Shoji Baba

Name of the Vulnerable Software and Affected Versions: Active! mail 6 versions 6.30.01004145 through 6.60.06008562 Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the logged-in user's web browser when accessing a specially crafted URL. Recommendations: For Active! mail 6 versions 6.30.01004145 through 6.60.06008562, update to a version that includes a fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Active! mail 6 versions 6.60.06008562 and earlier Description: A cross-site request forgery issue exists, potentially allowing unintended emails to be sent when a user, who is logged in, accesses a specially crafted URL. Recommendations: For Active! mail 6 versions 6.60.06008562 and earlier, consider implementing measures to verify the authenticity of requests, such as validating the origin of requests or using anti-CSRF tokens, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier **Description** The issue allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product. **Recommendations** For versions B0.1.9.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SHARP Energy Management Controller with Cloud Services versions B0.1.9.1 and earlier **Description** A cross-site scripting issue allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user accessing the management page of the affected product. **Recommendations** For versions B0.1.9.1 and earlier, update to a version later than B0.1.9.1 to resolve the issue. As a temporary workaround, consider restricting access to the management page of the affected product until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier **Description** The issue allows a network-adjacent unauthenticated attacker to access the affected product without authentication. This is due to an improper authentication vulnerability. **Recommendations** For versions B0.1.9.1 and earlier, update to a version later than B0.1.9.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier **Description** The issue allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product due to a path traversal vulnerability. **Recommendations** For versions B0.1.9.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier **Description** A cross-site request forgery issue allows a remote unauthenticated attacker to change the product settings. **Recommendations** For versions B0.1.9.1 and earlier, update to a version later than B0.1.9.1 to resolve the issue. As a temporary workaround, consider restricting access to the Energy Management Controller with Cloud Services to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier **Description** A server-side request forgery issue allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request (GET) from the affected product. **Recommendations** For versions B0.1.9.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier **Description** An improper access control issue exists, potentially allowing a network-adjacent unauthenticated attacker to obtain a `username` and its hashed `password` displayed on the management page of the affected product. **Recommendations** For versions B0.1.9.1 and earlier, consider restricting access to the management page as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier Description: The issue is related to improper neutralization of HTTP request headers for scripting syntax, allowing a remote authenticated attacker to obtain sensitive information via a specially crafted web page. This affects the Web GUI of the mentioned devices. Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier Description: The issue is a cross-site script inclusion vulnerability in the Web GUI of the affected products. This allows a remote authenticated attacker to alter the product's settings via a specially crafted web page. Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cybozu Office versions 10.0.0 through 10.8.3 **Description** A directory traversal issue allows remote authenticated attackers to modify arbitrary files using the `Customapp` function. **Recommendations** For Cybozu Office versions 10.0.0 through 10.8.3, consider restricting access to the `Customapp` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Cybozu Garoon versions 4.0.0 through 4.10.3 **Description** The issue allows remote authenticated attackers to execute arbitrary SQL commands. **Recommendations** For versions 4.0.0 through 4.10.3, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LogonTracer versions 1.2.0 and earlier **Description** The issue allows remote attackers to conduct Python code injection attacks. **Recommendations** For LogonTracer versions 1.2.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LogonTracer versions 1.2.0 and earlier **Description** A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. **Recommendations** For LogonTracer versions 1.2.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LogonTracer versions 1.2.0 and earlier **Description** The issue allows remote attackers to execute arbitrary OS commands. **Recommendations** For LogonTracer versions 1.2.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LogonTracer versions 1.2.0 and earlier **Description** The issue allows remote attackers to conduct XML External Entity (XXE) attacks. This is achieved via unspecified vectors, which could potentially lead to unauthorized access to sensitive data. **Recommendations** For LogonTracer versions 1.2.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** SiteBridge Inc. Joruri Gw versions 3.2.0 and earlier **Description** The issue allows remote authenticated users to execute arbitrary PHP code. **Recommendations** For versions 3.2.0 and earlier, update to a version later than 3.2.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier **Description** The issue allows remote attackers to execute arbitrary SQL commands. **Recommendations** For versions 3.0.14 and earlier, update to a version later than 3.0.14. For versions 4.0.5 and earlier, update to a version later than 4.0.5.

**Name of the Vulnerable Software and Affected Versions** baserCMS versions 3.0.14 and earlier baserCMS versions 4.0.5 and earlier **Description** The issue allows remote attackers to delete arbitrary files via unspecified vectors when the `File` field is being used in the mail form. **Recommendations** For baserCMS versions 3.0.14 and earlier, update to a version later than 3.0.14. For baserCMS versions 4.0.5 and earlier, update to a version later than 4.0.5.