Search

Find a vulnerability

Search criteria

    3 vulnerabilities found for Android App "Myna Point" by Digital Agency

    JVNDB-2026-000123

    Vulnerability from jvndb - Published: 2026-08-26 05:42 - Updated:2026-08-26 05:42
    Severity
    5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    Summary
    Android App "Myna Point" vulnerable to improper access restriction
    Details
    Android App "Myna Point" provided by Digital Agency contains the following vulnerability.
    • Improper Authorization in Handler for Custom URL Scheme (CWE-939) - CVE-2026-73335
    RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and IPA. JPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.
    References
    Impacted products
    Show details on JVN DB website
    To clipboard 

    {
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000123.html",
  "dc:date": "2026-08-26T14:42+09:00",
  "dcterms:issued": "2026-08-26T14:42+09:00",
  "dcterms:modified": "2026-08-26T14:42+09:00",
  "description": "Android App \"Myna Point\" provided by Digital Agency contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/939.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eImproper Authorization in Handler for Custom URL Scheme (CWE-939) - CVE-2026-73335\u003c/li\u003e\u003c/ul\u003eRyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and IPA.\r\nJPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000123.html",
  "sec:cpe": {
    "#text": "cpe:/a:e-gov:myna_point_app_for_android",
    "@product": "Android App \"Myna Point\"",
    "@vendor": "Digital Agency",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000123",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN67155805/index.html",
      "@id": "JVN#67155805",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-73335",
      "@id": "CVE-2026-73335",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Android App \"Myna Point\" vulnerable to improper access restriction"
}

    CVE-2026-73335 (GCVE-0-2026-73335)

    Vulnerability from nvd – Published: 2026-08-26 04:54 – Updated: 2026-08-26 14:09
    VLAI
    Summary
    Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
    Severity
    5.3 (Medium)
    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    4.6 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 14:09 UTC
    CWE
    • CWE-939 - Improper authorization in handler for custom URL scheme
    Assigner
    References
    Impacted products
    Vendor Product Version
    Digital Agency Android App "Myna Point" Affected: 0 , ≤ 2.0.6 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73335",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T14:09:19.310249Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T14:09:26.006Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Android App \"Myna Point\"",
          "vendor": "Digital Agency",
          "versions": [
            {
              "lessThanOrEqual": "2.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Android application \"Myna Point\" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user\u0027s Android device may exploit the affected application\u0027s functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper authorization in handler for custom URL scheme",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T04:54:58.950Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://play.google.com/store/apps/details?id=jp.go.soumu.mkpf.mkpfmypage\u0026hl"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN67155805/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-73335",
    "datePublished": "2026-08-26T04:54:58.950Z",
    "dateReserved": "2026-08-12T06:01:54.985Z",
    "dateUpdated": "2026-08-26T14:09:26.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73335 (GCVE-0-2026-73335)

    Vulnerability from cvelistv5 – Published: 2026-08-26 04:54 – Updated: 2026-08-26 14:09
    VLAI
    Summary
    Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
    Severity
    5.3 (Medium)
    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    4.6 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-26 14:09 UTC
    CWE
    • CWE-939 - Improper authorization in handler for custom URL scheme
    Assigner
    References
    Impacted products
    Vendor Product Version
    Digital Agency Android App "Myna Point" Affected: 0 , ≤ 2.0.6 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73335",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T14:09:19.310249Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T14:09:26.006Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Android App \"Myna Point\"",
          "vendor": "Digital Agency",
          "versions": [
            {
              "lessThanOrEqual": "2.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Android application \"Myna Point\" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user\u0027s Android device may exploit the affected application\u0027s functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper authorization in handler for custom URL scheme",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T04:54:58.950Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://play.google.com/store/apps/details?id=jp.go.soumu.mkpf.mkpfmypage\u0026hl"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN67155805/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-73335",
    "datePublished": "2026-08-26T04:54:58.950Z",
    "dateReserved": "2026-08-12T06:01:54.985Z",
    "dateUpdated": "2026-08-26T14:09:26.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}