Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Digital Agency
JVNDB-2026-000123
Vulnerability from jvndb - Published: 2026-08-26 05:42 - Updated:2026-08-26 05:42
Severity
Summary
Android App "Myna Point" vulnerable to improper access restriction
Details
Android App "Myna Point" provided by Digital Agency contains the following vulnerability.
- Improper Authorization in Handler for Custom URL Scheme (CWE-939) - CVE-2026-73335
References
| Type | URL | |
|---|---|---|
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000123.html",
"dc:date": "2026-08-26T14:42+09:00",
"dcterms:issued": "2026-08-26T14:42+09:00",
"dcterms:modified": "2026-08-26T14:42+09:00",
"description": "Android App \"Myna Point\" provided by Digital Agency contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/939.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eImproper Authorization in Handler for Custom URL Scheme (CWE-939) - CVE-2026-73335\u003c/li\u003e\u003c/ul\u003eRyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and IPA.\r\nJPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000123.html",
"sec:cpe": {
"#text": "cpe:/a:e-gov:myna_point_app_for_android",
"@product": "Android App \"Myna Point\"",
"@vendor": "Digital Agency",
"@version": "2.2"
},
"sec:cvss": {
"@score": "5.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-000123",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN67155805/index.html",
"@id": "JVN#67155805",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-73335",
"@id": "CVE-2026-73335",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Android App \"Myna Point\" vulnerable to improper access restriction"
}
JVNDB-2023-000098
Vulnerability from jvndb - Published: 2023-10-06 05:57 - Updated:2024-05-17 08:55
Severity
Summary
e-Gov Client Application fails to restrict custom URL schemes properly
Details
e-Gov Client Application is installed, a Custom URL Scheme is configured on the system to enable invoking the product through a web browser.
This custom URL contains the information about the website which the product should access, and a crafted URL may direct the application to access an unexpected website (CWE-939).
Toyama Taku of NEC Corporation reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000098.html",
"dc:date": "2024-05-17T17:55+09:00",
"dcterms:issued": "2023-10-06T14:57+09:00",
"dcterms:modified": "2024-05-17T17:55+09:00",
"description": "e-Gov Client Application is installed, a Custom URL Scheme is configured on the system to enable invoking the product through a web browser.\r\nThis custom URL contains the information about the website which the product should access, and a crafted URL may direct the application to access an unexpected website (CWE-939).\r\n\r\nToyama Taku of NEC Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000098.html",
"sec:cpe": [
{
"#text": "cpe:/a:e-gov:e-gov",
"@product": "e-Gov Electronic application",
"@vendor": "Digital Agency",
"@version": "2.2"
},
{
"#text": "cpe:/a:e-gov:e-gov",
"@product": "e-Gov Electronic application",
"@vendor": "Digital Agency",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
{
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2023-000098",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN15808274/index.html",
"@id": "JVN#15808274",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-44689",
"@id": "CVE-2023-44689",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-44689",
"@id": "CVE-2023-44689",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-264",
"@title": "Permissions(CWE-264)"
}
],
"title": "e-Gov Client Application fails to restrict custom URL schemes properly"
}
CVE-2026-73335 (GCVE-0-2026-73335)
Vulnerability from nvd – Published: 2026-08-26 04:54 – Updated: 2026-08-26 14:09
VLAI
EPSS
VEX
Summary
Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 14:09 UTC
CWE
- CWE-939 - Improper authorization in handler for custom URL scheme
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Agency | Android App "Myna Point" |
Affected:
0 , ≤ 2.0.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T14:09:19.310249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:09:26.006Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App \"Myna Point\"",
"vendor": "Digital Agency",
"versions": [
{
"lessThanOrEqual": "2.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Android application \"Myna Point\" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user\u0027s Android device may exploit the affected application\u0027s functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-939",
"description": "Improper authorization in handler for custom URL scheme",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T04:54:58.950Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://play.google.com/store/apps/details?id=jp.go.soumu.mkpf.mkpfmypage\u0026hl"
},
{
"url": "https://jvn.jp/en/jp/JVN67155805/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-73335",
"datePublished": "2026-08-26T04:54:58.950Z",
"dateReserved": "2026-08-12T06:01:54.985Z",
"dateUpdated": "2026-08-26T14:09:26.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-44689 (GCVE-0-2023-44689)
Vulnerability from nvd – Published: 2023-10-11 00:06 – Updated: 2024-09-18 16:03
VLAI
EPSS
VEX
Summary
e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-18 16:02 UTC
CWE
- Improper authorization in handler for custom URL scheme
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Agency | e-Gov Client Application (Windows version) |
Affected:
versions prior to 2.1.1.0
|
|
| Digital Agency | e-Gov Client Application (macOS version) |
Affected:
versions prior to 1.1.1.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:07:33.452Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN15808274/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-44689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:02:54.663068Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:03:05.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "e-Gov Client Application (Windows version)",
"vendor": "Digital Agency",
"versions": [
{
"status": "affected",
"version": "versions prior to 2.1.1.0"
}
]
},
{
"product": "e-Gov Client Application (macOS version)",
"vendor": "Digital Agency",
"versions": [
{
"status": "affected",
"version": "versions prior to 1.1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper authorization in handler for custom URL scheme",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-11T00:06:37.575Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
},
{
"url": "https://jvn.jp/en/jp/JVN15808274/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-44689",
"datePublished": "2023-10-11T00:06:37.575Z",
"dateReserved": "2023-10-02T05:03:23.579Z",
"dateUpdated": "2024-09-18T16:03:05.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-73335 (GCVE-0-2026-73335)
Vulnerability from cvelistv5 – Published: 2026-08-26 04:54 – Updated: 2026-08-26 14:09
VLAI
EPSS
VEX
Summary
Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 14:09 UTC
CWE
- CWE-939 - Improper authorization in handler for custom URL scheme
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Agency | Android App "Myna Point" |
Affected:
0 , ≤ 2.0.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T14:09:19.310249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:09:26.006Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App \"Myna Point\"",
"vendor": "Digital Agency",
"versions": [
{
"lessThanOrEqual": "2.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Android application \"Myna Point\" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user\u0027s Android device may exploit the affected application\u0027s functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-939",
"description": "Improper authorization in handler for custom URL scheme",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T04:54:58.950Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://play.google.com/store/apps/details?id=jp.go.soumu.mkpf.mkpfmypage\u0026hl"
},
{
"url": "https://jvn.jp/en/jp/JVN67155805/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-73335",
"datePublished": "2026-08-26T04:54:58.950Z",
"dateReserved": "2026-08-12T06:01:54.985Z",
"dateUpdated": "2026-08-26T14:09:26.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-44689 (GCVE-0-2023-44689)
Vulnerability from cvelistv5 – Published: 2023-10-11 00:06 – Updated: 2024-09-18 16:03
VLAI
EPSS
VEX
Summary
e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-18 16:02 UTC
CWE
- Improper authorization in handler for custom URL scheme
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Digital Agency | e-Gov Client Application (Windows version) |
Affected:
versions prior to 2.1.1.0
|
|
| Digital Agency | e-Gov Client Application (macOS version) |
Affected:
versions prior to 1.1.1.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:07:33.452Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN15808274/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-44689",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:02:54.663068Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:03:05.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "e-Gov Client Application (Windows version)",
"vendor": "Digital Agency",
"versions": [
{
"status": "affected",
"version": "versions prior to 2.1.1.0"
}
]
},
{
"product": "e-Gov Client Application (macOS version)",
"vendor": "Digital Agency",
"versions": [
{
"status": "affected",
"version": "versions prior to 1.1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper authorization in handler for custom URL scheme",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-11T00:06:37.575Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
},
{
"url": "https://jvn.jp/en/jp/JVN15808274/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-44689",
"datePublished": "2023-10-11T00:06:37.575Z",
"dateReserved": "2023-10-02T05:03:23.579Z",
"dateUpdated": "2024-09-18T16:03:05.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}