Gaku Mochizuki

The issue allows an attacker to bypass authentication and obtain a user's authentication information through a malicious application created by a third party.

The issue is related to a directory traversal vulnerability in the cordova-plugin-ionic-webview, which allows remote attackers to access arbitrary files via unspecified vectors. This vulnerability is due to insufficient restrictions on directory path names, enabling a remote attacker to access local files that should be inaccessible to third-party applications. The package launches a web server listening on http://localhost:8080 without restricting access, thus escaping the iOS application sandbox and accessing local files.

A cross-site scripting issue allows remote authenticated attackers to inject arbitrary web script or HTML.

The issue allows remote authenticated attackers to execute arbitrary OS commands.

The issue allows remote attackers to bypass access restrictions in the mail form, enabling them to view files uploaded by site users.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue allows remote authenticated attackers to bypass access restrictions, enabling them to view or alter restricted content.

The issue allows remote attackers to bypass access restrictions for content, enabling them to view files uploaded by site users. The attack vector is not specified.

The issue allows remote attackers with site operator privilege to upload arbitrary files.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that perform administrative functions. This can lead to unauthorized access and control of the devices.

The issue arises from the application's mishandling of implicit intents, allowing attackers to craft an application that can obtain sensitive information.

The issue arises from the application's improper handling of implicit intents, allowing attackers to craft an application that can obtain sensitive owner-name information.

The issue allows remote attackers to execute arbitrary Java methods and obtain sensitive information or execute arbitrary commands via a crafted web site. This is due to a regression of a previously fixed issue.

The issue in the Cybozu Live application allows attackers to execute arbitrary JavaScript code and obtain sensitive information. This is achieved by a crafted application placing malicious code into a local file associated with a file: URL.

The issue arises from the improper implementation of the WebView class in the Angel Browser application, allowing attackers to obtain sensitive information via a crafted application.

The issue is related to the improper implementation of the WebView class in the Galapagos Browser application for Android, allowing attackers to obtain sensitive information via a crafted application.

The issue allows attackers to obtain sensitive information by accessing the local filesystem due to weak permissions for unspecified files.

The issue allows attackers to obtain sensitive information via an application that accesses the local filesystem, due to weak permissions for unspecified files.

The issue allows attackers to obtain sensitive information via an application that accesses the local filesystem, due to weak permissions for unspecified files.