Taiga Shirakura

A reflected cross-site scripting issue allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product. This enables the attacker to perform actions on the user's behalf.

A stored cross-site scripting issue allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product. This can lead to unauthorized actions being taken on behalf of the user.

The issue is related to incorrect restriction of visualized layers in the user interface, which can be exploited by a remote attacker to conduct spoofing attacks. When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing.