Search criteria
9 vulnerabilities found for VI Web Client by i-PRO Co., Ltd.
CVE-2023-40705 (GCVE-0-2023-40705)
Vulnerability from cvelistv5 – Published: 2023-09-05 08:40 – Updated: 2024-09-30 17:27
VLAI?
Summary
Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:38:51.282Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40705",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:27:37.799078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:27:52.788Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:40:44.612Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-40705",
"datePublished": "2023-09-05T08:40:44.612Z",
"dateReserved": "2023-08-25T04:25:46.854Z",
"dateUpdated": "2024-09-30T17:27:52.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40535 (GCVE-0-2023-40535)
Vulnerability from cvelistv5 – Published: 2023-09-05 08:39 – Updated: 2024-09-30 17:15
VLAI?
Summary
Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:38:50.361Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:14:58.513477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:15:08.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:39:42.741Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-40535",
"datePublished": "2023-09-05T08:39:42.741Z",
"dateReserved": "2023-08-25T04:25:47.622Z",
"dateUpdated": "2024-09-30T17:15:08.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39938 (GCVE-0-2023-39938)
Vulnerability from cvelistv5 – Published: 2023-09-05 08:38 – Updated: 2024-09-30 17:15
VLAI?
Summary
Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary script.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:18:10.177Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:15:34.755307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:15:42.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:38:42.951Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-39938",
"datePublished": "2023-09-05T08:38:42.951Z",
"dateReserved": "2023-08-25T04:25:48.483Z",
"dateUpdated": "2024-09-30T17:15:42.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-38574 (GCVE-0-2023-38574)
Vulnerability from cvelistv5 – Published: 2023-09-05 08:37 – Updated: 2024-09-30 17:16
VLAI?
Summary
Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
Severity ?
No CVSS data available.
CWE
- Open Redirect
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:46:55.865Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:16:08.130016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:16:19.091Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Open Redirect",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:37:35.942Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-38574",
"datePublished": "2023-09-05T08:37:35.942Z",
"dateReserved": "2023-08-25T04:25:45.902Z",
"dateUpdated": "2024-09-30T17:16:19.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40705 (GCVE-0-2023-40705)
Vulnerability from nvd – Published: 2023-09-05 08:40 – Updated: 2024-09-30 17:27
VLAI?
Summary
Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:38:51.282Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40705",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:27:37.799078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:27:52.788Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:40:44.612Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-40705",
"datePublished": "2023-09-05T08:40:44.612Z",
"dateReserved": "2023-08-25T04:25:46.854Z",
"dateUpdated": "2024-09-30T17:27:52.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40535 (GCVE-0-2023-40535)
Vulnerability from nvd – Published: 2023-09-05 08:39 – Updated: 2024-09-30 17:15
VLAI?
Summary
Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:38:50.361Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:14:58.513477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:15:08.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:39:42.741Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-40535",
"datePublished": "2023-09-05T08:39:42.741Z",
"dateReserved": "2023-08-25T04:25:47.622Z",
"dateUpdated": "2024-09-30T17:15:08.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39938 (GCVE-0-2023-39938)
Vulnerability from nvd – Published: 2023-09-05 08:38 – Updated: 2024-09-30 17:15
VLAI?
Summary
Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary script.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:18:10.177Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:15:34.755307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:15:42.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:38:42.951Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-39938",
"datePublished": "2023-09-05T08:38:42.951Z",
"dateReserved": "2023-08-25T04:25:48.483Z",
"dateUpdated": "2024-09-30T17:15:42.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-38574 (GCVE-0-2023-38574)
Vulnerability from nvd – Published: 2023-09-05 08:37 – Updated: 2024-09-30 17:16
VLAI?
Summary
Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
Severity ?
No CVSS data available.
CWE
- Open Redirect
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| i-PRO Co., Ltd. | VI Web Client |
Affected:
prior to 7.9.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:46:55.865Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-30T17:16:08.130016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-30T17:16:19.091Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "VI Web Client",
"vendor": "i-PRO Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "prior to 7.9.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Open Redirect",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-05T08:37:35.942Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf"
},
{
"url": "https://jvn.jp/en/jp/JVN60140221/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-38574",
"datePublished": "2023-09-05T08:37:35.942Z",
"dateReserved": "2023-08-25T04:25:45.902Z",
"dateUpdated": "2024-09-30T17:16:19.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2023-000089
Vulnerability from jvndb - Published: 2023-08-31 14:13 - Updated:2024-05-14 18:05
Severity ?
Summary
Multiple vulnerabilities in i-PRO VI Web Client
Details
VI Web Client provided by i-PRO Co., Ltd. is Video Insight's video management software. VI Web Client contains multiple vulnerabilities listed below.
- Open Redirect (CWE-601) - CVE-2023-38574
- Reflected Cross-site Scripting (CWE-79) - CVE-2023-39938
- View Stored Cross-site Scripting in View setting page (CWE-79) - CVE-2023-40535
- Stored Cross-site Scripting in Map setting page (CWE-79) - CVE-2023-40705
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000089.html",
"dc:date": "2024-05-14T18:05+09:00",
"dcterms:issued": "2023-08-31T14:13+09:00",
"dcterms:modified": "2024-05-14T18:05+09:00",
"description": "VI Web Client provided by i-PRO Co., Ltd. is Video Insight\u0027s video management software. VI Web Client contains multiple vulnerabilities listed below.\u003cul\u003e\u003cli\u003eOpen Redirect (CWE-601) - CVE-2023-38574\u003c/li\u003e\u003cli\u003eReflected Cross-site Scripting (CWE-79) - CVE-2023-39938\u003c/li\u003e\u003cli\u003eView Stored Cross-site Scripting in View setting page (CWE-79) - CVE-2023-40535\u003c/li\u003e\u003cli\u003eStored Cross-site Scripting in Map setting page (CWE-79) - CVE-2023-40705\u003c/li\u003e\u003c/ul\u003eMichael Heinzl reported these vulnerabilities to i-PRO Co., Ltd. and coordinated with them. After the coordination was completed, the developer reported this case to IPA to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.",
"link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000089.html",
"sec:cpe": {
"#text": "cpe:/a:i-pro:i-pro_vi_web_client",
"@product": "VI Web Client",
"@vendor": "i-PRO Co., Ltd.",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
{
"@score": "6.1",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2023-000089",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN60140221/index.html",
"@id": "JVN#60140221",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-38574",
"@id": "CVE-2023-38574",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-39938",
"@id": "CVE-2023-39938",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-40535",
"@id": "CVE-2023-40535",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-40705",
"@id": "CVE-2023-40705",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-38574",
"@id": "CVE-2023-38574",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39938",
"@id": "CVE-2023-39938",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40535",
"@id": "CVE-2023-40535",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40705",
"@id": "CVE-2023-40705",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in i-PRO VI Web Client"
}