Yuji Tounai

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information.

Name of the Vulnerable Software and Affected Versions: iroha Board versions 0.10.12 and earlier Description: The issue is related to a direct request problem, also known as forced browsing or navegación forzada, which could allow an attacker who has logged in to the affected product to access non-public content. Recommendations: For versions 0.10.12 and earlier, consider restricting access to sensitive content until a fix is available. As a temporary workaround, limit user permissions to minimize the risk of exploitation. Avoid using the affected product for sensitive information storage until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: iroha Board versions v0.10.12 and earlier Description: A cross-site request forgery issue exists. If a user accesses a specially crafted URL while logged in to the affected product, arbitrary learning histories may be registered. Recommendations: For iroha Board versions v0.10.12 and earlier, consider disabling access to the learning history registration functionality until a patch is available. Restrict access to the affected product to minimize the risk of exploitation.

The issue allows a remote unauthenticated attacker to obtain coupon codes due to error messages containing sensitive information. This only affects products that use the coupon feature.

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M (MySQL version) LuxCal Web Calendar versions prior to 5.3.3L (SQLite version) Description: The issue concerns a missing authentication vulnerability in the dloader.php file. This vulnerability can be exploited to obtain arbitrary files on a server. Recommendations: For versions prior to 5.3.3M (MySQL version), update to version 5.3.3M or later. For versions prior to 5.3.3L (SQLite version), update to version 5.3.3L or later. As a temporary workaround, consider restricting access to the dloader.php file until a patch is applied.

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M LuxCal Web Calendar versions prior to 5.3.3L Description: The issue concerns a path traversal vulnerability in the dloader.php file. This vulnerability can be exploited to obtain arbitrary files on a server. Recommendations: For versions prior to 5.3.3M, update to version 5.3.3M or later. For versions prior to 5.3.3L, update to version 5.3.3L or later. As a temporary workaround, consider restricting access to the dloader.php file until a patch is available.

A cross-site scripting issue exists, allowing an arbitrary script to be executed on the web browser of the user who accessed the management page of the affected product. This can occur when the user accesses the management page, potentially leading to unauthorized actions.

The issue is caused by improper handling of EXIF meta data, leading to a cross-site scripting vulnerability. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser.

The issue allows a remote authenticated attacker to alter and/or obtain the data of Memo due to an incorrect authorization vulnerability.

A URL spoofing issue exists, allowing an attacker to force the administrator to access an arbitrary website when clicking a link in the audit log by sending a specially crafted request.

The issue allows a remote authenticated attacker to delete arbitrary files on the server due to a relative path traversal vulnerability.

The issue allows a remote authenticated attacker to execute an arbitrary script on the logged-in user's web browser. This is due to a cross-site scripting vulnerability.

A stored cross-site scripting issue exists in the event handlers of the `pre` tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

A cross-site scripting issue allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user accessing the product.

A SQL injection issue allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, potentially obtaining or altering information stored in the database.

The issue allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it. This is achieved through a SQL injection vulnerability.

A cross-site scripting issue allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product. This enables the attacker to perform actions on the user's web browser, potentially leading to unauthorized access or data theft.

The issue is related to an operation restriction bypass vulnerability in the MultiReport component of Cybozu Garoon, which is associated with inadequate access control. This vulnerability can be exploited by a remote authenticated attacker to alter the data of MultiReport, potentially impacting the integrity of protected information.

The issue allows a remote unauthenticated attacker to obtain information entered from forms created using the affected product, due to an exposure of private personal information to an unauthorized actor.

The issue allows a remote unauthenticated attacker to redirect a user to an arbitrary web site, potentially conducting a phishing attack by having the user access a specially crafted URL.