Yuji Tounai

Name of the Vulnerable Software and Affected Versions: iroha Board versions v0.10.12 and earlier Description: A cross-site request forgery issue exists. If a user accesses a specially crafted URL while logged in to the affected product, arbitrary learning histories may be registered. Recommendations: For iroha Board versions v0.10.12 and earlier, consider disabling access to the learning history registration functionality until a patch is available. Restrict access to the affected product to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: iroha Board versions 0.10.12 and earlier Description: The issue is related to a direct request problem, also known as forced browsing or navegación forzada, which could allow an attacker who has logged in to the affected product to access non-public content. Recommendations: For versions 0.10.12 and earlier, consider restricting access to sensitive content until a fix is available. As a temporary workaround, limit user permissions to minimize the risk of exploitation. Avoid using the affected product for sensitive information storage until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mailform Pro CGI versions prior to 4.3.4 **Description** The issue allows a remote unauthenticated attacker to obtain coupon codes due to error messages containing sensitive information. This only affects products that use the coupon feature. **Recommendations** For versions prior to 4.3.4, update to version 4.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the coupon feature until a patch is available. Restrict access to error messages to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M (MySQL version) LuxCal Web Calendar versions prior to 5.3.3L (SQLite version) Description: The issue concerns a missing authentication vulnerability in the dloader.php file. This vulnerability can be exploited to obtain arbitrary files on a server. Recommendations: For versions prior to 5.3.3M (MySQL version), update to version 5.3.3M or later. For versions prior to 5.3.3L (SQLite version), update to version 5.3.3L or later. As a temporary workaround, consider restricting access to the dloader.php file until a patch is applied.

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M LuxCal Web Calendar versions prior to 5.3.3L Description: The issue concerns a path traversal vulnerability in the dloader.php file. This vulnerability can be exploited to obtain arbitrary files on a server. Recommendations: For versions prior to 5.3.3M, update to version 5.3.3M or later. For versions prior to 5.3.3L, update to version 5.3.3L or later. As a temporary workaround, consider restricting access to the dloader.php file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** acmailer CGI versions 4.0.5 and earlier **Description** A cross-site scripting issue exists, allowing an arbitrary script to be executed on the web browser of the user who accessed the management page of the affected product. This can occur when the user accesses the management page, potentially leading to unauthorized actions. **Recommendations** For versions 4.0.5 and earlier, consider disabling access to the management page until a fix is available. Restrict access to the affected CGI module to minimize the risk of exploitation. Avoid using the management page in the affected product until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** EXIF Viewer Classic versions 2.3.2 through 2.4.0 **Description** The issue is caused by improper handling of EXIF meta data, leading to a cross-site scripting vulnerability. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. **Recommendations** For versions 2.3.2 and 2.4.0, consider updating to a version newer than 2.4.0, as the product has been refactored and version 3.0.1 is not vulnerable. As a temporary workaround, consider disabling the rendering of EXIF meta data until a patch is available. Restrict access to the image rendering functionality to minimize the risk of exploitation. Avoid using the affected EXIF Viewer Classic versions to process crafted images until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Cybozu Garoon versions 5.0.0 through 6.0.0 **Description** The issue allows a remote authenticated attacker to alter and/or obtain the data of Memo due to an incorrect authorization vulnerability. **Recommendations** For Cybozu Garoon versions 5.0.0 through 6.0.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** a-blog cms versions 3.1.0 through 3.1.8 **Description** A URL spoofing issue exists, allowing an attacker to force the administrator to access an arbitrary website when clicking a link in the audit log by sending a specially crafted request. **Recommendations** For versions 3.1.0 through 3.1.8, update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** a-blog cms versions prior to 2.9.1 a-blog cms versions 2.9.0 and earlier a-blog cms versions 2.10.x through 2.10.49 a-blog cms versions 2.11.x through 2.11.57 a-blog cms versions 3.0.x through 3.0.28 a-blog cms versions 3.1.x through 3.1.6 **Description** The issue allows a remote authenticated attacker to delete arbitrary files on the server due to a relative path traversal vulnerability. **Recommendations** For versions 2.9.0 and earlier, update to version 2.9.1 or later. For versions 2.10.x through 2.10.49, update to version 2.10.50 or later. For versions 2.11.x through 2.11.57, update to version 2.11.58 or later. For versions 3.0.x through 3.0.28, update to version 3.0.29 or later. For versions 3.1.x through 3.1.6, update to version 3.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** a-blog cms versions prior to 3.1.7 a-blog cms versions prior to 3.0.29 a-blog cms versions prior to 2.11.58 a-blog cms versions prior to 2.10.50 a-blog cms version 2.9.0 and earlier **Description** The issue allows a remote authenticated attacker to execute an arbitrary script on the logged-in user's web browser. This is due to a cross-site scripting vulnerability. **Recommendations** For versions prior to 3.1.7, update to version 3.1.7 or later. For versions prior to 3.0.29, update to version 3.0.29 or later. For versions prior to 2.11.58, update to version 2.11.58 or later. For versions prior to 2.10.50, update to version 2.10.50 or later. For version 2.9.0 and earlier, update to a version later than 2.9.0.

**Name of the Vulnerable Software and Affected Versions** GROWI versions prior to v6.0.0 **Description** A stored cross-site scripting issue exists in the event handlers of the `pre` tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. **Recommendations** For GROWI versions prior to v6.0.0, update to version v6.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the event handlers of the `pre` tags until a patch is available. Restrict access to the `pre` tags to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LuxCal Web Calendar versions prior to 5.2.4M LuxCal Web Calendar versions prior to 5.2.4L **Description** A cross-site scripting issue allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user accessing the product. **Recommendations** For versions prior to 5.2.4M, update to version 5.2.4M or later. For versions prior to 5.2.4L, update to version 5.2.4L or later.

**Name of the Vulnerable Software and Affected Versions** LuxCal Web Calendar versions prior to 5.2.4M (MySQL version) LuxCal Web Calendar versions prior to 5.2.4L (SQLite version) **Description** A SQL injection issue allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, potentially obtaining or altering information stored in the database. **Recommendations** For versions prior to 5.2.4M (MySQL version), update to version 5.2.4M or later. For versions prior to 5.2.4L (SQLite version), update to version 5.2.4L or later.

**Name of the Vulnerable Software and Affected Versions** LuxCal Web Calendar versions prior to 5.2.3M LuxCal Web Calendar versions prior to 5.2.3L **Description** The issue allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it. This is achieved through a SQL injection vulnerability. **Recommendations** For versions prior to 5.2.3M, update to version 5.2.3M or later to resolve the issue. For versions prior to 5.2.3L, update to version 5.2.3L or later to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LuxCal Web Calendar versions prior to 5.2.3M LuxCal Web Calendar versions prior to 5.2.3L **Description** A cross-site scripting issue allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product. This enables the attacker to perform actions on the user's web browser, potentially leading to unauthorized access or data theft. **Recommendations** For versions prior to 5.2.3M, update to version 5.2.3M or later to resolve the issue. For versions prior to 5.2.3L, update to version 5.2.3L or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cybozu Garoon version 5.15.0 **Description** The issue is related to an operation restriction bypass vulnerability in the MultiReport component of Cybozu Garoon, which is associated with inadequate access control. This vulnerability can be exploited by a remote authenticated attacker to alter the data of MultiReport, potentially impacting the integrity of protected information. **Recommendations** For Cybozu Garoon version 5.15.0, consider restricting access to the MultiReport component until a patch is available. As a temporary workaround, disabling the vulnerable functionality in MultiReport may help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JB Inquiry form versions 0.6.1 through 0.6.0 JB Inquiry form versions 0.5.2 through 0.5.0 JB Inquiry form version 0.40 **Description** The issue allows a remote unauthenticated attacker to obtain information entered from forms created using the affected product, due to an exposure of private personal information to an unauthorized actor. **Recommendations** For JB Inquiry form versions 0.6.1 through 0.6.0, update to a version that fixes this issue. For JB Inquiry form versions 0.5.2 through 0.5.0, update to a version that fixes this issue. For JB Inquiry form version 0.40, update to a version that fixes this issue.

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions prior to v6.14 **Description** The issue allows a remote unauthenticated attacker to redirect a user to an arbitrary web site, potentially conducting a phishing attack by having the user access a specially crafted URL. **Recommendations** For versions prior to v6.14, update to version v6.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions prior to v6.19 **Description** The issue is related to a directory traversal vulnerability in pgAdmin 4. This vulnerability can be exploited by a remote attacker to change another user's settings or alter the database. The vulnerability is associated with insufficient restrictions on the path name to a directory with limited access. **Recommendations** For pgAdmin 4 versions prior to v6.19, update to version v6.19 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and limiting user privileges to minimize the risk of exploitation.