jvndb - jvndb-2026-000059

jvndb-2026-000059

Vulnerability from jvndb

Published

2026-04-23 16:57

Modified

2026-04-23 16:57

Severity ?

8.8 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in LogonTracer

Details

LogonTracer provided by Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) is a tool to investigate malicious Windows logons by visualizing and analyzing Windows event logs. LogonTracer contains multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/943.html' target='_blank'></a><ul><li>OS command injection (CWE-78) - CVE-2026-33277</li><li>Improper neutralization of special elements in data query logic (CWE-943) - CVE-2026-33566</li></ul>Yuki Matsuhashi reported these vulnerabilities to IPA. JPCERT/CC coordinated internally under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN57877356/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-33277
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-33566
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

JPCERT Coordination Center

LogonTracer

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000059.html",
  "dc:date": "2026-04-23T16:57+09:00",
  "dcterms:issued": "2026-04-23T16:57+09:00",
  "dcterms:modified": "2026-04-23T16:57+09:00",
  "description": "LogonTracer provided by Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) is a tool to investigate malicious Windows logons by visualizing and analyzing Windows event logs.\r\nLogonTracer contains multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/943.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eOS command injection (CWE-78) - CVE-2026-33277\u003c/li\u003e\u003cli\u003eImproper neutralization of special elements in data query logic (CWE-943) - CVE-2026-33566\u003c/li\u003e\u003c/ul\u003eYuki Matsuhashi reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated internally under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000059.html",
  "sec:cpe": {
    "#text": "cpe:/a:jpcert:logontracer",
    "@product": "LogonTracer",
    "@vendor": "JPCERT Coordination Center",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000059",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN57877356/index.html",
      "@id": "JVN#57877356",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-33277",
      "@id": "CVE-2026-33277",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-33566",
      "@id": "CVE-2026-33566",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in LogonTracer"
}

CVE-2026-33277 (GCVE-0-2026-33277)

Vulnerability from cvelistv5

Published

2026-04-27 00:03

Modified

2026-04-27 15:32

Severity ?

8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Summary

An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user.

References

URL

Tags

	https://www.jpcert.or.jp/press/2026/PR20260423.html
	https://jvn.jp/en/jp/JVN57877356/

Impacted products

	Vendor	Product	Version
	Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)	LogonTracer	Version: prior to v2.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33277",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T15:24:12.890674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T15:32:02.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LogonTracer",
          "vendor": "Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v2.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T00:03:41.704Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.jpcert.or.jp/press/2026/PR20260423.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN57877356/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-33277",
    "datePublished": "2026-04-27T00:03:41.704Z",
    "dateReserved": "2026-04-21T23:51:22.704Z",
    "dateUpdated": "2026-04-27T15:32:02.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33566 (GCVE-0-2026-33566)

Vulnerability from cvelistv5

Published

2026-04-27 00:04

Modified

2026-04-27 15:23

Severity ?

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Summary

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered.

References

URL

Tags

	https://www.jpcert.or.jp/press/2026/PR20260423.html
	https://jvn.jp/en/jp/JVN57877356/

Impacted products

	Vendor	Product	Version
	Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)	LogonTracer	Version: prior to v2.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33566",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T15:16:26.565725Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T15:23:56.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LogonTracer",
          "vendor": "Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v2.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T00:04:23.709Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.jpcert.or.jp/press/2026/PR20260423.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN57877356/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-33566",
    "datePublished": "2026-04-27T00:04:23.709Z",
    "dateReserved": "2026-04-21T23:50:58.926Z",
    "dateUpdated": "2026-04-27T15:23:56.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2026-000059

Vulnerability from jvndb

CVE-2026-33277 (GCVE-0-2026-33277)

Vulnerability from cvelistv5

CVE-2026-33566 (GCVE-0-2026-33566)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature