GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    6 vulnerabilities by Digital Agency

    JVNDB-2026-000123

    Vulnerability from jvndb - Published: 2026-08-26 05:42 - Updated:2026-08-26 05:42
    Severity
    Summary
    Android App "Myna Point" vulnerable to improper access restriction
    Details
    Android App "Myna Point" provided by Digital Agency contains the following vulnerability.
    • Improper Authorization in Handler for Custom URL Scheme (CWE-939) - CVE-2026-73335
    RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and IPA. JPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.
    Impacted products
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000123.html",
      "dc:date": "2026-08-26T14:42+09:00",
      "dcterms:issued": "2026-08-26T14:42+09:00",
      "dcterms:modified": "2026-08-26T14:42+09:00",
      "description": "Android App \"Myna Point\" provided by Digital Agency contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/939.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eImproper Authorization in Handler for Custom URL Scheme (CWE-939) - CVE-2026-73335\u003c/li\u003e\u003c/ul\u003eRyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and IPA.\r\nJPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000123.html",
      "sec:cpe": {
        "#text": "cpe:/a:e-gov:myna_point_app_for_android",
        "@product": "Android App \"Myna Point\"",
        "@vendor": "Digital Agency",
        "@version": "2.2"
      },
      "sec:cvss": {
        "@score": "5.3",
        "@severity": "Medium",
        "@type": "Base",
        "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
        "@version": "3.0"
      },
      "sec:identifier": "JVNDB-2026-000123",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/jp/JVN67155805/index.html",
          "@id": "JVN#67155805",
          "@source": "JVN"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2026-73335",
          "@id": "CVE-2026-73335",
          "@source": "CVE"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-Other",
          "@title": "No Mapping(CWE-Other)"
        }
      ],
      "title": "Android App \"Myna Point\" vulnerable to improper access restriction"
    }

    JVNDB-2023-000098

    Vulnerability from jvndb - Published: 2023-10-06 05:57 - Updated:2024-05-17 08:55
    Severity
    Summary
    e-Gov Client Application fails to restrict custom URL schemes properly
    Details
    e-Gov Client Application is installed, a Custom URL Scheme is configured on the system to enable invoking the product through a web browser. This custom URL contains the information about the website which the product should access, and a crafted URL may direct the application to access an unexpected website (CWE-939). Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000098.html",
      "dc:date": "2024-05-17T17:55+09:00",
      "dcterms:issued": "2023-10-06T14:57+09:00",
      "dcterms:modified": "2024-05-17T17:55+09:00",
      "description": "e-Gov Client Application is installed, a Custom URL Scheme is configured on the system to enable invoking the product through a web browser.\r\nThis custom URL contains the information about the website which the product should access, and a crafted URL may direct the application to access an unexpected website (CWE-939).\r\n\r\nToyama Taku of NEC Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000098.html",
      "sec:cpe": [
        {
          "#text": "cpe:/a:e-gov:e-gov",
          "@product": "e-Gov Electronic application",
          "@vendor": "Digital Agency",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/a:e-gov:e-gov",
          "@product": "e-Gov Electronic application",
          "@vendor": "Digital Agency",
          "@version": "2.2"
        }
      ],
      "sec:cvss": [
        {
          "@score": "4.3",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "@version": "2.0"
        },
        {
          "@score": "4.3",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "@version": "3.0"
        }
      ],
      "sec:identifier": "JVNDB-2023-000098",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/jp/JVN15808274/index.html",
          "@id": "JVN#15808274",
          "@source": "JVN"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2023-44689",
          "@id": "CVE-2023-44689",
          "@source": "CVE"
        },
        {
          "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-44689",
          "@id": "CVE-2023-44689",
          "@source": "NVD"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-264",
          "@title": "Permissions(CWE-264)"
        }
      ],
      "title": "e-Gov Client Application fails to restrict custom URL schemes properly"
    }

    CVE-2026-73335 (GCVE-0-2026-73335)

    Vulnerability from nvd – Published: 2026-08-26 04:54 – Updated: 2026-08-26 14:09
    VLAI
    Summary
    Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 14:09 UTC
    CWE
    • CWE-939 - Improper authorization in handler for custom URL scheme
    Impacted products
    Vendor Product Version
    Digital Agency Android App "Myna Point" Affected: 0 , ≤ 2.0.6 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73335",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-26T14:09:19.310249Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-26T14:09:26.006Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Android App \"Myna Point\"",
              "vendor": "Digital Agency",
              "versions": [
                {
                  "lessThanOrEqual": "2.0.6",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Android application \"Myna Point\" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user\u0027s Android device may exploit the affected application\u0027s functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                "version": "3.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-939",
                  "description": "Improper authorization in handler for custom URL scheme",
                  "lang": "en-US",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-26T04:54:58.950Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://play.google.com/store/apps/details?id=jp.go.soumu.mkpf.mkpfmypage\u0026hl"
            },
            {
              "url": "https://jvn.jp/en/jp/JVN67155805/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2026-73335",
        "datePublished": "2026-08-26T04:54:58.950Z",
        "dateReserved": "2026-08-12T06:01:54.985Z",
        "dateUpdated": "2026-08-26T14:09:26.006Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2023-44689 (GCVE-0-2023-44689)

    Vulnerability from nvd – Published: 2023-10-11 00:06 – Updated: 2024-09-18 16:03
    VLAI
    Summary
    e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack.
    Severity
    No CVSS data available.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-18 16:02 UTC
    CWE
    • Improper authorization in handler for custom URL scheme
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T20:07:33.452Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://jvn.jp/en/jp/JVN15808274/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-44689",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-18T16:02:54.663068Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-18T16:03:05.350Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "e-Gov Client Application (Windows version)",
              "vendor": "Digital Agency",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions prior to 2.1.1.0"
                }
              ]
            },
            {
              "product": "e-Gov Client Application (macOS version)",
              "vendor": "Digital Agency",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions prior to 1.1.1.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Improper authorization in handler for custom URL scheme",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-10-11T00:06:37.575Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
            },
            {
              "url": "https://jvn.jp/en/jp/JVN15808274/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2023-44689",
        "datePublished": "2023-10-11T00:06:37.575Z",
        "dateReserved": "2023-10-02T05:03:23.579Z",
        "dateUpdated": "2024-09-18T16:03:05.350Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2026-73335 (GCVE-0-2026-73335)

    Vulnerability from cvelistv5 – Published: 2026-08-26 04:54 – Updated: 2026-08-26 14:09
    VLAI
    Summary
    Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 14:09 UTC
    CWE
    • CWE-939 - Improper authorization in handler for custom URL scheme
    Impacted products
    Vendor Product Version
    Digital Agency Android App "Myna Point" Affected: 0 , ≤ 2.0.6 (semver)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73335",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-26T14:09:19.310249Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-26T14:09:26.006Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Android App \"Myna Point\"",
              "vendor": "Digital Agency",
              "versions": [
                {
                  "lessThanOrEqual": "2.0.6",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Android application \"Myna Point\" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user\u0027s Android device may exploit the affected application\u0027s functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                "version": "3.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-939",
                  "description": "Improper authorization in handler for custom URL scheme",
                  "lang": "en-US",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-26T04:54:58.950Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://play.google.com/store/apps/details?id=jp.go.soumu.mkpf.mkpfmypage\u0026hl"
            },
            {
              "url": "https://jvn.jp/en/jp/JVN67155805/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2026-73335",
        "datePublished": "2026-08-26T04:54:58.950Z",
        "dateReserved": "2026-08-12T06:01:54.985Z",
        "dateUpdated": "2026-08-26T14:09:26.006Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2023-44689 (GCVE-0-2023-44689)

    Vulnerability from cvelistv5 – Published: 2023-10-11 00:06 – Updated: 2024-09-18 16:03
    VLAI
    Summary
    e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack.
    Severity
    No CVSS data available.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-18 16:02 UTC
    CWE
    • Improper authorization in handler for custom URL scheme
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T20:07:33.452Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://jvn.jp/en/jp/JVN15808274/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-44689",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-18T16:02:54.663068Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-18T16:03:05.350Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "e-Gov Client Application (Windows version)",
              "vendor": "Digital Agency",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions prior to 2.1.1.0"
                }
              ]
            },
            {
              "product": "e-Gov Client Application (macOS version)",
              "vendor": "Digital Agency",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions prior to 1.1.1.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct the product to access an arbitrary website. As a result, the user may become a victim of a phishing attack."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Improper authorization in handler for custom URL scheme",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-10-11T00:06:37.575Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://shinsei.e-gov.go.jp/contents/news/2023-03-12t1022040900_1318.html"
            },
            {
              "url": "https://jvn.jp/en/jp/JVN15808274/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2023-44689",
        "datePublished": "2023-10-11T00:06:37.575Z",
        "dateReserved": "2023-10-02T05:03:23.579Z",
        "dateUpdated": "2024-09-18T16:03:05.350Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }