JVNRSS Feed - JP
JVNRSS Feed - Update Entry
JVN
Multiple vulnerabilities in ShizenBox2
ShizenBox2 provided by Shizen Connect Inc. contains multiple vulnerabilities.
PALLET CONTROL products vulnerable to improper access control
PALLET CONTROL products provided by JAL Information Technology Co., Ltd. contains an improper access control vulnerability.
Multiple vulnerabilities in GROWI
GROWI provided by GROWI, Inc. contains multiple vulnerabilities.
Multiple vulnerabilities in SOY series
SOY series provided by Tsuyoshi Saito contain multiple vulnerabilities.
Zabbix agent may insecurely load Dynamic Link Libraries
Zabbix agent provided by Zabbix LLC may insecurely load Dynamic Link Libraries.
Installer for Rakuten Kobo Desktop Application (Windows version) may insecurely load Dynamic Link Libraries
The installer for Rakuten Kobo Desktop Application (Windows version) provided by Rakuten Kobo Inc. may insecurely load Dynamic Link Libraries.
Android App "Myna Point" vulnerable to improper access restriction
Android App "Myna Point" provided by Digital Agency contains an improper access restriction vulnerability.
Multiple vulnerabilities in CorvusSKK
CorvusSKK provided by SASAKI Nobuyuki contains multiple vulnerabilities.
Apache Struts 2 vulnerable to resource exhaustion
Apache Struts 2 provided by The Apache Software Foundation contains a resource exhaustion vulnerability.
Multiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
SKYSEA Client View and SKYMEC IT Manager provided by Sky Co., LTD. contains multiple vulnerabilities.
Sakura Editor vulnerable to OS command injection
Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability.
UNIVERGE IX-R/IX-V series routers vulnerable to missing authentication for critical function
UNIVERGE IX-R/IX-V series routers provided by NEC Corporation contain a missing authentication for critical function vulnerability.
Miraikan Assist App vulnerable to cross-site scripting
Miraikan Assist App provided by Japan Science and Technology Agency (JST) contains a cross-site scripting vulnerability.
Multiple vulnerabilities in acmailer
acmailer provided by Extra Innovation Inc. contains multiple vulnerabilities.
Apache Allura vulnerable to server-side request forgery
Apache Allura provided by The Apache Software Foundation contains a server-side request forgery vulnerability.
F-RevoCRM vulnerable to cross-site scripting
F-RevoCRM provided by Thinkingreed Inc. contains a cross-site scripting vulnerability.
miChecker improper restriction of XML external entity references
miChecker developed by Eclipse Foundation and provided by Ministry of Internal Affairs and Communications improperly restricts XML external entity references.
Improper file access permission settings in Synology Assistant
Synology Assistant provided by Synology Inc. is configured with an improper file access permission settings.
VoiceTra vulnerable to incorrectly specified destination in a communication channel
VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains a vulnerability due to incorrectly specified destination in a communication channel.
Installer for LINE for Windows insecurely loads Dynamic Link Libraries
The installer for LINE for Windows provided by LY Corporation insecurely loads Dynamic Link Libraries.
Multiple vulnerabilities in NetKids iMark
NetKids iMark provided by Integrated Systems Technologies, Inc. contains multiple vulnerabilities.
freo2 vulnerable to unrestricted upload of file with dangerous type
freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability.
Cybozu Garoon vulnerable to cross-site scripting
Cybozu Garoon provided by Cybozu, Inc contains a cross-site scripting vulnerability.
Permissive regular expression vulnerability in Tegalog -Fumy Otegaru Memo Logger-
Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression.
Multiple vulnerabilities in ELECOM wireless LAN routers and access points (July 2026)
Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities.
Ricoh printers and Multifunction Printers (MFPs) missing restriction on SSH port forwarding
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations.
Drupal plugin "AI Agents" vulnerable to incorrect authorization
AI Agents provided by Drupal contains an incorrect authorization vulnerability.
Vulnerability in certain IC chips of contactless IC card "FeliCa"
For certain FeliCa IC chips shipped by Sony Corporation in or before 2017, a certain operation during cryptographic processing may compromise the intended security strength.
Multiple vulnerabilities in TTSSH2 plugin of Tera Term
TTSSH2 plugin of Tera Term provided by TeraTerm Project contains multiple vulnerabilities.
Installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries
Installer of HYPER SBI 2 provided by SBI SECURITIES Co.,Ltd. insecurely loads Dynamic Link Libraries.
Multiple vulnerabilities in the installer for Pupsman
The installer for Pupsman provided by Fuji Electric Co.,Ltd. contains multiple vulnerabilities.
SEIKO EPSON printers and scanners Web Config vulnerable to cross-site request forgery
Web Config embedded in SEIKO EPSON multiple printers and scanners contains a cross-site request forgery vulnerability.
Seiko Solutions SkyBridge MB-A100/MB-A110 vulnerable to OS command injection
SkyBridge MB-A100/MB-A110 provided by Seiko Solutions Inc. contains an OS command injection vulnerability.
Reflected cross-site scripting vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor
Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability.
RPG MAKER MV and MZ vulnerable to OS command injection
RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability.
DGM3103SCT vulnerable to OS command injection
DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability.
Multiple vulnerabilities in Fluentd
Fluentd provided by Fluentd Project contains multiple vulnerabilities.
ExpressUpdate Agent for Windows improper access restriction on its named pipe
ExpressUpdate Agent for Windows provided by NEC Corporation configures its named pipe with an improper access restriction.
OS command injection in RadiX AX6600 WiFi 6 Tri-Band Gaming Router
RadiX AX6600 WiFi 6 Tri-Band Gaming Router provided by Micro-Star International Co., Ltd. contains an OS command injection vulnerability.
ThingsBoard vulnerable to prototype pollution
ThingsBoard contains a prototype pollution vulnerability.
Improper file access permission settings in the installers for Optical Disc Archive Software for Windows
Optical Disc Archive Software for Windows provided by Sony Corporation is configured with improper file access permission settings.
Privilege escalation vulnerability in multiple RICOH and KONICA MINOLTA JAPAN printer drivers
Multiple printer drivers provided by RICOH and KONICA MINOLTA JAPAN contain a privilege escalation vulnerability.
CamView installer insecurely loads Dynamic Link Libraries
CamView installer provided by ARUCOM Inc. insecurely loads Dynamic Link Libraries.
Multiple TP-Link products vulnerable to cleartext transmission of sensitive information
Multiple TP-Link products provided by TP-Link Systems Inc. contain Cleartext Transmission of Sensitive Information (CWE-319) vulnerability.
WordPress Plugin "Zoho Mail for WordPress" vulnerable to cross-site request forgery
WordPress plugin "Zoho Mail for WordPress" provided by Zoho Corporation contains a cross-site request forgery vulnerability.
Multiple vulnerabilities in ServerView Agents for Windows
ServerView Agents for Windows provided by Fsas Technologies Inc. contains multiple vulnerabilities.
Jupyter Server vulnerable to open redirect
Jupyter Server provided by Jupyter Development Team contains an open redirect vulnerability.
NEC Aterm series vulnerable to OS command injection (NV26-003)
NEC Aterm series products provided by NEC Corporation contain an OS command injection vulnerability.
NEC Aterm series vulnerable to cross-site scripting (NV26-002)
Aterm series products provided by NEC Corporation contain a cross-site scripting vulnerability.
Movable Type vulnerable to missing authorization
Movable Type provided by Six Apart Ltd. contains a missing authorization vulnerability.
Multiple vulnerabilities in "Musetheque V4 Information Disclosure for IPKNOWLEDGE"
Musetheque V4 Information Disclosure for IPKNOWLEDGE provided by Fujitsu Japan Limited contains multiple vulnerabilities.
WPS Office improper access restriction to its named pipe
WPS Office provided by WPS SOFTWARE PTE. LTD. fails to properly restrict access to its named pipe.
GUARDIANWALL MailSuite vulnerable to stack-based buffer overflow
GUARDIANWALL MailSuite provided by Canon Marketing Japan Inc. contains a stack-based buffer overflow vulnerability.
Android App "あんしんフィルター for au" vulnerable to cleartext transmission of sensitive information
Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability.
Bytello Share (Windows Edition) installer executable insecurely loads Dynamic Link Libraries
Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries.
Multiple vulnerabilities in ELECOM wireless LAN routers and access points (May 2026)
GROWI vulnerable to path traversal
GROWI provided by GROWI, Inc. contains a path traversal vulnerability.
"Kura Sushi Official App" vulnerable to improper certificate validation
"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation.
libXpm vulnerable to out-of-bounds read
libXpm provided by X.Org Foundation contains an out-of-bounds read vulnerability.
Lhaz and Lhaz+ vulnerable to path traversal
Lhaz and Lhaz+ provided by Chitora soft contain a path traversal vulnerability.
Open redirect vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor
Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain an open redirect vulnerability.
Apache ActiveMQ series improper validation of MQTT packets [AMQ-9810]
Apache ActiveMQ series provided by The Apache Software Foundation does not properly validate MQTT packets.
GROWI vulnerable to Regular expression Denial-of-Service (ReDoS)
GROWI provided by GROWI, Inc. contains a Regular expression Denial-of-Service (DoS) vulnerability.
Multiple vulnerabilities in LogonTracer
LogonTracer provided by Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) contains multiple vulnerabilities.
IP Setting Software may insecurely load Dynamic Link Libraries
IP Setting Software provided by i-PRO Co., Ltd. may insecurely load Dynamic Link Libraries.
CMS ALAYA vulnerable to SQL injection
CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability.
Ziostation2 vulnerable to path traversal
Ziostation2 provided by Ziosoft, Inc. contains a path traversal vulnerability.
Installers of LiveOn Meet Client for Windows and its plugin may insecurely load Dynamic Link Libraries
The installer of LiveOn Meet Client for Windows and the installer of Canon Network Camera Plugin provided by Japan Media Systems Corporation may insecurely load Dynamic Link Libraries.
DeepL Chrome browser extension vulnerable to cross-site scripting
DeepL Chrome browser extension contains a cross-site scripting vulnerability.
SKYSEA Client View and SKYMEC IT Manager improper file access permission settings
SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configures the installation folder with improper file access permission settings.
Multiple vulnerabilities in CubeCart
CubeCart provided by CubeCart Limited contains multiple vulnerabilities.
Arcserve UDP Console vulnerable to redirect to a dummy URL
Offline activation traffic of UDP Console provided by Arcserve may be redirected to a dummy URL.
GROWI vulnerable to stored cross-site scripting
GROWI provided by GROWI, Inc. contains a stored cross-site scripting vulnerability.
EmoCheck loads Dynamic Link Libraries insecurely
EmoCheck provided by Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) loads Dynamic Link Libraries insecurely.
Multiple vulnerabilities in Movable Type
Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities.
Multiple vulnerabilities in MATCHA series
MATCHA series provided by ICZ Corporation contains multiple vulnerabilities.
Multiple vulnerabilities in NEC Aterm series (NV26-001)
Aterm series products provided by NEC Corporation contain multiple vulnerabilities.
Multiple vulnerabilities in baserCMS
baserCMS provided by baserCMS User Community contains multiple vulnerabilities.
WordPress Plugin "OpenStreetMap" vulnerable to cross-site scripting
WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability.
Multiple vulnerabilities in BUFFALO Wi-Fi routers
Wi-Fi router products provided by BUFFALO INC. contain multiple vulnerabilities.
Multiple vulnerabilities in the installer of RATOC RAID Monitoring Manager for Windows
The installer of RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. contains multiple vulnerabilities.
Digital Photo Frame GH-WDF10A vulnerable to improper access restriction
Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an improper access restriction vulnerability.
SHARP routers missing authentication for some web APIs
SHARP routers allow access to some web APIs without authentication.
Installer of OM Workspace (Windows Edition) may insecurely load Dynamic Link Libraries
Installer of OM Workspace (Windows Edition) provided by OM Digital Solutions Corporation may insecurely load Dynamic Link Libraries.
SANYO DENKI SANUPS SOFTWARE registers Windows services with unquoted file paths
SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths.
Installer for IBM Trusteer Rapport may insecurely load Dynamic Link Libraries
The installer for IBM Trusteer Rapport provided by IBM may insecurely load Dynamic Link Libraries.
Missing authorization in the OpenAI thread/message API endpoints of GROWI
GROWI provided by GROWI, Inc. contains a missing authorization vulnerability in the OpenAI thread/message API endpoints.
OpenLiteSpeed and LSWS Enterprise vulnerable to OS command injection
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.
Improper file access permission settings in multiple Digital Arts products
Multiple products provided by Digital Arts Inc. are configured with improper file access permission settings.
Installer for Qsee Client may insecurely load Dynamic Link Libraries
The installer for Qsee Client provided by Qsee may insecurely load Dynamic Link Libraries.
django-allauth vulnerable to open redirect
django-allauth contains an open redirect vulnerability.
EC-CUBE vulnerable to multi-factor authentication bypass
EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability.
Multiple vulnerabilities in Dell UPS Multi-UPS Management Console (MUMC)
UPS Multi-UPS Management Console (MUMC) provided by Dell Inc. contains multiple vulnerabilities.
IM-LogicDesigner module of intra-mart Accel Platform vulnerable to untrusted data deserialization
IM-LogicDesigner module of intra-mart Accel Platform provided by NTT DATA INTRAMART Corporation contains an untrusted data deserialization vulnerability.
Improper file access permission settings in the installers for multiple Soliton Systems products
The installers for multiple products provided by Soliton Systems K.K. are configured with improper file access permission settings.
Multiple vulnerabilities in the installer of FinalCode Client
The installer of FinalCode Client provided by Digital Arts Inc. contains multiple vulnerabilities.
Lanscope Endpoint Manager (On-Premises) vulnerable to path traversal
Lanscope Endpoint Manager (On-Premises) provided by MOTEX Inc. contains a path traversal vulnerability.
Installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール may insecurely load Dynamic Link Libraries
The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール provided by Ricoh Company, Ltd. may insecurely load Dynamic Link Libraries.
WordPress Plugin "Survey Maker" vulnerable to cross-site scripting
WordPress Plugin "Survey Maker" provided by Ays Pro contains a cross-site scripting vulnerability.
Joomla! CMS vulnerable to cross-site scripting
Joomla! CMS provided by Joomla! Project contains a cross-site scripting vulnerability.
FileZen vulnerable to OS command injection
FileZen provided by Soliton Systems K.K. contains an OS command injection vulnerability.
Installer of M-Audio M-Track Duo HD may insecurely load Dynamic Link Libraries
The installer of M-Track Duo HD provided by M-Audio may insecurely load Dynamic Link Libraries.
Oki Electric Industry products and OEM products register Windows services with unquoted file paths
Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows services with unquoted file paths.
web2py vulnerable to open redirect
web2py contains an open redirect vulnerability.
Multiple vulnerabilities in ELECOM wireless LAN products
Wireless LAN products provided by ELECOM CO.,LTD. contain multiple vulnerabilities.
Improper file access permission settings in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows
Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows provided by Mitsubishi Electric Corporation is configured with an improper file access permission settings.
Installer for Roland Cloud Manager may insecurely load Dynamic Link Libraries
The installer for Roland Cloud Manager provided by Roland Corporation may insecurely load Dynamic Link Libraries.
Multiple vulnerabilities in Cybozu Garoon
Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities.
Multiple Microsoft Office products vulnerable to untrusted search path
Multiple Microsoft Office products contain an untrusted search path vulnerability.
Sonatype Nexus Repository vulnerable to server-side request forgery
Nexus Repository provided by Sonatype is vulnerable to server-side request forgery.
OS command injection in raspap-webgui
RaspAP raspap-webgui contains an OS command injection vulnerability.
Undocumented "TelnetEnable" functionality of End of Service NETGEAR products
Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.
beat-access for Windows may insecurely load Dynamic Link Libraries
beat-access for Windows provided by FUJIFILM Business Innovation Corp. may insecurely load Dynamic Link Libraries.
Command injection vulnerability in ASUS routers
A command injection vulnerability exists in ASUS routers.
Installer of Fujitsu ServerView Agents for Windows may insecurely load Dynamic Link Libraries
The installer of ServerView Agents for Windows provided by Fsas Technologies Inc. may insecurely load Dynamic Link Libraries.
Ruijie Networks AP180 series vulnerable to OS command injection
AP180 series provided by Ruijie Networks Co., Ltd. contains an OS command injection vulnerability.
Multiple Vulnerabilities in TOA Network Cameras TRIFORA 3 series
Network Cameras TRIFORA 3 series provided by TOA Corporation contain multiple vulnerabilities.
Chainlit vulnerable to improper access restriction
Chainlit provided by Chainlit contains an improper access restriction vulnerability.
Multiple vulnerabilities in EATON UPS Companion
EATON UPS Companion provided by Eaton contains multiple vulnerabilities.
RICOH Streamline NX vulnerable to improper authorization
RICOH Streamline NX provided by Ricoh Company, Ltd. contains an improper authorization vulnerability.
The installers for multiple PIONEER products may insecurely load Dynamic Link Libraries
The installers for multiple products provided by PIONEER CORPORATION may insecurely load Dynamic Link Libraries.
Multiple vulnerabilities in multiple NEC branded projectors manufactured by Sharp Display Solutions, Ltd.
Multiple NEC branded projectors manufactured by Sharp Display Solutions, Ltd. contain multiple vulnerabilities.
Origin validation error vulnerability in Fujitsu Security Solution AuthConductor Client Basic V2
Fujitsu Security Solution AuthConductor Client Basic V2 provided by Fujitsu Client Computing Limited contains an origin validation error vulnerability.
GROWI vulnerable to cross-site request forgery
GROWI provided by GROWI, Inc. contains a cross-site request forgery vulnerability.
SEIKO EPSON printer Web Config vulnerable to stack-based buffer overflow
SEIKO EPSON printer Web Config contains a stack-based buffer overflow vulnerability.
QND vulnerable to privilege escalation
QND provided by QualitySoft Corporation is vulnerable to privilege escalation.
ELECOM Clone for Windows registers a Windows service with an unquoted file path
Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path.
Multiple vulnerabilities in GroupSession
GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities.
GS Yuasa FULLBACK Manager Pro registers Windows services with unquoted file paths
FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths.
Multiple vulnerabilities in ABB Terra AC Wallbox
Terra AC Wallbox provided by ABB contains multiple vulnerabilities.
Installer of INZONE Hub may insecurely load Dynamic Link Libraries
The installer of INZONE Hub provided by Sony Corporation may insecurely load Dynamic Link Libraries.
SwitchBot Smart Video Doorbell vulnerable to active debug code
Smart Video Doorbell provided by SwitchBot is vulnerable to active debug code.
Multiple vulnerabilities in Security Point (Windows) of MaLion
Security Point (Windows) of MaLion provided by Intercom, Inc. contains multiple vulnerabilities.
Multiple vulnerabilities in SNC-CX600W
SNC-CX600W provided by Sony Corporation contains multiple vulnerabilities.
"FOD" App uses hard-coded cryptographic keys
"FOD" App provided by Fuji Television Network, Inc. uses hard-coded cryptographic keys.
Multiple vulnerabilities in LogStare Collector
LogStare Collector provided by LogStare Inc. contains multiple vulnerabilities.
Installer of RakurakuMusen Start EX for Windows may insecurely load Dynamic Link Libraries
Installer of RakurakuMusen Start EX for Windows provided by NEC Corporation may insecurely load Dynamic Link Libraries.
"デジラアプリ" App for iOS vulnerable to improper server certificate verification
"デジラアプリ" App for iOS provided by KDDI CORPORATION is vulnerable to improper server certificate verification.
NCP-HG100 vulnerable to OS command injection
NCP-HG100 provided by Sony Network Communications Inc. and used in MANOMA service contains an OS command injection vulnerability.
Multiple vulnerabilities in GNU Libmicrohttpd
GNU Libmicrohttpd provided by GNU Project contains multiple vulnerabilities.
Use of password hash with insufficient computational effort vulnerability in BUFFALO Wi-Fi router "WSR-1800AX4 series"
Wi-Fi router "WSR-1800AX4 series" provided by BUFFALO INC. contains a use of password hash with insufficient computational effort vulnerability.
CLUSTERPRO X and EXPRESSCLUSTER X vulnerable to OS command injection
CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain an OS command injection vulnerability.
Multiple Roboticsware products register Windows services with unquoted file paths
Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths.
Optical Disc Archive Software (for Windows) registers a Windows service with an unquoted file path
Optical Disc Archive Software (for Windows) provided by Sony Corporation registers a Windows service with an unquoted file path.
Progress Flowmon vulnerable to authenticated OS command injection
Progress Flowmon provided by Progress Software Corporation contains an authenticated OS command injection vulnerability.
Installer of WTW EAGLE (for Windows) may insecurely load Dynamic Link Libraries
The installer of WTW EAGLE (for Windows) provided by Wireless Tsukamoto Co., Ltd. may insecurely load Dynamic Link Libraries.
MZK-DP300N uses hard-coded credentials
MZK-DP300N provided by PLANEX COMMUNICATIONS INC. uses hard-coded credentials.
Multiple stored cross-site scripting vulnerabilities in Pleasanter
Pleasanter provided by Implem Inc. contains multiple stored cross-site scripting vulnerabilities.
GROWI vulnerable to cross-site scripting
GROWI provided by GROWI, Inc. contains a cross-site scripting vulnerability.
Multiple I-O DATA NAS management applications register Windows services with unquoted file paths
Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths.
Multiple stored cross-site scripting vulnerabilities in Movable Type
Movable Type provided by Six Apart Ltd. contains multiple stored cross-site scripting vulnerabilities.
Lanscope Endpoint Manager (On-Premises) vulnerable to improper verification of source of a communication channel
Lanscope Endpoint Manager (On-Premises) provided by MOTEX Inc. contains a vulnreability that leads to arbitrary code execution due to improper verification of source of a communication channel (CWE-940).
ETERNUS SF vulnerable to incorrect default permissions
ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability.
Installer of AutoDownloader may insecurely load Dynamic Link Libraries
Installer of AutoDownloader provided by Panasonic Connect Co., Ltd. may insecurely load Dynamic Link Libraries.
Multiple vulnerabilities in ChatLuck
ChatLuck provided by NEOJAPAN Inc. contains multiple vulnerabilities.
Multiple vulnerabilities in desknet's NEO
desknet's NEO provided by NEOJAPAN Inc. contains multiple vulnerabilities.
Ruijie Networks RG-EST300 undocumented SSH functionality
RG-EST300 provided by Ruijie Networks provides undocumented SSH server functionality, which is enabled in the initial configuration.
Phoenix Contact CHARX SEC-3xxx vulnerable to code injection
CHARX SEC-3xxx provided by Phoenix Contact contains a code injection vulnerability.
Multiple RSUPPORT products may insecurely load Dynamic Link Libraries
Multiple RSUPPORT products may insecurely load Dynamic Link Libraries.
BUFFALO NAS Navigator2 registers a Windows service with an unquoted file path
NAS Navigator2 provided by BUFFALO INC. registers a Windows service with an unquoted file path.
The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries
The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries.
DataSpider Servista improper restriction of XML external entity references
DataSpider Servista provided by Saison Technology Co.,Ltd. improperly restricts XML external entity references.
UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation vulnerable to cross-site scripting
UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contains a cross-site scripting vulnerability.
Century HW RAID Manager registers a Windows service with an unquoted file path
RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path.
WTW-EAGLE App vulnerable to improper server certificate validation
WTW-EAGLE App provided by Wireless Tsukamoto Co., Ltd. is vulnerable to improper server certificate validation.
RICOH Streamline NX vulnerable to tampering with operation history
RICOH Streamline NX provided by Ricoh Company, Ltd. contains a vulnerability that may lead to tampering with operation history
RATOC RAID Monitoring Manager for Windows registers a Windows service with an unquoted file path
RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path.
Obsidian GitHub Copilot Plugin stores sensitive information in cleartext
Obsidian GitHub Copilot Plugin provided by Pierre-Adrien Vasseur stores sensitive information in cleartext.
"Yahoo! Shopping" App for Android fails to restrict custom URL schemes properly
"Yahoo! Shopping" App for Android provided by LY Corporation fails to restrict custom URL schemes properly.
Multiple vulnerabilities in TkEasyGUI
TkEasyGUI provided by kujirahand contains multiple vulnerabilities.
Web Caster V130 vulnerable to cross-site request forgery
Web Caster V130 provided by NTT EAST, Inc. and NTT WEST, Inc. contains a cross-site request forgery vulnerability.
"Gunosy" App vulnerable to insertion of sensitive information into sent data (CWE-201)
"Gunosy" App provided by Gunosy Inc. contains a vulnerability where sensitive information may be included in the application's outbound communication.