Refine your search

2 vulnerabilities found for Tablacus Explorer by Gaku

CVE-2017-2140 (GCVE-0-2017-2140)
Vulnerability from cvelistv5
Published
2017-04-28 16:00
Modified
2024-08-05 13:48
Severity ?
CWE
  • Script injection
Summary
Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory.
References
Impacted products
Vendor Product Version
Gaku Tablacus Explorer Version: 17.3.30 and earlier
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:48:03.447Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://tablacus.hatenablog.com/entry/2017/04/05/200424"
          },
          {
            "name": "JVN#64451600",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN64451600/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tablacus Explorer",
          "vendor": "Gaku",
          "versions": [
            {
              "status": "affected",
              "version": "17.3.30 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2017-04-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Script injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-28T15:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://tablacus.hatenablog.com/entry/2017/04/05/200424"
        },
        {
          "name": "JVN#64451600",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN64451600/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-2140",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tablacus Explorer",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "17.3.30 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Gaku"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Script injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://tablacus.hatenablog.com/entry/2017/04/05/200424",
              "refsource": "MISC",
              "url": "http://tablacus.hatenablog.com/entry/2017/04/05/200424"
            },
            {
              "name": "JVN#64451600",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN64451600/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-2140",
    "datePublished": "2017-04-28T16:00:00.000Z",
    "dateReserved": "2016-12-01T00:00:00.000Z",
    "dateUpdated": "2024-08-05T13:48:03.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

jvndb-2017-000058
Vulnerability from jvndb
Published
2017-04-07 14:47
Modified
2017-06-01 15:24
Severity ?
8.8 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Tablacus Explorer vulnerable to script injection
Details
Tablacus Explorer is a tabbled file manager. Tablacus Explorer contains a script injection vulnerability due to improper handling of directory names. Touma Hatano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000058.html",
  "dc:date": "2017-06-01T15:24+09:00",
  "dcterms:issued": "2017-04-07T14:47+09:00",
  "dcterms:modified": "2017-06-01T15:24+09:00",
  "description": "Tablacus Explorer is a tabbled file manager. Tablacus Explorer contains a script injection vulnerability due to improper handling of directory names.\r\n\r\nTouma Hatano reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000058.html",
  "sec:cpe": {
    "#text": "cpe:/a:gaku:tablacus_explorer",
    "@product": "Tablacus Explorer",
    "@vendor": "Gaku",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "8.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000058",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN64451600/index.html",
      "@id": "JVN#64451600",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2140",
      "@id": "CVE-2017-2140",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2140",
      "@id": "CVE-2017-2140",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "Tablacus Explorer vulnerable to script injection"
}