rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-0627 
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: WG1200HP
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0628 
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: WG1200HP
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0629 
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: Aterm W300P
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0630 
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: Aterm W300P
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0631 
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: Aterm W300P
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0632 
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response.
Problem types: description: Buffer Overflow
Affected products: vendor: NEC Corporation
product: Aterm W300P
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0633 
Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter.
Problem types: description: Buffer Overflow
Affected products: vendor: NEC Corporation
product: Aterm W300P
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0634 
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0635 
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0636 
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0637 
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0638 
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0639 
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time parameter, and offset parameter.
Problem types: description: OS Command Injection
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0640 
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter.
Problem types: description: Buffer Overflow
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0641 
Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, time parameter, and offset parameter.
Problem types: description: Buffer Overflow
Affected products: vendor: NEC Corporation
product: HC100RC
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0642 
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Foliovision
product: FV Flowplayer Video Player
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0643 
Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: ORCA Management Organization Co., Ltd.
product: Ubuntu14.04 ORCA(Online Receipt Computer Advantage)4.8.0(panda-server) 1:1.4.9+p41-u4jma1 and earlier
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0644 
Buffer overflow in Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 5.0.0 (panda-client2) 1:2.0.0+p48-u4jma1 and earlier, and Ubuntu16.04 ORCA (Online Receipt Computer Advantage) 5.0.0 (panda-client2) 1:2.0.0+p48-u5jma1 and earlier allows authenticated attackers to cause denial-of-service (DoS) condition via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: ORCA Management Organization Co., Ltd.
product: Ubuntu14.04 ORCA(Online Receipt Computer Advantage)4.8.0(panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORCA(Online Receipt Computer Advantage)5.0.0(panda-client2) 1:2.0.0+p48-u4jma1 and earlier, and Ubuntu16.04 ORCA(Online Receipt Computer Advantage)5.0.0(panda-client2) 1:2.0.0+p48-u5jma1 and earlier
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0645 
MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors.
Problem types: description: Remote code execution
Affected products: vendor: bit part LLC
product: MTAppjQuery
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0646 
Directory traversal vulnerability in Explzh v.7.58 and earlier allows an attacker to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: pon software
product: Explzh
Published: 2018-09-04T13:00:00.000Z
CVE-2018-0647 
Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: ASUS Japan Inc.
product: WL-330NUL
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0648 
Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: ChatWork Co,. LTD.
product: Installer of ChatWork Desktop App for Windows
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0649 
Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Canon IT Solutions Inc.
product: The installers of multiple Canon IT Solutions Inc. software programs
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0650 
The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: Fails to verify SSL certificates
Affected products: vendor: LINE MUSIC CORPORATION
product: LINE MUSIC for Android
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0651 
Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN/FCJ Simulator R4.20 and earlier, ASTPLANNER R15.01 and earlier, TriFellows V5.04 and earlier) allows remote attackers to stop the license management function or execute an arbitrary program via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: Yokogawa Electric Corporation
product: The license management function of YOKOGAWA products
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0652 
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0653 
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0654 
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0655 
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page.
Problem types: description: Cross-site scripting
Affected products: vendor: WESEEK, Inc.
product: GROWI
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0656 
Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Sony Corporation
product: The installer of Digital Paper App
Published: 2018-09-04T13:00:00.000Z
CVE-2018-0657 
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: GMO Payment Gateway, Inc.
product: EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0658 
Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier allows an attacker with administrative rights to execute arbitrary PHP code on the server via unspecified vectors.
Problem types: description: Improper Input Validation
Affected products: vendor: GMO Payment Gateway, Inc.
product: EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0659 
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing files via specially crafted ATC file.
Problem types: description: Directory traversal
Affected products: vendor: HiBARA Software
product: AttacheCase
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0660 
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file.
Problem types: description: Directory traversal
Affected products: vendor: HiBARA Software
product: AttacheCase
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0661 
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to bypass access restriction to add files on a specific directory that may result in executing arbitrary OS commands/code or information including credentials leakage or alteration.
Problem types: description: Fails to restrict access
Affected products: vendor: I-O DATA DEVICE, INC.
product: Multiple I-O DATA network camera products
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0662 
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to add malicious files on the device and execute arbitrary code.
Problem types: description: Insufficient Verification of Data Authenticity
Affected products: vendor: I-O DATA DEVICE, INC.
product: Multiple I-O DATA network camera products
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0663 
Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated attacker to execute arbitrary OS commands on the device via unspecified vector.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: I-O DATA DEVICE, INC.
product: Multiple I-O DATA network camera products
Published: 2018-09-07T14:00:00.000Z
CVE-2018-0664 
A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors.
Problem types: description: External Control of Critical State Data
Affected products: vendor: NoMachine S.a r.l.
product: NoMachine App for Android
Published: 2018-09-04T13:00:00.000Z
CVE-2018-0665 
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0666.
Problem types: description: Script Injection
Affected products: vendor: Yamaha Corporation
product: Yamaha Broadband VoIP Router RT57i
vendor: Yamaha Corporation
product: Yamaha Broadband VoIP Router RT58i
vendor: Yamaha Corporation
product: Yamaha Broadband VoIP Router NVR500
vendor: Yamaha Corporation
product: Yamaha Gigabit VPN Router RTX810
vendor: Yamaha Corporation
product: Yamaha Firewall FWX120
vendor: NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION
product: Biz Box Router N58i, N500, NVR500, and RTX810
vendor: NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
product: Biz Box Router N58i, and N500
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0666 
Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an administrative user to embed arbitrary scripts to the configuration data through a certain form field of the configuration page, which may be executed on another administrative user's web browser. This is a different vulnerability from CVE-2018-0665.
Problem types: description: Script Injection
Affected products: vendor: Yamaha Corporation
product: Yamaha Broadband VoIP Router RT57i
vendor: Yamaha Corporation
product: Yamaha Broadband VoIP Router RT58i
vendor: Yamaha Corporation
product: Yamaha Broadband VoIP Router NVR500
vendor: Yamaha Corporation
product: Yamaha Gigabit VPN Router RTX810
vendor: Yamaha Corporation
product: Yamaha Firewall FWX120
vendor: NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION
product: Biz Box Router N58i, N500, NVR500, and RTX810
vendor: NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
product: Biz Box Router N58i, and N500
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0667 
Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: MICRONET CORPORATION
product: Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0668 
Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executing arbtrary code via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: MICRONET CORPORATION
product: INplc-RT
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0669 
INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0670.
Problem types: description: Authentication bypass
Affected products: vendor: MICRONET CORPORATION
product: INplc-RT
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0670 
INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0669.
Problem types: description: Authentication bypass
Affected products: vendor: MICRONET CORPORATION
product: INplc-RT
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0671 
Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on the Windows system via unspecified vectors.
Problem types: description: Privilege escalation
Affected products: vendor: MICRONET CORPORATION
product: INplc-RT
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0672 
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart, Ltd.
product: Movable Type
Published: 2018-09-04T13:00:00.000Z
CVE-2018-0673 
Directory traversal vulnerability in Cybozu Garoon 3.5.0 to 4.6.3 allows authenticated attackers to read arbitrary files via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2018-11-15T15:00:00.000Z
CVE-2018-0674 
AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.
Problem types: description: Remote code execution
Affected products: vendor: HiBARA Software
product: AttacheCase
Published: 2018-09-04T13:00:00.000Z
CVE-2018-0675 
AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.
Problem types: description: Remote code execution
Affected products: vendor: HiBARA Software
product: AttacheCase
Published: 2018-09-04T13:00:00.000Z
CVE-2018-0676 
BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and execute an arbitrary command via unspecified vectors.
Problem types: description: Authentication bypass
Affected products: vendor: Panasonic Corporation
product: BN-SDWBP3
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0677 
BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: Panasonic Corporation
product: BN-SDWBP3
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0678 
Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: Panasonic Corporation
product: BN-SDWBP3
Published: 2019-01-09T22:00:00.000Z
CVE-2018-0679 
Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions) allows attacker with administrator rights to inject arbitrary web script or HTML via the administrative page.
Problem types: description: Cross-site scripting
Affected products: vendor: FXC Inc.
product: multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Power over Ethernet (PoE) switch FXC5210PE/5218PE/5224PE firmware prior to version Ver1.00.14, and Wireless LAN router AE1021/AE1021PE firmware all versions)
Published: 2018-11-15T15:00:00.000Z
CVE-2018-0680 
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to read/send mail or change the configuration.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: NEOJAPAN Inc.
product: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
Published: 2018-11-15T15:00:00.000Z
CVE-2018-0681 
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: NEOJAPAN Inc.
product: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
Published: 2018-11-15T15:00:00.000Z
CVE-2018-0682 
Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors.
Problem types: description: Fails to manage sessions
Affected products: vendor: NEOJAPAN Inc.
product: Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier)
Published: 2018-11-15T15:00:00.000Z