Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2016-1139
Cross-site request forgery (CSRF) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06'}, {'name': 'JVNDB-2016-000010', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000010'}, {'name': 'JVN#54686544', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN54686544/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1140
KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06'}, {'name': 'JVN#54686544', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN54686544/index.html'}, {'name': 'JVNDB-2016-000011', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000011'}]
CVE State: PUBLISHED
Explain CVE-2016-1141
KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06'}, {'name': 'JVNDB-2016-000012', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000012'}, {'name': 'JVN#54686544', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN54686544/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1142
Seeds acmailer before 3.8.21 and 3.9.x before 3.9.15 Beta allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.acmailer.jp/info/de.cgi?id=64'}, {'name': 'JVNDB-2016-000002', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000002'}, {'name': 'JVN#50899877', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN50899877/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1143
Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ikeay/vinemv/commit/f41efbcac1f9262a161ebc1babfcf55fae9e939a'}, {'name': 'JVNDB-2016-000016', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000016'}, {'name': 'JVN#12165579', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN12165579/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1144
Cross-site scripting (XSS) vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000017', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000017'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ws-download.net/info.php?type=version&id=V0001081'}, {'name': 'JVN#26921563', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN26921563/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1145
Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and Solaris allows remote attackers to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#03050861', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN03050861/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jpn.nec.com/security-info/secinfo/nv16-001.html'}, {'name': 'JVNDB-2016-000015', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000015'}]
CVE State: PUBLISHED
Explain CVE-2016-1148
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
Affected Products: n/a
References: [{'name': 'JVN#22578691', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN22578691/index.html'}, {'name': 'JVNDB-2016-000019', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000019.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://akerun.com/2016-02-12-akerun-ios-app-security-update/'}]
CVE State: PUBLISHED
Explain CVE-2016-1149
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1150.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000026', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2015/006072.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2015/006087.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2016/006107.html'}, {'name': 'JVN#69278491', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN69278491/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2016/006109.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1150
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1149.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000026', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2015/006072.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2015/006087.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2016/006107.html'}, {'name': 'JVN#69278491', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN69278491/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2016/006109.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1151
Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000024', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2016/006111.html'}, {'name': 'JVN#64209269', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN64209269/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1152
Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2015-8486.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000023', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023'}, {'name': 'JVN#48720230', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN48720230/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2015/006076.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1153
customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unspecified vectors, a different vulnerability than CVE-2015-8489.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000020', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000020'}, {'name': 'JVN#20246313', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN20246313/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cs.cybozu.co.jp/2016/006108.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1154
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#31524757', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN31524757/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ec-cube.net/products/detail.php?product_id=279'}, {'name': 'JVNDB-2016-000027', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000027'}]
CVE State: PUBLISHED
Explain CVE-2016-1155
HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.
Affected Products: n/a
References: [{'name': '97662', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97662'}, {'name': 'JVN#99757346', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'https://jvn.jp/vu/JVNVU99757346/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://android.googlesource.com/platform/external/okhttp/+/71b9f47b26fb57ac3e436a19519c6e3ec70e86eb'}]
CVE State: PUBLISHED
Explain CVE-2016-1156
LINE 4.3.0.724 and earlier on Windows and 4.3.1 and earlier on OS X allows remote authenticated users to cause a denial of service (application crash) via a crafted post that is mishandled when displaying a Timeline.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://linecorp.com/ja/security/article/53'}, {'name': 'JVNDB-2016-000029', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000029'}, {'name': 'JVN#46044093', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN46044093/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1157
Cross-site scripting (XSS) vulnerability in log_chat.cgi in Script* Log-Chat before 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#93535632', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN93535632/index.html'}, {'name': 'JVNDB-2016-000031', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://r.o0o0.jp/sc/log-chat/'}]
CVE State: PUBLISHED
Explain CVE-2016-1158
Cross-site request forgery (CSRF) vulnerability on Corega CG-WLBARGMH and CG-WLBARGNL devices allows remote attackers to hijack the authentication of administrators for requests that perform administrative functions.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000032', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000032'}, {'name': 'JVN#59349382', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN59349382/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://corega.jp/support/security/20160229_wlbargmh_wlbargnl.htm'}]
CVE State: PUBLISHED
Explain CVE-2016-1159
In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password history) via a vulnerable hidden service.
Affected Products: Password Manager Pro (PMP)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://excellium-services.com/cert-xlm-advisory/cve-2016-1159/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.manageengine.com/products/passwordmanagerpro/release-notes.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/vu/JVNVU90405898/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.manageengine.com/products/passwordmanagerpro/issues-fixed.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1160
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000034', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000034'}, {'name': 'JVN#86517621', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN86517621/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/wp-favorite-posts/changelog/'}]
CVE State: PUBLISHED
Explain CVE-2016-1161
Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500).
Affected Products: n/a
References: [{'name': '91531', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/91531'}, {'tags': ['x_refsource_MISC'], 'url': 'http://jvn.jp/en/vu/JVNVU95113461/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.excellium-services.com/cert-xlm-advisory/cve-2016-1161/'}]
CVE State: PUBLISHED
Explain CVE-2016-1167
Cross-site request forgery (CSRF) vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'name': 'JVN#82020528', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN82020528/index.html'}, {'name': 'JVNDB-2016-000036', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000036'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jpn.nec.com/security-info/secinfo/nv16-005.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1168
Cross-site request forgery (CSRF) vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000035', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000035'}, {'name': 'JVN#07818796', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN07818796/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jpn.nec.com/security-info/secinfo/nv16-004.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1169
Cross-site scripting (XSS) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000044', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000044'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hiniarata.jp/news/archives/55'}, {'name': 'JVN#55801246', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55801246/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1170
Cross-site request forgery (CSRF) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to hijack the authentication of administrators.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hiniarata.jp/news/archives/55'}, {'name': 'JVN#55801246', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN55801246/index.html'}, {'name': 'JVNDB-2016-000045', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000045'}]
CVE State: PUBLISHED
Explain CVE-2016-1171
Cross-site scripting (XSS) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#13288761', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN13288761/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hiniarata.jp/news/archives/55'}, {'name': 'JVNDB-2016-000040', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000040'}]
CVE State: PUBLISHED
Explain CVE-2016-1172
Cross-site request forgery (CSRF) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000041', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000041'}, {'name': 'JVN#13288761', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN13288761/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hiniarata.jp/news/archives/55'}]
CVE State: PUBLISHED
Explain CVE-2016-1173
Cross-site scripting (XSS) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#26627848', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN26627848/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hiniarata.jp/news/archives/55'}, {'name': 'JVNDB-2016-000042', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000042'}]
CVE State: PUBLISHED
Explain CVE-2016-1174
Cross-site request forgery (CSRF) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.
Affected Products: n/a
References: [{'name': 'JVN#26627848', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN26627848/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hiniarata.jp/news/archives/55'}, {'name': 'JVNDB-2016-000043', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000043'}]
CVE State: PUBLISHED
Explain CVE-2016-1175
Cross-site request forgery (CSRF) vulnerability in AQUOS Photo Player HN-PP150 1.02.00.04 through 1.03.01.04 allows remote attackers to hijack the authentication of arbitrary users.
Affected Products: n/a
References: [{'name': 'JVN#47164236', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN47164236/index.html'}, {'name': 'JVNDB-2016-000039', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000039'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sharp.co.jp/support/photoplayer/fw_update.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1176
Buffer overflow in the ActiveX control in Sharp EVA Animeter allows remote attackers to execute arbitrary code via a crafted web page.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000038', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000038'}, {'name': 'JVN#41875357', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN41875357/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1177
The management screen in Falcon WisePoint 4.3.1 and earlier and WisePoint Authenticator 4.1.19.22 and earlier allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#28480773', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28480773/index.html'}, {'name': 'JVNDB-2016-000037', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000037'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.falconsc.com/'}]
CVE State: PUBLISHED
Explain CVE-2016-1178
The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#03975805', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN03975805/index.html'}, {'name': 'JVNDB-2016-000047', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000047.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://developer.a-blogcms.jp/blog/patch/entry-2363.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1179
Cross-site scripting (XSS) vulnerability in the standard template of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000046', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000046.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://developer.a-blogcms.jp/blog/patch/entry-2363.html'}, {'name': 'JVN#73166466', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN73166466/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1180
Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cyber-will.co.jp/SA_JVN_78482127'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ec-cube.net/products/detail.php?product_id=799'}, {'name': 'JVNDB-2016-000048', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000048'}, {'name': 'JVN#78482127', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN78482127/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1181
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000096', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000096'}, {'name': '91068', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/91068'}, {'name': '1036056', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036056'}, {'name': 'JVN#03188560', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN03188560/index.html'}, {'name': '91787', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/91787'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujul2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20180629-0006/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1343538'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2016-1181'}]
CVE State: PUBLISHED
Explain CVE-2016-1182
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000097', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000097'}, {'name': 'JVN#65044642', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN65044642/index.html'}, {'name': '1036056', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036056'}, {'name': '91067', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/91067'}, {'name': '91787', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/91787'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujul2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20180629-0006/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1343540'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2016-1182'}]
CVE State: PUBLISHED
Explain CVE-2016-1183
NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183'}, {'name': 'JVN#74659077', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN74659077/index.html'}, {'name': 'JVNDB-2016-000098', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000098'}]
CVE State: PUBLISHED
Explain CVE-2016-1184
Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000049', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000049.html'}, {'name': 'JVN#00272277', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00272277/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.tokyostarbank.co.jp/important151222.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1185
The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application.
Affected Products: n/a
References: [{'name': 'JVN#89026267', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN89026267/index.html'}, {'name': '96842', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/96842'}, {'name': 'JVNDB-2016-000055', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000055'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9479'}]
CVE State: PUBLISHED
Explain CVE-2016-1186
Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
Affected Products: n/a
References: [{'name': '97976', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97976'}, {'name': 'JVN#91816422', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91816422/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9480'}, {'name': 'JVNDB-2016-000056', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000056.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1187
Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9446'}, {'name': 'JVN#11994518', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN11994518/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9495'}, {'name': 'JVNDB-2016-000060', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000060.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1188
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#18975349', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18975349/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/8845'}, {'name': 'JVNDB-2016-000077', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000077'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03'}]
CVE State: PUBLISHED
Explain CVE-2016-1189
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#18975349', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18975349/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9020'}, {'name': 'JVNDB-2016-000093', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000093'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03'}]
CVE State: PUBLISHED
Explain CVE-2016-1190
Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/8877'}, {'name': 'JVN#18975349', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN18975349/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03'}, {'name': 'JVNDB-2016-000094', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000094'}]
CVE State: PUBLISHED
Explain CVE-2016-1191
Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000078', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000078'}, {'name': 'JVN#14749391', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN14749391/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03'}]
CVE State: PUBLISHED
Explain CVE-2016-1192
Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#14749391', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN14749391/index.html'}, {'name': 'JVNDB-2016-000095', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000095'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03'}]
CVE State: PUBLISHED
Explain CVE-2016-1193
Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#25765762', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN25765762/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/8919'}, {'name': 'JVNDB-2016-000079', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000079'}]
CVE State: PUBLISHED
Explain CVE-2016-1194
Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/8983'}, {'name': 'JVNDB-2016-000080', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000080.html'}, {'name': 'JVN#26298347', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN26298347/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1195
Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/8987'}, {'name': 'JVNDB-2016-000081', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000081'}, {'name': 'JVN#32218514', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN32218514/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1196
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information via an API call, a different vulnerability than CVE-2015-7776.
Affected Products: n/a
References: [{'name': 'JVN#33879831', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN33879831/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/8970'}, {'name': 'JVNDB-2016-000082', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000082'}]
CVE State: PUBLISHED
Explain CVE-2016-1197
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775.
Affected Products: n/a
References: [{'name': 'JVN#37121456', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN37121456/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9303'}, {'name': 'JVNDB-2016-000083', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000083'}]
CVE State: PUBLISHED
Explain CVE-2016-1198
Photopt for Android before 2.0.1 does not verify SSL certificates.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000050', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000050.html'}, {'name': 'JVN#11815655', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN11815655/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://mypocket.ntt.com/photopt/info/info_001.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1199
The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200.
Affected Products: n/a
References: [{'name': 'JVN#47473944', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN47473944/index.html'}, {'name': 'JVNDB-2016-000051', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000051'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ec-cube.net/info/weakness/weakness.php?id=65'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ec-cube.net/info/weakness/201604/'}]
CVE State: PUBLISHED
Explain CVE-2016-1200
The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199.
Affected Products: n/a
References: [{'name': '90503', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/90503'}, {'name': 'JVN#11458774', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN11458774/index.html'}, {'name': 'JVNDB-2016-000052', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000052'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ec-cube.net/info/weakness/201604/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ec-cube.net/info/weakness/weakness.php?id=66'}]
CVE State: PUBLISHED
Explain CVE-2016-1201
Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators.
Affected Products: n/a
References: [{'name': '90515', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/90515'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ec-cube.net/info/weakness/weakness.php?id=67'}, {'name': 'JVNDB-2016-000053', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000053'}, {'name': 'JVN#73776243', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN73776243/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ec-cube.net/info/weakness/201604/'}]
CVE State: PUBLISHED
Explain CVE-2016-1202
Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/electron/electron/commit/9a2e2b365d061ec10cd861391fd5b1344af7194d'}, {'name': 'JVNDB-2016-000054', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000054'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/electron/electron/pull/2976'}, {'name': 'JVN#00324715', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN00324715/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1205
Cross-site scripting (XSS) vulnerability in the shiro8 (1) category_freearea_ addition_plugin plugin 1.0 and (2) itemdetail_freearea_ addition_plugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#63384827', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN63384827/index.html'}, {'name': '88872', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/88872'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ec-cube.net/products/detail.php?product_id=505'}, {'name': 'JVNDB-2016-000057', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000057'}]
CVE State: PUBLISHED
Explain CVE-2016-1206
The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack.
Affected Products: n/a
References: [{'name': 'JVN#25674893', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN25674893/index.html'}, {'name': 'JVNDB-2016-000061', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/'}]
CVE State: PUBLISHED
Explain CVE-2016-1207
Cross-site scripting (XSS) vulnerability on I-O DATA DEVICE WN-G300R devices with firmware 1.12 and earlier, WN-G300R2 devices with firmware 1.12 and earlier, and WN-G300R3 devices with firmware 1.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVN#22978346', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN22978346/index.html'}, {'name': 'JVNDB-2016-000062', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000062'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.iodata.jp/support/information/2016/wn-g300r_xss/'}]
CVE State: PUBLISHED
Explain CVE-2016-1208
The server in Apple FileMaker before 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://help.filemaker.com/app/answers/detail/a_id/15364'}, {'name': 'JVN#91638315', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN91638315/index.html'}, {'name': 'JVNDB-2016-000063', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000063'}]
CVE State: PUBLISHED
Explain CVE-2016-1209
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wordpress.org/plugins/ninja-forms/changelog/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpvulndb.com/vulnerabilities/8485'}, {'name': 'JVNDB-2016-000064', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000064'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://ninjaforms.com/important-security-update-always-hurt-ones-love/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rapid7.com/db/modules/exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_upload'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html'}, {'name': 'JVN#44657371', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN44657371/index.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilities'}]
CVE State: PUBLISHED
Explain CVE-2016-1210
The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000065', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000065.html'}, {'name': 'JVN#11877654', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN11877654/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1211
Cross-site scripting (XSS) vulnerability in Epoch Web Mailing List 0.31 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000066', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000066'}, {'name': 'JVN#43076390', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN43076390/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.psl.ne.jp/perl/ml/index.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1212
Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000069', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000069'}, {'name': 'JVN#42545812', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN42545812/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.futomi.com/library/info/2016/201605.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1213
The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.
Affected Products: n/a
References: [{'name': 'JVN#67266823', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67266823/index.html'}, {'name': '92596', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92596'}, {'name': 'JVNDB-2016-000142', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2016-000142'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9221'}]
CVE State: PUBLISHED
Explain CVE-2016-1214
Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.
Affected Products: n/a
References: [{'name': 'JVNDB-2016-000143', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000143.html'}, {'name': 'JVN#67595539', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN67595539/index.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.cybozu.com/ja-jp/article/9222'}, {'name': '92601', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92601'}]
CVE State: PUBLISHED