deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5666
Published: 2024-06-29
Description: The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/extensions-for-elementor/trunk/modules/button/widgets/ee-button.php#L88; https://plugins.trac.wordpress.org/changeset/3104024/; https://wordpress.org/plugins/extensions-for-elementor/#developers
CVE: CVE-2024-5790
Published: 2024-06-29
Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading widget in all versions up to, and including, 3.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.11.0/widgets/gradient-heading/widget.php#L260; https://plugins.trac.wordpress.org/changeset/3108597/#file575; https://wordpress.org/plugins/happy-elementor-addons/#developers
CVE: CVE-2024-6363
Published: 2024-06-29
Description: The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/stock-ticker/trunk/stock-ticker.php; https://wordpress.org/plugins/stock-ticker/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/280a5d6d-192a-43aa-927e-45c50b126463?source=cve
CVE: CVE-2024-5819
Published: 2024-06-29
Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3108332/kadence-blocks; https://www.wordfence.com/threat-intel/vulnerabilities/id/c7457ce7-8471-415d-8e34-4505aa34fd61?source=cve; https://plugins.trac.wordpress.org/changeset/3108332/kadence-blocks
CVE: CVE-2023-4017
Published: 2024-06-29
Description: The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’,  'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://goya.everthemes.com/help-center/changelog/#1-0-8-8-august-7-2023; https://themeforest.net/item/goya-modern-woocommerce-theme/25175097; https://www.wordfence.com/threat-intel/vulnerabilities/id/2cce2a10-3d5f-4249-9085-923a1fa76385?source=cve
CVE: CVE-2024-25943
Published: 2024-06-29
Description: iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
CVSS Score: 7.6 (HIGH)
CWE: CWE-330
References: https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability; https://www.dell.com/support/kbdoc/en-us/000226503/dsa-2024-099-security-update-for-dell-idrac9-ipmi-session-vulnerability
CVE: CVE-2024-2386
Published: 2024-06-29
Description: The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3108077/wp-google-map-plugin; https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0deb68-3caf-4ad6-977e-0e954d29e6b7?source=cve; https://plugins.trac.wordpress.org/changeset/3108077/wp-google-map-plugin
CVE: CVE-2024-39840
Published: 2024-06-29
Description: Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module functions to execute bytecode and generate fake objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://memorycorruption.net/posts/rce-lua-factorio/; https://news.ycombinator.com/item?id=40830005; https://memorycorruption.net/posts/rce-lua-factorio/
CVE: CVE-2024-39846
Published: 2024-06-29
Description: NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOTE: in each case, data at rest is encrypted, but is decrypted within process memory during use.
CVSS Score: 3.5 (LOW)
CWE: CWE-312
References: https://github.com/6eero/NewPass/commit/13f0a844d64927450fa751deb7cc06beba699720; https://github.com/6eero/NewPass/releases/tag/v1.2.0; https://github.com/6eero/NewPass/commit/13f0a844d64927450fa751deb7cc06beba699720
CVE: CVE-2024-39848
Published: 2024-06-29
Description: Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws.security.WsGrouperLdapAuthentication and the use of the UyY29r password for the M3vwHr account. This also affects "Grouper for Web Services" before 4.13.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1390
References: https://spaces.at.internet2.edu/display/Grouper/Grouper+bug+-+GRP-5515+-+web+services+LDAP+authentication+security+vulnerability; https://spaces.at.internet2.edu/display/Grouper/Grouper+bug+-+GRP-5515+-+web+services+LDAP+authentication+security+vulnerability
CVE: CVE-2024-5926
Published: 2024-06-30
Description: A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the 'project-name' parameter, enabling attackers to specify paths that traverse the filesystem. By setting 'project-name' to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-29
References: https://huntr.com/bounties/19af24fe-9b90-4638-8fbc-b18def6985d7; https://huntr.com/bounties/19af24fe-9b90-4638-8fbc-b18def6985d7
CVE: CVE-2024-6414
Published: 2024-06-30
Description: A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage of the component Export Page. The manipulation of the argument ID leads to direct request. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270000. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://kiwiyumi.com/post/traksys-export-page-code/; https://vuldb.com/?ctiid.270000; https://vuldb.com/?id.270000
CVE: CVE-2024-6415
Published: 2024-06-30
Description: A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /emgui/rest/preferences/PREF_HOME_PAGE/sponsor/3/ of the component New Widget Handler. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://gentle-khaan-c53.notion.site/Self-Reflected-XSS-in-Ingenico-The-Estate-Manager-94b4c85ffe074c6b870a6454f73edaf4?pvs=4; https://vuldb.com/?ctiid.270001; https://vuldb.com/?id.270001
CVE: CVE-2023-35022
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access.  IBM X-Force ID:  258254.
CVSS Score: 3.3 (LOW)
CWE: CWE-285
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/258254; https://www.ibm.com/support/pages/node/7158447; https://exchange.xforce.ibmcloud.com/vulnerabilities/258254
CVE: CVE-2024-28795
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  286832.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/286832; https://www.ibm.com/support/pages/node/7158408; https://exchange.xforce.ibmcloud.com/vulnerabilities/286832
CVE: CVE-2024-5062
Published: 2024-06-30
Description: A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4; https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f; https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4
CVE: CVE-2023-50954
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system.  IBM X-Force ID:  275776.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-598
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275776; https://www.ibm.com/support/pages/node/7158597; https://exchange.xforce.ibmcloud.com/vulnerabilities/275776
CVE: CVE-2024-28798
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  287172.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287172; https://www.ibm.com/support/pages/node/7158439; https://exchange.xforce.ibmcloud.com/vulnerabilities/287172
CVE: CVE-2024-31902
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.   IBM X-Force ID:  289234.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/289234; https://www.ibm.com/support/pages/node/7159066; https://exchange.xforce.ibmcloud.com/vulnerabilities/289234
CVE: CVE-2024-35119
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace.  This information could be used in further attacks against the system.  IBM X-Force ID:  290342.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/290342; https://www.ibm.com/support/pages/node/7159052; https://exchange.xforce.ibmcloud.com/vulnerabilities/290342
CVE: CVE-2023-50952
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.  IBM X-Force ID:  275774.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275774; https://www.ibm.com/support/pages/node/7158437; https://exchange.xforce.ibmcloud.com/vulnerabilities/275774
CVE: CVE-2023-50953
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.  IBM X-Force ID:  275775.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275775; https://www.ibm.com/support/pages/node/7159057; https://exchange.xforce.ibmcloud.com/vulnerabilities/275775
CVE: CVE-2024-28797
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  287136.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287136; https://www.ibm.com/support/pages/node/7158431; https://exchange.xforce.ibmcloud.com/vulnerabilities/287136
CVE: CVE-2024-31898
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.   IBM X-Force ID:  288182.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/288182; https://www.ibm.com/support/pages/node/7158425; https://exchange.xforce.ibmcloud.com/vulnerabilities/288182
CVE: CVE-2023-50964
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  276102.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/276102; https://www.ibm.com/support/pages/node/7159060; https://exchange.xforce.ibmcloud.com/vulnerabilities/276102
CVE: CVE-2024-28794
Published: 2024-06-30
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  286831.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/286831; https://www.ibm.com/support/pages/node/7158444; https://exchange.xforce.ibmcloud.com/vulnerabilities/286831
CVE: CVE-2024-34703
Published: 2024-06-30
Description: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The proof of concept used a 16Kbit prime for this purpose. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at most 521 bits. No known workarounds are available. Note that support for explicit encoding of elliptic curve parameters is deprecated in Botan.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405, CWE-770
References: https://github.com/randombit/botan/commit/08c404b23740babee1f6aa51b54e966029aadee4; https://github.com/randombit/botan/commit/94e9154c143aa5264da6254a6a1be5bc66ee2b5a; https://github.com/randombit/botan/security/advisories/GHSA-w4g2-7m2h-7xj7
CVE: CVE-2024-6416
Published: 2024-06-30
Description: A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(sleep(10)))v) leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270007.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://fushuling.com/index.php/2024/06/24/test4/; https://vuldb.com/?ctiid.270007; https://vuldb.com/?id.270007
CVE: CVE-2024-6417
Published: 2024-06-30
Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_user. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270008.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/xyj123a/cve/blob/main/sql.md; https://vuldb.com/?ctiid.270008; https://vuldb.com/?id.270008
CVE: CVE-2024-6418
Published: 2024-06-30
Description: A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.php?f=register_user. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270009 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/jadu101/CVE/blob/main/SourceCodester_Medicine_Tracker_System_Users_php_sqli.md; https://vuldb.com/?ctiid.270009; https://vuldb.com/?id.270009
CVE: CVE-2024-6419
Published: 2024-07-01
Description: A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Master.php?f=save_medicine. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270010 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/SourceCodester_Medicine_Tracker_System_Master_php_sqli.md; https://vuldb.com/?ctiid.270010; https://vuldb.com/?id.270010
CVE: CVE-2024-20076
Published: 2024-07-01
Description: In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01297806; Issue ID: MSV-1481.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://corp.mediatek.com/product-security-bulletin/July-2024; https://corp.mediatek.com/product-security-bulletin/July-2024
CVE: CVE-2024-20077
Published: 2024-07-01
Description: In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01297807; Issue ID: MSV-1482.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://corp.mediatek.com/product-security-bulletin/July-2024; https://corp.mediatek.com/product-security-bulletin/July-2024
CVE: CVE-2024-20078
Published: 2024-07-01
Description: In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08737250; Issue ID: MSV-1452.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/July-2024; https://corp.mediatek.com/product-security-bulletin/July-2024
CVE: CVE-2024-20079
Published: 2024-07-01
Description: In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08044040; Issue ID: MSV-1491.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/July-2024; https://corp.mediatek.com/product-security-bulletin/July-2024
CVE: CVE-2024-20080
Published: 2024-07-01
Description: In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08720039; Issue ID: MSV-1424.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://corp.mediatek.com/product-security-bulletin/July-2024; https://corp.mediatek.com/product-security-bulletin/July-2024
CVE: CVE-2024-20081
Published: 2024-07-01
Description: In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08719602; Issue ID: MSV-1412.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/July-2024; https://corp.mediatek.com/product-security-bulletin/July-2024
CVE: CVE-2024-38480
Published: 2024-07-01
Description: "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-798
References: https://apps.apple.com/jp/app/%E3%83%94%E3%83%83%E3%82%B3%E3%83%9E/id[PII_REDACTED]; https://jvn.jp/en/jp/JVN01073312/; https://play.google.com/store/apps/details?id=jp.kakao.piccoma