deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0671
Published: 2019-01-09
Description: Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on the Windows system via unspecified vectors.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: http://www.mnc.co.jp/INplc/info_20180907_E.htm; https://jvn.jp/en/jp/JVN59624986/index.html; http://www.mnc.co.jp/INplc/info_20180907_E.htm
CVE: CVE-2018-0676
Published: 2019-01-09
Description: BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and execute an arbitrary command via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN65082538/index.html; https://p3.support.panasonic.com/faq/show/5017?&site_domain=p3; https://jvn.jp/en/jp/JVN65082538/index.html
CVE: CVE-2018-0677
Published: 2019-01-09
Description: BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN65082538/index.html; https://p3.support.panasonic.com/faq/show/5017?&site_domain=p3; https://jvn.jp/en/jp/JVN65082538/index.html
CVE: CVE-2018-0678
Published: 2019-01-09
Description: Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: https://jvn.jp/en/jp/JVN65082538/index.html; https://p3.support.panasonic.com/faq/show/5017?&site_domain=p3; https://jvn.jp/en/jp/JVN65082538/index.html
CVE: CVE-2018-0698
Published: 2019-01-09
Description: Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN96493183/index.html; https://weseek.co.jp/security/2018/12/25/growi-prevent-xss2/; https://jvn.jp/en/jp/JVN96493183/index.html
CVE: CVE-2018-0702
Published: 2019-01-09
Description: Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN83739174/index.html; https://kb.cybozu.support/article/34135/; https://jvn.jp/en/jp/JVN83739174/index.html
CVE: CVE-2018-0703
Published: 2019-01-09
Description: Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN15232217/index.html; https://kb.cybozu.support/article/34088/; https://jvn.jp/en/jp/JVN15232217/index.html
CVE: CVE-2018-0704
Published: 2019-01-09
Description: Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN15232217/index.html; https://kb.cybozu.support/article/34091/; https://jvn.jp/en/jp/JVN15232217/index.html
CVE: CVE-2018-0705
Published: 2019-01-09
Description: Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN16697622/index.html; https://kb.cybozu.support/article/34089/; https://jvn.jp/en/jp/JVN16697622/index.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1074; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1129; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm that results in the creation of an ephemeral user record in memory.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1128; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a user signed up for a new user account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1158; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission or access to the local file system to obtain credentials entered by users if the form submission could not be successfully processed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-10-10/#SECURITY-765; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1101; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1029; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-938; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.jelly, RebuildAction/ListSubversionTagsParameterValue.jelly, RebuildAction/MavenMetadataParameterValue.jelly, RebuildAction/NodeParameterValue.jelly, RebuildAction/PasswordParameterValue.jelly, RebuildAction/RandomStringParameterValue.jelly, RebuildAction/RunParameterValue.jelly, RebuildAction/StringParameterValue.jelly, RebuildAction/TextParameterValue.jelly, RebuildAction/ValidatingStringParameterValue.jelly that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-130; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1130; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1125; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%281%29; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%282%29; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1013%20%281%29; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1013%20%282%29; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1067; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1068; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-265; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1163; http://www.securityfocus.com/bid/106532
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-09
Description: A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106532; https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1122; http://www.securityfocus.com/bid/106532
CVE: CVE-2018-16164
Published: 2019-01-09
Description: Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN75738023/index.html; https://plugins.trac.wordpress.org/changeset/1961423/; https://wordpress.org/plugins/event-calendar-wd/#developers
CVE: CVE-2018-16165
Published: 2019-01-09
Description: Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1; https://jvn.jp/en/vu/JVNVU98026636/index.html; https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1
CVE: CVE-2018-16166
Published: 2019-01-09
Description: LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1; https://jvn.jp/en/vu/JVNVU98026636/index.html; https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1
CVE: CVE-2018-16167
Published: 2019-01-09
Description: LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1; https://jvn.jp/en/vu/JVNVU98026636/index.html; https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1
CVE: CVE-2018-16168
Published: 2019-01-09
Description: LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1; https://jvn.jp/en/vu/JVNVU98026636/index.html; https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1
CVE: CVE-2018-16169
Published: 2019-01-09
Description: Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://jvn.jp/en/jp/JVN23161885/index.html; https://kb.cybozu.support/article/34311/; https://jvn.jp/en/jp/JVN23161885/index.html
CVE: CVE-2018-16170
Published: 2019-01-09
Description: Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrary files via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN23161885/index.html; https://kb.cybozu.support/article/34301/; https://jvn.jp/en/jp/JVN23161885/index.html
CVE: CVE-2018-16171
Published: 2019-01-09
Description: Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN23161885/index.html; https://kb.cybozu.support/article/35259/; https://jvn.jp/en/jp/JVN23161885/index.html
CVE: CVE-2018-16172
Published: 2019-01-09
Description: Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 to 3.1.8, that allows remote attackers to trick a user to delete the registered client certificate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://jvn.jp/en/jp/JVN23161885/index.html; https://kb.cybozu.support/article/35260/; https://jvn.jp/en/jp/JVN23161885/index.html
CVE: CVE-2018-16173
Published: 2019-01-09
Description: Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN85760090/index.html; https://wordpress.org/plugins/learnpress/; https://jvn.jp/en/jp/JVN85760090/index.html
CVE: CVE-2018-16174
Published: 2019-01-09
Description: Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://jvn.jp/en/jp/JVN85760090/index.html; https://wordpress.org/plugins/learnpress/; https://jvn.jp/en/jp/JVN85760090/index.html
CVE: CVE-2018-16175
Published: 2019-01-09
Description: SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://jvn.jp/en/jp/JVN85760090/index.html; https://wordpress.org/plugins/learnpress/; https://jvn.jp/en/jp/JVN85760090/index.html
CVE: CVE-2018-16176
Published: 2019-01-09
Description: Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://emdb.jaea.go.jp/emdb/en/mappingtool.html; https://jvn.jp/en/jp/JVN33677949/index.html; https://emdb.jaea.go.jp/emdb/en/mappingtool.html
CVE: CVE-2018-16177
Published: 2019-01-09
Description: Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://f-security.jp/v6/support/information/100193.html; https://jvn.jp/en/jp/JVN15709478/index.html; https://f-security.jp/v6/support/information/100193.html
CVE: CVE-2018-16178
Published: 2019-01-09
Description: Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on function.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/en/jp/JVN25385698/index.html; https://kb.cybozu.support/article/35265; https://jvn.jp/en/jp/JVN25385698/index.html
CVE: CVE-2018-16179
Published: 2019-01-09
Description: The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://jvn.jp/en/vu/JVNVU91640357/index.html; https://play.google.com/store/apps/details?id=jp.co.mizuhobank.banking; https://jvn.jp/en/vu/JVNVU91640357/index.html
CVE: CVE-2018-16180
Published: 2019-01-09
Description: Cross-site scripting vulnerability in i-FILTER Ver.9.50R05 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://download.daj.co.jp/user/ifilter/V9/; https://jvn.jp/en/jp/JVN32155106/index.html; https://download.daj.co.jp/user/ifilter/V9/
CVE: CVE-2018-16181
Published: 2019-01-09
Description: HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks that may result in an arbitrary script injection or setting an arbitrary cookie values via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-113
References: https://download.daj.co.jp/user/ifilter/V9/; https://jvn.jp/en/jp/JVN32155106/index.html; https://download.daj.co.jp/user/ifilter/V9/
CVE: CVE-2018-16182
Published: 2019-01-09
Description: Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN78422300/index.html; https://marketspeed.jp/ms1/download/; https://jvn.jp/en/jp/JVN78422300/index.html
CVE: CVE-2018-16183
Published: 2019-01-09
Description: An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), Windows 8 (64bit), Windows 8.1 (64bit), Windows 10 (64bit) delivered in or later than October 2009 allow local users to gain privileges via a Trojan horse executable file and execute arbitrary code with eleveted privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://jvn.jp/en/jp/JVN36895151/index.html; https://pc-dl.panasonic.co.jp/dl/docs/077770; https://jvn.jp/en/jp/JVN36895151/index.html