rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-20235 ProSoft Technology ICX35-HWC Authentication Bypass
ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthenticated attackers to gain access to administrative functions without valid credentials. Attackers can bypass the authentication mechanism in affected firmware versions to obtain full administrative access to device configuration and settings.
Problem types: cwe_id: CWE-287
description: Improper Authentication (CWE-287)
Affected products: vendor: ProSoft Technology
product: ICX35-HWC Cellular Gateway
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
version: 3.1
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2026-04-03T22:51:42.963Z
CVE-2017-20236 ProSoft Technology ICX35-HWC Command Injection via Web Interface
ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote attackers to inject and execute system commands by submitting malicious input through unvalidated fields. Attackers can exploit this vulnerability to gain root privileges and execute arbitrary commands on the device through the accessible web interface.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected products: vendor: ProSoft Technology
product: ICX35-HWC Cellular Gateway
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-04-03T22:54:00.846Z
CVE-2017-20237 Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution
Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.
Problem types: cwe_id: CWE-287
description: Improper Authentication (CWE-287)
Affected products: vendor: Belden
product: Hirschmann Industrial HiVision
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-04-03T21:05:49.713Z
CVE-2017-20238 Hirschmann Industrial HiVision Improper Authorization Privilege Escalation
Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Belden
product: Hirschmann Industrial HiVision
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: NONE
version: 3.1
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Published: 2026-04-03T22:10:18.157Z
CVE-2017-20239 MDwiki Cross-Site Scripting via Location Hash Parameter
MDwiki contains a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the location hash parameter. Attackers can craft URLs with JavaScript payloads in the hash fragment that are parsed and rendered without sanitization, causing the injected scripts to execute in the victim's browser context.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Dynalon
product: MDwiki
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-04-12T12:28:42.926Z
CVE-2017-2090 
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors.
Problem types: description: SQL Injection
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2091 
Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2092 
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2093 
Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors.
Problem types: description: Information Disclosure
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2094 
Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2095 
Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in the mail function leading to an alteration of the order of mail folders via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2096 
smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: Ruby Programming Shounendan
product: smalruby-editor
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2097 
Cross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: support-project.org
product: Knowledge
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2098 
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: CubeCart Limited
product: CubeCart
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2099 
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote code execution via unspecified vectors.
Problem types: description: Remote code execution
Affected products: vendor: INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA)
product: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2100 
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduct DNS rebinding attacks via unspecified vectors.
Problem types: description: DNS rebinding
Affected products: vendor: INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA)
product: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2101 
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors.
Problem types: description: Authentication bypass
Affected products: vendor: INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA)
product: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2102 
Cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA)
product: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2103 
The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: Fails to verify SSL certificates
Affected products: vendor: K-Opticom Corporation
product: LaLa Call App for Android
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2104 
The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: Fails to verify SSL certificates
Affected products: vendor: K-Opticom Corporation
product: Business LaLa Call App for Android
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2105 
The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: Fails to verify SSL certificates
Affected products: vendor: PRESENTCAST INC.
product: TVer App for Android
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2106 
Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Webmin
product: Webmin
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2107 
Untrusted search path vulnerability in Self-extracting archive files created by 7-ZIP32.DLL 9.22.00.01 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Akky
product: Self-extracting archive files created by 7-ZIP32.DLL
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2108 
Untrusted search path vulnerability in PrimeDrive Desktop Application 1.4.3 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: SoftBank Corp.
product: PrimeDrive Desktop Application
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2109 
Cybozu KUNAI for Android 3.0.4 to 3.0.5.1 allow remote attackers to obtain log information through a malicious Android application.
Problem types: description: Information Disclosure
Affected products: vendor: Cybozu, Inc.
product: Cybozu KUNAI for Android
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2110 
The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: Fails to verify SSL certificates
Affected products: vendor: NISSAN SECURITIES CO., LTD.
product: Access CX App for Android
vendor: NISSAN SECURITIES CO., LTD.
product: Access CX App for iOS
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2111 
HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware version 1.18 and earlier may allow a remote attackers to display false information.
Problem types: description: HTTP header injection
Affected products: vendor: I-O DATA DEVICE, INC.
product: TS-WPTCAM
vendor: I-O DATA DEVICE, INC.
product: TS-WPTCAM2
vendor: I-O DATA DEVICE, INC.
product: TS-WLCE
vendor: I-O DATA DEVICE, INC.
product: TS-WLC2
vendor: I-O DATA DEVICE, INC.
product: TS-WRLC
vendor: I-O DATA DEVICE, INC.
product: TS-PTCAM/POE
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2112 
TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware version 1.18 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: I-O DATA DEVICE, INC.
product: TS-WPTCAM
vendor: I-O DATA DEVICE, INC.
product: TS-WPTCAM2
vendor: I-O DATA DEVICE, INC.
product: TS-WLCE
vendor: I-O DATA DEVICE, INC.
product: TS-WLC2
vendor: I-O DATA DEVICE, INC.
product: TS-WRLC
vendor: I-O DATA DEVICE, INC.
product: TS-PTCAM/POE
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2113 
Buffer overflow in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware version 1.18 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: I-O DATA DEVICE, INC.
product: TS-WPTCAM
vendor: I-O DATA DEVICE, INC.
product: TS-WPTCAM2
vendor: I-O DATA DEVICE, INC.
product: TS-WLCE
vendor: I-O DATA DEVICE, INC.
product: TS-WLC2
vendor: I-O DATA DEVICE, INC.
product: TS-WRLC
vendor: I-O DATA DEVICE, INC.
product: TS-PTCAM/POE
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2114 
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Office
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2115 
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Office
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2116 
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Office
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2117 
Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: CubeCart Limited
product: CubeCart
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2118 
Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WBCE Team
product: WBCE CMS
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2119 
Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: WBCE Team
product: WBCE CMS
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2120 
SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: SQL Injection
Affected products: vendor: WBCE Team
product: WBCE CMS
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2122 
Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Tenable Network Security, Inc.
product: Nessus
Published: 2017-05-12T18:00:00.000Z
CVE-2017-2123 
Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via language.php.
Problem types: description: Cross-site scripting
Affected products: vendor: SpiQe Software
product: OneThird CMS
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2124 
Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via contact.php.
Problem types: description: Cross-site scripting
Affected products: vendor: SpiQe Software
product: OneThird CMS
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2125 
Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the guest account.
Problem types: description: Privilege escalation
Affected products: vendor: Allied Telesis K.K.
product: CentreCOM
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2126 
WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and access the configuration interface via unspecified vectors.
Problem types: description: Authentication bypass
Affected products: vendor: BUFFALO INC.
product: WAPM-1166D
vendor: BUFFALO INC.
product: WAPM-APG600H
Published: 2017-07-22T00:00:00.000Z
CVE-2017-2127 
Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: YOP
product: YOP Poll
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2128 
Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data.
Problem types: description: OS Command Injection
Affected products: vendor: INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA)
product: Security guide for website operators
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2130 
Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: SecureBrain Corporation
product: The installer of PhishWall Client Internet Explorer version
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2131 
Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to bypass access restrictions to view the configuration menu via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-20T11:00:00.000Z
CVE-2017-2132 
Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to delete arbitrary files in a specific directory via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-20T11:00:00.000Z
CVE-2017-2133 
SQL injection vulnerability in Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-20T11:00:00.000Z
CVE-2017-2134 
Cross-site scripting vulnerability in ASSETBASE 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: UCHIDA YOKO CO., LTD.
product: ASSETBASE
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2135 
Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: WP Statistics
product: WP Statistics
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2136 
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
Problem types: description: Cross-site scripting
Affected products: vendor: WP Statistics
product: WP Statistics
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2137 
ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the switch via SOAP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2138 
Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: Frogman Office Inc.
product: CS-Cart Japanese Edition
vendor: Frogman Office Inc.
product: CS-Cart Multivendor Japanese Edition
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2139 
CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to bypass access restriction to obtain customer information via orders.pre.php.
Problem types: description: Fails to restrict access
Affected products: vendor: Frogman Office Inc.
product: CS-Cart Japanese Edition
vendor: Frogman Office Inc.
product: CS-Cart Multivendor Japanese Edition
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2140 
Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory.
Problem types: description: Script injection
Affected products: vendor: Gaku
product: Tablacus Explorer
Published: 2017-04-28T16:00:00.000Z
CVE-2017-2141 
WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: I-O DATA DEVICE, INC.
product: WN-G300R3
Published: 2017-04-28T16:00:00.000Z