vultures@jpcert.or.jp
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS vultures@jpcert.or.jp
03
assessed vulnerabilities (628)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-97627US | — | — | ||
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privi… | ||||
| CVE-2026-100737US | — | — | ||
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privi… | ||||
| CVE-2026-109831US | — | — | ||
UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition. | ||||
| CVE-2026-104679US | — | — | ||
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended… | ||||
| CVE-2026-96614US | — | — | ||
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to… | ||||
| CVE-2026-75559US | — | — | ||
The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, p… | ||||
| CVE-2026-72528US | — | — | ||
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be… | ||||
| CVE-2026-105271US | —OT elevated | — | ||
"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected… | ||||
| CVE-2026-103671US | — | — | ||
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitra… | ||||
| CVE-2026-107153US | — | — | ||
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a cra… | ||||
| CVE-2026-106931US | —OT critical | KEV | ||
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system r… | ||||
| CVE-2026-101020US | — | — | ||
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticate… | ||||
| CVE-2026-92862US | — | — | ||
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent. | ||||
| CVE-2026-92861US | —OT elevated | — | ||
The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application. | ||||
| CVE-2026-96408US | — | — | ||
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the… | ||||
| CVE-2026-103668US | — | — | ||
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected pro… | ||||
| CVE-2026-100727US | — | — | ||
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file… | ||||
| CVE-2026-97150US | — | — | ||
When converting baserCMS4-style addons to baserCMS5-style ones,
BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed.
Arbitrary… | ||||
| CVE-2026-93464US | — | — | ||
A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user'… | ||||
| CVE-2026-93463US | — | — | ||
A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web brow… | ||||