Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-4838 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:39:26.287Z Vendors: Money Foward, Inc., SOURCENEXT CORPORATION Products: Money Forward, Money Forward for The Gunma Bank, Money Forward for SHIGA BANK, Money Forward for SHIZUOKA BANK, Money Forward for SBI Sumishin Net Bank, Money Forward for Tokai Tokyo Securities, Money Forward for THE TOHO BANK, Money Forward for YMFG, Money Forward for AppPass, Money Forward for au SMARTPASS, Money Forward for Chou Houdai Problem Types: Unintended operation execution Description: The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BA
id Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION allows an attacker to execute unintended operations via a specially crafted app
18.3) provided by SOURCENEXT CORPORATION allows an attacker to execute unintended operations via a specially crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.sourcenext.com/support/i/160725_1 - https://jvn.jp/en/jp/JVN49343562/index.html - http://corp.moneyforward.com/info/20160920-mf-android/ - http://www.securityfocus.com/bid/93034
CVE ID: CVE-2016-4839 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:39:26.310Z Vendors: Money Foward, Inc., SOURCENEXT CORPORATION Products: Money Forward, Money Forward for The Gunma Bank, Money Forward for SHIGA BANK, Money Forward for SHIZUOKA BANK, Money Forward for SBI Sumishin Net Bank, Money Forward for Tokai Tokyo Securities, Money Forward for THE TOHO BANK, Money Forward for YMFG, Money Forward for AppPass, Money Forward for au SMARTPASS, Money Forward for Chou Houdai Problem Types: WebView implmentation issue Description: The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK
Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION do not properly implement the WebView class, which allows an attacker to disclose
3) provided by SOURCENEXT CORPORATION do not properly implement the WebView class, which allows an attacker to disclose information stored on the device via a specially crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://www.sourcenext.com/support/i/160725_1 - http://www.securityfocus.com/bid/93035 - http://corp.moneyforward.com/info/20160920-mf-android/ - https://jvn.jp/en/jp/JVN61297210/index.html
CVE ID: CVE-2016-4840 State: PUBLISHED Published: 2017-04-21T14:00:00 Last Updated: 2024-08-06T00:39:26.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92314 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000133.html - http://jvn.jp/en/jp/JVN06920277/index.html
CVE ID: CVE-2016-4841 State: PUBLISHED Published: 2017-04-21T14:00:00 Last Updated: 2024-08-06T00:39:26.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers. Additional Analyst Notes: - CVE Program Container: References: - https://support.cybozu.com/ja-jp/article/9607 - http://www.securityfocus.com/bid/92459 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000135.html - http://jvn.jp/en/jp/JVN01353821/index.html
CVE ID: CVE-2016-4842 State: PUBLISHED Published: 2017-04-20T18:00:00 Last Updated: 2024-08-06T00:39:26.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read. Additional Analyst Notes: - CVE Program Container: References: - https://support.cybozu.com/ja-jp/article/9606 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000136.html - http://jvn.jp/en/jp/JVN02576342/index.html - http://www.securityfocus.com/bid/92460
CVE ID: CVE-2016-4843 State: PUBLISHED Published: 2017-04-20T18:00:00 Last Updated: 2024-08-06T00:39:26.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN03052683/index.html - http://www.securityfocus.com/bid/92461 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000137.html - https://support.cybozu.com/ja-jp/article/9654
CVE ID: CVE-2016-4844 State: PUBLISHED Published: 2017-04-20T18:00:00 Last Updated: 2024-08-06T00:39:26.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN04125292/index.html - https://support.cybozu.com/ja-jp/article/9605 - http://www.securityfocus.com/bid/92462 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000138.html
CVE ID: CVE-2016-4845 State: PUBLISHED Published: 2016-09-24T10:00:00 Last Updated: 2024-08-06T00:39:26.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content. Additional Analyst Notes: - CVE Program Container: References: - http://www.iodata.jp/support/information/2016/hvl-a_csrf/ - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000134 - http://www.securityfocus.com/bid/92352 -
rt/information/2016/hvl-a_csrf/ - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000134 - http://www.securityfocus.com/bid/92352 - http://jvn.jp/en/jp/JVN35062083/index.html
CVE ID: CVE-2016-4846 State: PUBLISHED Published: 2017-04-21T14:00:00 Last Updated: 2024-08-06T00:39:26.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN45583702/index.html - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000139.html - http://www.securityfocus.com/bid/92498 - http://www.securebrain.co.jp/about/news/2016/08/160817.html
CVE ID: CVE-2016-4847 State: PUBLISHED Published: 2017-04-20T17:00:00 Last Updated: 2024-08-06T00:39:26.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ossec/ossec-wui/commit/b4dcbba7a8eb09ba9d38fc69807a8861255736d0 - http://www.securityfocus.com/bid/92536 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000141.html - http://jvn.jp/en/jp/JVN58455472/index.html
CVE ID: CVE-2016-4848 State: PUBLISHED Published: 2016-09-02T01:00:00 Last Updated: 2024-08-06T00:39:26.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ClipBucket before 2.8.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000140 - https://github.com/arslancb/clipbucket/commit/ff5e37d3e1098a7ce2b9fe60389b14514932dd93 - http://jvn.jp/en/jp/JVN28386124/index.html - http://www.securityfocus.com/bid/92537
CVE ID: CVE-2016-4849 State: PUBLISHED Published: 2017-04-20T17:00:00 Last Updated: 2024-08-06T00:39:26.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or HTML by leveraging use of the COM_getCurrentURL function in (1) public_html/layout/default/header.thtml, (2) public_html/layout/bento/header.thtml, (3) public_html/layout/fotos/header.thtml, or (4) public_html/layout/default/article/article.thtml. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92545 - https://github.com/ivywe/geeklog-ivywe
: - CVE Program Container: References: - http://www.securityfocus.com/bid/92545 - https://github.com/ivywe/geeklog-ivywe/commit/41f4677e2eaa587b80eb9801150c1b402344c43d - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000150.html - https://www.ivywe.co.jp/article.php/xss-ivywe-distribution - http://jvn.jp/en/jp/JVN09836883/index.html - https://github.com/ivywe/geeklog-ivywe/commit/beba390fd86bd991414ebf73e3482966d7115654
CVE ID: CVE-2016-4850 State: PUBLISHED Published: 2017-04-20T18:00:00 Last Updated: 2024-08-06T00:39:26.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://linecorp.com/ja/security/article/65 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000153.html - http://jvn.jp/en/jp/JVN05924524/index.html - http://www.securityfocus.com/bid/92644
CVE ID: CVE-2016-4851 State: PUBLISHED Published: 2016-09-02T01:00:00 Last Updated: 2024-08-06T00:39:26.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Let's PHP! simple chat before 2016-08-15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000152 - http://www.securityfocus.com/bid/92597 - http://jvn.jp/en/jp/JVN42262137/index.html
CVE ID: CVE-2016-4852 State: PUBLISHED Published: 2016-09-12T10:00:00 Last Updated: 2024-08-06T00:46:38.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9, which allows remote attackers to cause a denial of service (application crash) via a crafted emoji character sequence. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN94816361/index.html - http://jvn.jp/en/jp/JVN94816361/995844/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000151 - http://www.securityfocus.com/bid/926
en/jp/JVN94816361/995844/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000151 - http://www.securityfocus.com/bid/92609
CVE ID: CVE-2016-4853 State: PUBLISHED Published: 2016-09-02T01:00:00 Last Updated: 2024-08-06T00:46:38.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN85213412/index.html - http://www.securityfocus.com/bid/92700 - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000154 - http://jvn.jp/en/jp/JVN85213412/995740/index.html
CVE ID: CVE-2016-4854 State: PUBLISHED Published: 2017-05-22T16:00:00 Last Updated: 2024-08-06T00:46:38.434Z Vendors: NTT DOCOMO, INC. Products: L-04D Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000194 - https://jvn.jp/en/jp/JVN46351856/index.html - http://www.securityfocus.com/bid/93278
CVE ID: CVE-2016-4855 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:46:38.444Z Vendors: ADOdb Products: ADOdb Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ADOdb/ADOdb/issues/274 - http://www.securityfocus.com/bid/92753 - https://security.gentoo.org/glsa/201701-59 - http://jvn.jp/en/jp/JVN48237713/index.html
CVE ID: CVE-2016-4856 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:46:38.427Z Vendors: Splunk Inc. Products: Splunk Enterprise, Splunk Light Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAPN9 - https://jvn.jp/en/jp/JVN71462075/index.html - http://www.securityfocus.com/bid/92990
CVE ID: CVE-2016-4857 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:46:38.451Z Vendors: Splunk Inc. Products: Splunk Enterprise, Splunk Light Problem Types: Open Redirect Description: Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splunk Light prior to 6.4.2 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAPQM - https://jvn.jp/en/jp/JVN39926655/index.html
CVE ID: CVE-2016-4858 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:46:38.458Z Vendors: Splunk Inc. Products: Splunk Enterprise, Splunk Light Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.s
b script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/view/SP-CAAAPN9 - https://jvn.jp/en/jp/JVN71462075/index.html
CVE ID: CVE-2016-4859 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:46:38.464Z Vendors: Splunk Inc. Products: Splunk Enterprise, Splunk Light Problem Types: Open Redirect Description: Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.j
phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN64800312/index.html - https://www.splunk.com/view/SP-CAAAPQ6 - http://www.securityfocus.com/bid/92603
CVE ID: CVE-2016-4860 State: PUBLISHED Published: 2016-09-19T01:00:00 Last Updated: 2024-08-06T00:46:38.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-259-01 - https://web-material3.yokogawa.com/YSAR-16-0002-E.pdf - http://www.securityfocus.com/bid/92981
CVE ID: CVE-2016-4861 State: PUBLISHED Published: 2017-02-16T18:00:00 Last Updated: 2024-08-06T00:46:38.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT/ - https://security.gentoo.org/glsa/201804-10 - https://lists.fedoraproject.org/archives/list/package-
SZYMPBEPZEZTYFTIT/ - https://security.gentoo.org/glsa/201804-10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00012.html - https://framework.zend.com/security/advisory/ZF2016-03 - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158 - http://jvn.jp/en/jp/JVN18926672/index.html
CVE ID: CVE-2016-4862 State: PUBLISHED Published: 2017-04-20T18:00:00 Last Updated: 2024-08-06T00:46:38.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitrary PHP code on the servers. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92992 - http://tips.cs-cart.jp/fix-twigmo-vulnerability-20160914.html - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000157.html - http://jvn.jp/en/jp/JVN55389065/index.html
CVE ID: CVE-2016-4863 State: PUBLISHED Published: 2017-05-22T16:00:00 Last Updated: 2024-08-06T00:46:38.522Z Vendors: Toshiba Products: FlashAir SD-WD/WC series Class 6 model, FlashAir SD-WD/WC series Class 10 model W-02, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model, FlashAir II Class 10 model W-02 series, FlashAir III Class 10 model W-03 series, FlashAir W-02 series Class 10 model, FlashAir W-03 series Class 10 model Problem Types: Lack of authentication mechanism Description: The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE ser
0.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or dat
AN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93479 - https://jvn.jp/en/jp/JVN39619137/index.html - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168
CVE ID: CVE-2016-4864 State: PUBLISHED Published: 2017-05-12T18:00:00 Last Updated: 2024-08-06T00:46:38.474Z Vendors: Kazuho Oku Products: H2O Problem Types: Format String Vulnerability Description: H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/h2o/h2o/issues/1077 - https://jvn.jp/en/jp/JVN94779084/index.html
CVE ID: CVE-2016-4865 State: PUBLISHED Published: 2017-04-17T15:00:00 Last Updated: 2024-08-06T00:46:38.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function. Additional Analyst Notes: - CVE Program Container: References: - https://support.cybozu.com/ja-jp/article/9430 - http://www.securityfocus.com/bid/93281 - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000184.html - http://jvn.jp/en/jp/JVN06726266/index.html
CVE ID: CVE-2016-4866 State: PUBLISHED Published: 2017-04-17T15:00:00 Last Updated: 2024-08-06T00:46:38.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Project function. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000185.html - http://www.securityfocus.com/bid/93281 - https://support.cybozu.com/ja-jp/article/9431 - http://jvn.jp/en/jp/JVN06726266/index.html
CVE ID: CVE-2016-4867 State: PUBLISHED Published: 2017-04-17T15:00:00 Last Updated: 2024-08-06T00:46:38.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project function. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000187.html - http://www.securityfocus.com/bid/93461 - http://jvn.jp/en/jp/JVN07148816/index.html - https://support.cybozu.com/ja-jp/article/9429
CVE ID: CVE-2016-4868 State: PUBLISHED Published: 2017-04-17T15:00:00 Last Updated: 2024-08-06T00:46:38.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests. Additional Analyst Notes: - CVE Program Container: References: - https://support.cybozu.com/ja-jp/article/9433 - http://www.securityfocus.com/bid/97713 - http://jvn.jp/en/jp/JVN08736331/index.html - http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000190.html