Toyama Taku

Name of the Vulnerable Software and Affected Versions: WRC-1167GHBK2-S (affected versions not specified) Description: The issue is a stored cross-site scripting vulnerability in the WebGUI of the product. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the WebGUI. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ELECOM wireless LAN routers (affected versions not specified) **Description** The issue allows for the unrestricted upload of files with dangerous types in ELECOM wireless LAN routers. A specially crafted file can be uploaded by a logged-in user with administrative privileges, resulting in the execution of arbitrary OS commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) versions 14.0.001.002 and earlier **Description** The issue is related to the improper restriction of XML external entity references (XXE) in the Electronic Delivery Check System. This allows an attacker to read arbitrary files on the system by processing a specially crafted XML file. **Recommendations** For versions 14.0.001.002 and earlier, consider disabling the XML processing functionality until a patch is available to prevent exploitation of the XXE issue. Restrict access to sensitive files and directories to minimize the risk of arbitrary file reading.

**Name of the Vulnerable Software and Affected Versions** Electronic Deliverables Creation Support Tool (Construction Edition) versions prior to 1.0.4 Electronic Deliverables Creation Support Tool (Design & Survey Edition) versions prior to 1.0.4 **Description** The issue is related to the improper restriction of XML external entity references (XXE) in the affected software. By processing a specially crafted XML file, an attacker may be able to read arbitrary files on the system. **Recommendations** For Electronic Deliverables Creation Support Tool (Construction Edition) versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. For Electronic Deliverables Creation Support Tool (Design & Survey Edition) versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting the processing of XML files from untrusted sources until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Electronic Delivery Check System (Doboku) versions 18.1.0 and earlier Electronic Delivery Check System (Dentsu) versions 12.1.0 and earlier Electronic Delivery Check System (Kikai) versions 10.1.0 and earlier Electronic delivery item Inspection Support System versions 4.0.31 and earlier **Description** The affected systems improperly restrict XML external entity references (XXE). By processing a specially crafted XML file, an attacker may be able to read arbitrary files on the system. **Recommendations** For Electronic Delivery Check System (Doboku) versions 18.1.0 and earlier, consider disabling XML external entity references until a patch is available. For Electronic Delivery Check System (Dentsu) versions 12.1.0 and earlier, consider disabling XML external entity references until a patch is available. For Electronic Delivery Check System (Kikai) versions 10.1.0 and earlier, consider disabling XML external entity references until a patch is available. For Electronic delivery item Inspection Support System versions 4.0.31 and earlier, consider disabling XML external entity references until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** e-Tax software versions 3.0.10 and earlier **Description** The issue is related to the improper restriction of XML external entity references (XXE) in the e-Tax software due to the configuration of the embedded XML parser. This allows an attacker to read arbitrary files on the system by processing a specially crafted XML file. **Recommendations** For e-Tax software versions 3.0.10 and earlier, consider disabling the XML parser or restricting its use until a patch is available to prevent exploitation of the XXE issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** e-Gov Client Application (Windows version) versions prior to 2.1.1.0 e-Gov Client Application (macOS version) versions prior to 1.1.1.0 **Description** The issue concerns improper authorization in the handler for a custom URL scheme. A crafted URL may direct the product to access an arbitrary website, potentially leading to phishing attacks. **Recommendations** For e-Gov Client Application (Windows version) versions prior to 2.1.1.0, update to version 2.1.1.0 or later. For e-Gov Client Application (macOS version) versions prior to 1.1.1.0, update to version 1.1.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** FD Application versions 9.01 and earlier **Description** The issue improperly restricts XML external entity references (XXE), allowing an attacker to read arbitrary files on the system by processing a specially crafted XML file. **Recommendations** For FD Application versions 9.01 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Applicant Programme versions 7.06 and earlier **Description** The issue is related to the improper restriction of XML external entity references (XXE) in the Applicant Programme. This allows an attacker to read arbitrary files on the system by processing a specially crafted XML file. **Recommendations** For versions 7.06 and earlier, consider disabling XML external entity references until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tsClinical Define.xml Generator versions 1.0.0 through 1.4.0 tsClinical Metadata Desktop Tools versions 1.0.3 through 1.1.0 **Description** An improper restriction of XML external entity reference (XXE) issue exists, allowing an attacker to obtain an arbitrary file by reading a specially crafted XML file if the vulnerability is exploited. **Recommendations** For tsClinical Define.xml Generator versions 1.0.0 through 1.4.0, update to a version that addresses the XXE vulnerability. For tsClinical Metadata Desktop Tools versions 1.0.3 through 1.1.0, update to a version that addresses the XXE vulnerability. As a temporary workaround, consider restricting the use of XML external entities in the affected software until a patch is available.

**Name of the Vulnerable Software and Affected Versions** EasyMail versions 2.00.130 and earlier **Description** A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script. **Recommendations** For EasyMail versions 2.00.130 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpUploader versions 1.2 and earlier **Description** A SQL injection issue allows a remote unauthenticated attacker to obtain database information via unspecified vectors. **Recommendations** For phpUploader versions 1.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpUploader versions 1.2 and earlier **Description** A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. **Recommendations** For phpUploader versions 1.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.