{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000130.html",
  "dc:date": "2018-02-14T13:52+09:00",
  "dcterms:issued": "2017-06-12T14:49+09:00",
  "dcterms:modified": "2018-02-14T13:52+09:00",
  "description": "Installer of electronic tendering and bid opening system provided by Acquisition, Technology \u0026 Logistics Agency contains an issue with the search path for executable files, which may lead to insecurely invoking an executable file.\r\n\r\nNote that this vulnerability is different from JVN#75514460.\r\n\r\nDigiGnome reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000130.html",
  "sec:cpe": {
    "#text": "cpe:/a:atla:electronic_tendering_and_bid_opening_system",
    "@product": "Installer of electronic tendering and bid opening system",
    "@vendor": "Acquisition, Technology \u0026 Logistics Agency (ATLA)",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000130",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN27198823/index.html",
      "@id": "JVN#27198823",
      "@source": "JVN"
    },
    {
      "#text": "http://jvn.jp/en/ta/JVNTA91240916/index.html",
      "@id": "JVNTA#91240916",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2208",
      "@id": "CVE-2017-2208",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2208",
      "@id": "CVE-2017-2208",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Installer of electronic tendering and bid opening system provided by Acquisition, Technology \u0026 Logistics Agency may insecurely invoke an executable file"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000100.html",
  "dc:date": "2018-01-17T13:58+09:00",
  "dcterms:issued": "2017-05-25T14:14+09:00",
  "dcterms:modified": "2018-01-17T13:58+09:00",
  "description": "Installer of electronic tendering and bid opening system provided by Acquisition, Technology \u0026 Logistics Agency contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.\r\n\r\nEili Masami of Tachibana Lab. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000100.html",
  "sec:cpe": {
    "#text": "cpe:/a:atla:electronic_tendering_and_bid_opening_system",
    "@product": "Installer of electronic tendering and bid opening system",
    "@vendor": "Acquisition, Technology \u0026 Logistics Agency (ATLA)",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000100",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN75514460/index.html",
      "@id": "JVN#75514460",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2178",
      "@id": "CVE-2017-2178",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2178",
      "@id": "CVE-2017-2178",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Installer of electronic tendering and bid opening system provided by Acquisition, Technology \u0026 Logistics Agency may insecurely load Dynamic Link Libraries"
}