specially crafted HTML document as a local file, an arbitrary local file may be obtained from remote even though access from other users is...

Smarty vulnerable to cross-site scripting

Overview Smarty contains a cross-site scripting vulnerability. Smarty is a template engine for PHP. Smarty contains a cross-site scripting vulnerability when displaying an error message. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#63650108: Smarty vulnerable to cross-site scripting

Smarty is a template engine for PHP. Smarty contains a cross-site scripting vulnerability when displaying an error message. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version according to the information provided by the...

MyWebSearch vulnerable to cross-site scripting

Overview MyWebSearch contains a cross-site scripting vulnerability. MyWebSearch is a CGI script for searching within a website. MyWebSearch contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to t...

JVN#58160713: MyWebSearch vulnerable to cross-site scripting

MyWebSearch is a CGI script for searching within a website. MyWebSearch contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the...

jigbrowser+ for Android vulnerable in the WebView class

Overview jigbrowser+ for Android contains a vulnerability in the WebView class. jigbrowser+ is a web browser for a smartphone. jigbrowser+ for Android contains a vulnerability in the WebView class. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/...

JVN#86318665: jigbrowser+ for Android vulnerable in the WebView class

jigbrowser+ is a web browser for a smartphone. jigbrowser+ for Android contains a vulnerability in the WebView class. Impact If a user of the affected product uses other malicious Android application, information managed by the affected product may be disclosed. Solution Update the software Updat...

Trend Micro Control Manager vulnerable to SQL injection

Overview Trend Micro Control Manager contains a SQL injection vulnerability. Trend Micro Control Manager contains a vulnerability in the ad hoc query module, which may result in SQL injection. Tom Gregory and Mada R Perdhana of Spentera reported this vulnerability to JPCERT/CC. JPCERT/CC...

JVN#42014489: Trend Micro Control Manager vulnerable to SQL injection

Trend Micro Control Manager contains a vulnerability in the ad hoc query module, which may result in SQL injection. Impact An arbitrary SQL command may be executed in the backend database the product is referencing. Solution Apply a patch Apply the appropriate patch according to the information...

ATOK for Android issue in the access permissions for the learning information file

Overview ATOK for Android provided by JUST Systems, contains an issue in the access permissions for the learning information file. ATOK for Android provided by JUST Systems contains an issue where another application may access the learning information file which stores user input strings. Gaku...

JVN#93344001: ATOK for Android issue in the access permissions for the learning information file

ATOK for Android provided by JUST Systems contains an issue where another application may access the learning information file which stores user input strings. Impact If a user of the affected product uses other malicious Android application, the learning information file may be obtained. Solutio...

myLittleAdmin for SQL Server 2000 vulnerable to arbitrary script execution

Overview myLittleAdmin for SQL Server 2000 contains a vulnerability that may allow arbitrary script execution. myLittleAdmin for SQL server 2000 from myLittleTools is a web-based database management software.The management screen in myLittleAdmin for SQL server 2000 contains a vulnerability that...

Email Anti-virus (formerly WebShield SMTP) vulnerable to denial-of-service

Overview Email Anti-virus formerly WebShield SMTP provided by McAfee Co., Ltd. contains a denial-of-service DoS vulnerability. Email Anti-virus formerly WebShield SMTP provided by McAfee Co., Ltd. is an anti-virus package that scans emails. Email Anti-virus formerly WebShield SMTP contains a...

JVN#50701493: Email Anti-virus (formerly WebShield SMTP) vulnerable to denial-of-service

Email Anti-virus formerly WebShield SMTP provided by McAfee Co., Ltd. is an anti-virus package that scans emails. Email Anti-virus formerly WebShield SMTP contains a denial-of-service DoS vulnerability. Impact An attacker may be able to cause a denial-of-service DoS. Solution Do not use Email...

JVN#56373673: myLittleAdmin for SQL Server 2000 vulnerable to arbitrary script execution

myLittleAdmin for SQL server 2000 from myLittleTools is a web-based database management software.The management screen in myLittleAdmin for SQL server 2000 contains a vulnerability that may allow arbitrary script execution. Impact When a user accesses a malicious database entry through the...

KUNAI Browser for Remote Service beta vulnerable in the WebView class

Overview KUNAI Browser for Remote Service beta contains a vulnerability in the WebView class. KUNAI Browser for Remote Service beta is an Android browser software for using Cybozu. KUNAI Browser for Remote Service beta contains a vulnerability in the WebView class. Impact When there is a maliciou...

JVN#03015214: KUNAI Browser for Remote Service beta vulnerable in the WebView class

KUNAI Browser for Remote Service beta is an Android browser software for using Cybozu. KUNAI Browser for Remote Service beta contains a vulnerability in the WebView class. Impact When there is a malicious file in the user's Android device, clicking a file:// hyperlink may lead to the malicious fi...

Cybozu KUNAI for Android vulnerable in the WebView class

Overview Cybozu KUNAI for Android contains a vulnerability in the WebView class. Cybozu KUNAI is a mobile client software for using Cybozu. Cybozu KUNAI for Android contains a vulnerability in the WebView class. Impact When there is a malicious file in the user's Android device, clicking a file:/...

Cybozu KUNAI for Android vulnerable to arbitrary Java method execution

Overview Cybozu KUNAI for Android contains an arbitrary Java method execution vulnerability. Cybozu KUNAI is a mobile client software for using Cybozu. Cybozu KUNAI for Android contains an arbitrary Java method execution vulnerability. Impact When opening a specially crafted website, an attacker...

JVN#59652356: Cybozu KUNAI for Android vulnerable in the WebView class

Cybozu KUNAI is a mobile client software for using Cybozu. Cybozu KUNAI for Android contains a vulnerability in the WebView class. Impact When there is a malicious file in the user's Android device, clicking a file:// hyperlink may lead to the malicious file being opened and information managed b...

JVN#23568423: Cybozu KUNAI for Android vulnerable to arbitrary Java method execution

Cybozu KUNAI is a mobile client software for using Cybozu. Cybozu KUNAI for Android contains an arbitrary Java method execution vulnerability. Impact When opening a specially crafted website, an attacker may be able to execute an arbitrary Java method. As a result, information stored in Android...

Cybozu Live for Android vulnerable in the WebView class

Overview Cybozu Live for Android contains a vulnerability in the WebView class. Cybozu Live for Android is a client software for Cybozu Live. Cybozu Live for Android contains a vulnerability in the WebView class. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability ...

Cybozu Live for Android vulnerable to arbitrary Java method execution

Overview Cybozu Live for Android contains an arbitrary Java method execution vulnerability. Cybozu Live for Android is a client software for Cybozu Live. Cybozu Live for Android contains an arbitrary Java method execution vulnerability. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc...

JVN#23009798: Cybozu Live for Android vulnerable to arbitrary Java method execution

Cybozu Live for Android is a client software for Cybozu Live. Cybozu Live for Android contains an arbitrary Java method execution vulnerability. Impact When opening a specially crafted website, an attacker may be able to execute an arbitrary Java method. As a result, information stored in Android...

JVN#77393797: Cybozu Live for Android vulnerable in the WebView class

Cybozu Live for Android is a client software for Cybozu Live. Cybozu Live for Android contains a vulnerability in the WebView class. Impact When there is a malicious file in the user's Android device, clicking a file:// hyperlink may lead to the malicious file being opened and information managed...

Opera address bar spoofing vulnerability

Overview Opera contains a vulnerability where the URL displayed in the address bar may be spoofed. Opera contains a vulnerability where certain characters may be displayed in the address bar, causing 2 URLs to potentially be indistinguishable from each other. Masahiro Yamada reported this...