Search criteria

4 vulnerabilities by nttdata

CVE-2022-43484 (GCVE-0-2022-43484)

Vulnerability from cvelistv5 – Published: 2022-12-05 00:00 – Updated: 2025-04-24 14:12
VLAI
Summary
TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an improper input validation issue in the binding mechanism of Spring MVC. By the application processing a specially crafted file, arbitrary code may be executed with the privileges of the application.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • ClassLoader manipulation vulnerability
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
NTT DATA Corporation TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) Affected: TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T13:32:59.591Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://terasolunaorg.github.io/vulnerability/cve-2022-43484.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://osdn.net/projects/terasoluna/wiki/cve-2022-43484"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN54728399/index.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-43484",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T14:12:21.882658Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-24T14:12:57.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich)",
          "vendor": "NTT DATA Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an improper input validation issue in the binding mechanism of Spring MVC. By the application processing a specially crafted file, arbitrary code may be executed with the privileges of the application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "ClassLoader manipulation vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-05T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "http://terasolunaorg.github.io/vulnerability/cve-2022-43484.html"
        },
        {
          "url": "https://osdn.net/projects/terasoluna/wiki/cve-2022-43484"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN54728399/index.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-43484",
    "datePublished": "2022-12-05T00:00:00.000Z",
    "dateReserved": "2022-10-22T00:00:00.000Z",
    "dateUpdated": "2025-04-24T14:12:57.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-5523 (GCVE-0-2020-5523)

Vulnerability from cvelistv5 – Published: 2020-01-28 05:25 – Updated: 2024-08-04 08:30
VLAI
Summary
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity
No CVSS data available.
CWE
  • Fails to verify SSL certificates
Assigner
References
Impacted products
Vendor Product Version
NTT Data Corporation 'MyPallete' and some of the Android banking applications that use 'MyPallete' Affected: MyPallete all versions, AshikagaBankingAppli ver1.0.4 and earlier, SENSHUIKEDABANKBankingAppli ver3.0.4 and earlier, ShikokuBankingAppli ver2.0.1 and earlier, TohokuBankingAppli ver1.0.1 and earlier, NaganoBankingAppli ver1.0.1 and earlier, 77BankingAppli ver2.0.1 and earlier, HokkaidoBankingAppli ver3.0.1 and earlier, and HokurikuBankingAppli ver2.0.1 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:24.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.shikokubank.co.jp/info/apps20200128.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN28845872/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "\u0027MyPallete\u0027 and some of the Android banking applications that use \u0027MyPallete\u0027",
          "vendor": "NTT Data Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "MyPallete all versions, AshikagaBankingAppli ver1.0.4 and earlier, SENSHUIKEDABANKBankingAppli ver3.0.4 and earlier, ShikokuBankingAppli ver2.0.1 and earlier, TohokuBankingAppli ver1.0.1 and earlier, NaganoBankingAppli ver1.0.1 and earlier, 77BankingAppli ver2.0.1 and earlier, HokkaidoBankingAppli ver3.0.1 and earlier, and HokurikuBankingAppli ver2.0.1 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Android App \u0027MyPallete\u0027 and some of the Android banking applications based on \u0027MyPallete\u0027 do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to verify SSL certificates",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-28T05:25:48.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.shikokubank.co.jp/info/apps20200128.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://jvn.jp/en/jp/JVN28845872/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5523",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "\u0027MyPallete\u0027 and some of the Android banking applications that use \u0027MyPallete\u0027",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "MyPallete all versions, AshikagaBankingAppli ver1.0.4 and earlier, SENSHUIKEDABANKBankingAppli ver3.0.4 and earlier, ShikokuBankingAppli ver2.0.1 and earlier, TohokuBankingAppli ver1.0.1 and earlier, NaganoBankingAppli ver1.0.1 and earlier, 77BankingAppli ver2.0.1 and earlier, HokkaidoBankingAppli ver3.0.1 and earlier, and HokurikuBankingAppli ver2.0.1 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NTT Data Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Android App \u0027MyPallete\u0027 and some of the Android banking applications based on \u0027MyPallete\u0027 do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to verify SSL certificates"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html",
              "refsource": "MISC",
              "url": "http://www.dokodemobank.ne.jp/info_20200128_bankingapp.html"
            },
            {
              "name": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf",
              "refsource": "MISC",
              "url": "https://www.ashikagabank.co.jp/appbanking/pdf/oshirase.pdf"
            },
            {
              "name": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf",
              "refsource": "MISC",
              "url": "https://www.sihd-bk.jp/common_v2/pdf/20200127.pdf"
            },
            {
              "name": "https://www.shikokubank.co.jp/info/apps20200128.html",
              "refsource": "MISC",
              "url": "https://www.shikokubank.co.jp/info/apps20200128.html"
            },
            {
              "name": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html",
              "refsource": "MISC",
              "url": "https://www.tohoku-bank.co.jp/news/topics/200128_applissl.html"
            },
            {
              "name": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html",
              "refsource": "MISC",
              "url": "https://www.naganobank.co.jp/soshiki/2/app-ssl.html"
            },
            {
              "name": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf",
              "refsource": "MISC",
              "url": "https://www.77bank.co.jp/pdf/oshirase/20012801_appvulnerability.pdf"
            },
            {
              "name": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf",
              "refsource": "MISC",
              "url": "https://www.hokkaidobank.co.jp/common/dat/2020/0120/15795047141946146699.pdf"
            },
            {
              "name": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html",
              "refsource": "MISC",
              "url": "https://www.hokugin.co.jp/info/archives/personal/2020/1913.html"
            },
            {
              "name": "http://jvn.jp/en/jp/JVN28845872/index.html",
              "refsource": "MISC",
              "url": "http://jvn.jp/en/jp/JVN28845872/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5523",
    "datePublished": "2020-01-28T05:25:48.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:30:24.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-1183 (GCVE-0-2016-1183)

Vulnerability from cvelistv5 – Published: 2016-06-19 01:00 – Updated: 2024-08-05 22:48
VLAI
Summary
NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.fujitsu.com/jp/products/software/resou… x_refsource_CONFIRM
http://jvn.jp/en/jp/JVN74659077/index.html third-party-advisoryx_refsource_JVN
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000098 third-party-advisoryx_refsource_JVNDB
Date Public
2016-06-07 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:48:13.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183"
          },
          {
            "name": "JVN#74659077",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN74659077/index.html"
          },
          {
            "name": "JVNDB-2016-000098",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000098"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-06-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-19T01:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183"
        },
        {
          "name": "JVN#74659077",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN74659077/index.html"
        },
        {
          "name": "JVNDB-2016-000098",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000098"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2016-1183",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183",
              "refsource": "CONFIRM",
              "url": "http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183"
            },
            {
              "name": "JVN#74659077",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN74659077/index.html"
            },
            {
              "name": "JVNDB-2016-000098",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000098"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2016-1183",
    "datePublished": "2016-06-19T01:00:00.000Z",
    "dateReserved": "2015-12-26T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:48:13.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-7786 (GCVE-0-2015-7786)

Vulnerability from cvelistv5 – Published: 2015-12-29 17:00 – Updated: 2024-08-06 07:58
VLAI
Summary
Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000196 third-party-advisoryx_refsource_JVNDB
http://www.nttdata-smart.co.jp/information/2015/0… x_refsource_CONFIRM
http://jvn.jp/en/jp/JVN70083512/index.html third-party-advisoryx_refsource_JVN
http://jvn.jp/en/jp/JVN70083512/995570/index.html x_refsource_CONFIRM
Date Public
2015-12-07 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:58:59.851Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVNDB-2015-000196",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVNDB",
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.nttdata-smart.co.jp/information/2015/000040.html"
          },
          {
            "name": "JVN#70083512",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN70083512/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN70083512/995570/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-12-29T17:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVNDB-2015-000196",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVNDB"
          ],
          "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.nttdata-smart.co.jp/information/2015/000040.html"
        },
        {
          "name": "JVN#70083512",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN70083512/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://jvn.jp/en/jp/JVN70083512/995570/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2015-7786",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVNDB-2015-000196",
              "refsource": "JVNDB",
              "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000196"
            },
            {
              "name": "http://www.nttdata-smart.co.jp/information/2015/000040.html",
              "refsource": "CONFIRM",
              "url": "http://www.nttdata-smart.co.jp/information/2015/000040.html"
            },
            {
              "name": "JVN#70083512",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN70083512/index.html"
            },
            {
              "name": "http://jvn.jp/en/jp/JVN70083512/995570/index.html",
              "refsource": "CONFIRM",
              "url": "http://jvn.jp/en/jp/JVN70083512/995570/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2015-7786",
    "datePublished": "2015-12-29T17:00:00.000Z",
    "dateReserved": "2015-10-09T00:00:00.000Z",
    "dateUpdated": "2024-08-06T07:58:59.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}