Shiga Takuma

Improper authorization in the handler for a custom URL scheme in the Yahoo! Shopping App for Android may allow a remote, unauthenticated attacker to redirect a user to an arbitrary website. This could result in a phishing attack.

The issue concerns improper authorization in the handler for the custom URL scheme, allowing an arbitrary site to be displayed on the WebView of the product via Intent from another application installed on the user's device. This could result in the user being redirected to an unauthorized site, potentially leading to a phishing attack.

The issue is related to a cross-site scripting vulnerability. If exploited, an arbitrary script may be executed on the WebView of the Yahoo! JAPAN App via another app installed on the user's device.

The issue exists due to the improper export of Android application components, allowing another app installed on the user's device to access an arbitrary URL on the ABEMA App for Android via Intent. If exploited, an arbitrary website may be displayed on the app, potentially leading to phishing attacks.

The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access an arbitrary website via the vulnerable App, potentially resulting in a phishing attack.

The issue is related to improper handling of structural elements, which can lead to a denial-of-service (DoS) condition if exploited by an attacker.

A stored cross-site scripting issue exists in the event handlers of the `pre` tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

The issue is related to a Code Injection vulnerability in the mail form of baserCMS, a website development framework. This vulnerability allows malicious code to be executed in the Mail Form Feature.

The issue is related to a cross-site scripting vulnerability in the file upload feature of baserCMS. This vulnerability may allow malicious code to be executed. The management system is affected when used by an unspecified number of users.

The issue concerns a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. This vulnerability could allow a logged-in user to obtain information on the server. The estimated number of potentially affected devices is not specified, and there is no information about real-world incidents where this issue was exploited.

The issue is related to a cross-site request forgery vulnerability in the content preview feature of baserCMS. This vulnerability may allow malicious code to be executed. The vulnerability is particularly relevant when the management system is used by multiple users.

The issue allows a remote unauthenticated attacker to redirect a user to an arbitrary web site, potentially conducting a phishing attack by having the user access a specially crafted URL.

A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script.

The issue is related to improper validation of syntactic correctness of input, which can be exploited by a remote unauthenticated attacker. By having a user access a specially crafted URL, an attacker may set a specially crafted URL to the Reset Password page, allowing them to conduct a phishing attack.

The issue allows a remote unauthenticated attacker to redirect users to an arbitrary web site, potentially conducting a phishing attack.

A stored cross-site scripting issue allows a remote authenticated attacker with administrative privileges to inject an arbitrary script.