Find a vulnerability

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-033235.html",
  "dc:date": "2026-09-29T12:18+09:00",
  "dcterms:issued": "2026-09-14T16:32+09:00",
  "dcterms:modified": "2026-09-29T12:18+09:00",
  "description": "CONPROSYS series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/548.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/1395.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2020-7746\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/434.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/787.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/352.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/256.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/121.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/522.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/95.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eCross-site scripting (CWE-79) - CVE-2026-82773, CVE-2026-82776, CVE-2026-82788\u003c/li\u003e\u003cli\u003eOS command injection (CWE-78) - CVE-2026-82774, CVE-2026-82777, CVE-2026-82779\u003c/li\u003e\u003cli\u003eExposure of information through directory listing (CWE-548) - CVE-2026-82775, CVE-2026-82778\u003c/li\u003e\u003cli\u003eDependency on vulnerable third-party component (CWE-1395)\u003c/li\u003e\u003cul\u003e\u003cli\u003eThis issue is caused by a vulnerability in chart.js (CVE-2020-7746).\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eUnrestricted upload of file with dangerous type (CWE-434) - CVE-2026-82780\u003c/li\u003e\u003cli\u003eCross-site scripting (CWE-79) - CVE-2026-82781\u003c/li\u003e\u003cli\u003eOut-of-bounds write (CWE-787) - CVE-2026-82782\u003c/li\u003e\u003cli\u003eCross-site request forgery (CWE-352) - CVE-2026-82764\u003c/li\u003e\u003cli\u003ePlaintext storage of a password (CWE-256) - CVE-2026-82783\u003c/li\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-82784\u003c/li\u003e\u003cli\u003eStack-based buffer overflow (CWE-121) - CVE-2026-82785\u003c/li\u003e\u003cli\u003eInsufficiently protected credentials (CWE-522) - CVE-2026-82786\u003c/li\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-82787\u003c/li\u003e\u003cli\u003eEval injection (CWE-95) - CVE-2026-82789\u003c/li\u003e\u003c/ul\u003eContec Co., Ltd. reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-033235.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:contec:conprosys_hmi_system",
      "@product": "CONPROSYS HMI System (CHS)",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:configurable_type_cps-pcs341_-ds1-120",
      "@product": "Configurable type CPS-PCS341[][]-DS1-1201",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:cps-tm341g5mb-adsc1-931",
      "@product": "CPS-TM341G5MB-ADSC1-931",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:cps-tm341gmb-adsc1-931",
      "@product": "CPS-TM341GMB-ADSC1-931",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:cps-tm341mb-adsc1-931",
      "@product": "CPS-TM341MB-ADSC1-931",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:cpsl-08p1en",
      "@product": "CPSL-08P1EN",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:cpsn-eob471ei-",
      "@product": "Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:cpsn-mcb271-",
      "@product": "Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:cpsn-pcb271-s1-041",
      "@product": "Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:integrated_type_cps-pc341_-9201",
      "@product": "Integrated Type CPS-PC341[][]-*-9201",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:m2m_controller_configurable_type_cps-mcs341",
      "@product": "M2M Controller Configurable type CPS-MCS341*",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:m2m_controller_integrated_type_cps-mc341",
      "@product": "M2M Controller Integrated Type CPS-MC341",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:m2m_gateway_configurable_type_cps-mgs341",
      "@product": "M2M Gateway Configurable type CPS-MGS341*",
      "@vendor": "Contec",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:contec:m2m_gateway_integrated_type_cps-mg341",
      "@product": "M2M Gateway Integrated Type CPS-MG341*",
      "@vendor": "Contec",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "6.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-033235",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU96551518/index.html",
      "@id": "JVNVU#96551518",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2020-7746",
      "@id": "CVE-2020-7746",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82764",
      "@id": "CVE-2026-82764",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82773",
      "@id": "CVE-2026-82773",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82774",
      "@id": "CVE-2026-82774",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82775",
      "@id": "CVE-2026-82775",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82776",
      "@id": "CVE-2026-82776",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82777",
      "@id": "CVE-2026-82777",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82778",
      "@id": "CVE-2026-82778",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82779",
      "@id": "CVE-2026-82779",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82780",
      "@id": "CVE-2026-82780",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82781",
      "@id": "CVE-2026-82781",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82782",
      "@id": "CVE-2026-82782",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82783",
      "@id": "CVE-2026-82783",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82784",
      "@id": "CVE-2026-82784",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82785",
      "@id": "CVE-2026-82785",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82786",
      "@id": "CVE-2026-82786",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82787",
      "@id": "CVE-2026-82787",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82788",
      "@id": "CVE-2026-82788",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-82789",
      "@id": "CVE-2026-82789",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/121.html",
      "@id": "CWE-121",
      "@title": "Stack-based Buffer Overflow(CWE-121)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1395.html",
      "@id": "CWE-1395",
      "@title": "Dependency on Vulnerable Third-Party Component(CWE-1395)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/256.html",
      "@id": "CWE-256",
      "@title": "Unprotected Storage of Credentials(CWE-256)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/306.html",
      "@id": "CWE-306",
      "@title": "Missing Authentication for Critical Function(CWE-306)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/434.html",
      "@id": "CWE-434",
      "@title": "Unrestricted Upload of File with Dangerous Type(CWE-434)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/522.html",
      "@id": "CWE-522",
      "@title": "Insufficiently Protected Credentials(CWE-522)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/548.html",
      "@id": "CWE-548",
      "@title": "Exposure of Information Through Directory Listing(CWE-548)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/787.html",
      "@id": "CWE-787",
      "@title": "Out-of-bounds Write(CWE-787)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/95.html",
      "@id": "CWE-95",
      "@title": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)(CWE-95)"
    }
  ],
  "title": "Multiple vulnerabilities in Contec CONPROSYS series"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-007754.html",
  "dc:date": "2025-07-02T11:31+09:00",
  "dcterms:issued": "2025-07-02T11:31+09:00",
  "dcterms:modified": "2025-07-02T11:31+09:00",
  "description": "CONPROSYS HMI System (CHS) provided by Contec Co.,Ltd. contains multiple vulnerabilities listed below.\r\n\r\n  * Reflected cross-site scripting (CWE-79) - CVE-2025-34080\r\n  * Insertion of sensitive information into debugging code (CWE-215) - CVE-2025-34081\r\n\r\nAlex Williams of Converge Technology Solutions reported these vulnerabilities to Vulncheck Inc., and\r\nVulncheck Inc. reported these vulnerabilities to the developer.\r\nBased on the coordination request made by the developer, JPCERT/CC coordinated with Vulncheck Inc. and the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-007754.html",
  "sec:cpe": {
    "#text": "cpe:/a:contec:conprosys_hmi_system",
    "@product": "CONPROSYS HMI System (CHS)",
    "@vendor": "Contec",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-007754",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU92266386/index.html",
      "@id": "JVNVU#92266386",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-34080",
      "@id": "CVE-2025-34080",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-34081",
      "@id": "CVE-2025-34081",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/215.html",
      "@id": "CWE-215",
      "@title": "Insertion of Sensitive Information Into Debugging Code(CWE-215)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in Contec CONPROSYS HMI System (CHS)"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-002002.html",
  "dc:date": "2024-03-19T18:13+09:00",
  "dcterms:issued": "2023-06-01T13:48+09:00",
  "dcterms:modified": "2024-03-19T18:13+09:00",
  "description": "CONPROSYS HMI System (CHS) provided by Contec Co., Ltd. contains multiple vulnerabilities listed below.\r\n\r\n* Plaintext storage of a password (CWE-256) - CVE-2023-28713\r\n* Incorrect permission assignment for critical resource (CWE-732) - CVE-2023-28399\r\n* Improper access control (CWE-284) - CVE-2023-28657\r\n* Cross-site scripting (CWE-79) - CVE-2023-28651\r\n* Server-side request forgery (CWE-918)- CVE-2023-28824\r\n* SQL injection (CWE-89) - CVE-2023-29154\r\n* Improper control of interaction frequency (CWE-799) - CVE-2023-2758\r\n\r\nMichael Heinzl reported the vulnerabilities listed below to JPCERT/CC, and JPCERT/CC coordinated with the developer.\r\nCVE-2023-28713, CVE-2023-28399, CVE-2023-28657, CVE-2023-28651, CVE-2023-28824, CVE-2023-29154\r\n\r\nTenable, Inc. reported CVE-2023-2758 vulnerability to the developer, and based on the coordination request made by the developer, JPCERT/CC coordinated with Tenable, Inc. and the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-002002.html",
  "sec:cpe": {
    "#text": "cpe:/a:contec:conprosys_hmi_system",
    "@product": "CONPROSYS HMI System (CHS)",
    "@vendor": "Contec",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2023-002002",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93372935/index.html",
      "@id": "JVNVU#93372935",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-28713",
      "@id": "CVE-2023-28713",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-28399",
      "@id": "CVE-2023-28399",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-28657",
      "@id": "CVE-2023-28657",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-28651",
      "@id": "CVE-2023-28651",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-28824",
      "@id": "CVE-2023-28824",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-29154",
      "@id": "CVE-2023-29154",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-2758",
      "@id": "CVE-2023-2758",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-2758",
      "@id": "CVE-2023-2758",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-28399",
      "@id": "CVE-2023-28399",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-28651",
      "@id": "CVE-2023-28651",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-28657",
      "@id": "CVE-2023-28657",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-28713",
      "@id": "CVE-2023-28713",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-28824",
      "@id": "CVE-2023-28824",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-29154",
      "@id": "CVE-2023-29154",
      "@source": "NVD"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/256.html",
      "@id": "CWE-256",
      "@title": "Unprotected Storage of Credentials(CWE-256)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/284.html",
      "@id": "CWE-284",
      "@title": "Improper Access Control(CWE-284)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/732.html",
      "@id": "CWE-732",
      "@title": "Incorrect Permission Assignment for Critical Resource(CWE-732)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/799.html",
      "@id": "CWE-799",
      "@title": "Improper Control of Interaction Frequency(CWE-799)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/918.html",
      "@id": "CWE-918",
      "@title": "Server-Side Request Forgery (SSRF)(CWE-918)"
    }
  ],
  "title": "Multiple vulnerabilities in Contec CONPROSYS HMI System (CHS)"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-001400.html",
  "dc:date": "2023-04-03T16:19+09:00",
  "dcterms:issued": "2023-04-03T16:19+09:00",
  "dcterms:modified": "2023-04-03T16:19+09:00",
  "description": "CONPROSYS HMI System(CHS) provided by Contec Co., Ltd. contains an SQL injection vulnerability (CWE-89, CVE-2023-1658).\r\n\r\nTenable Network Security reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the reporter and the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-001400.html",
  "sec:cpe": {
    "#text": "cpe:/a:contec:conprosys_hmi_system",
    "@product": "CONPROSYS HMI System (CHS)",
    "@vendor": "Contec",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2023-001400",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU92145493/index.html",
      "@id": "JVNVU#92145493",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-1658",
      "@id": "CVE-2023-1658",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "CONPROSYS HMI System(CHS) vulnerable to SQL injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-001108.html",
  "dc:date": "2023-01-24T13:38+09:00",
  "dcterms:issued": "2023-01-24T13:38+09:00",
  "dcterms:modified": "2023-01-24T13:38+09:00",
  "description": "CONPROSYS HMI System (CHS) provided by CONTEC CO.,LTD. contains multiple SQL injection vulnerabilities (CWE-89).\r\n\r\nMosin from ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc., reported these vulnerabilities to Contec Co., Ltd.\r\nContec Co., Ltd. reported the issues to JPCERT/CC in order to notify the solutions to the users through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-001108.html",
  "sec:cpe": {
    "#text": "cpe:/a:contec:conprosys_hmi_system",
    "@product": "CONPROSYS HMI System (CHS)",
    "@vendor": "Contec",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2023-001108",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU97195023/index.html",
      "@id": "JVNVU#97195023",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22324",
      "@id": "CVE-2023-22324",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22324",
      "@id": "CVE-2023-22324",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "Contec CONPROSYS HMI System (CHS) vulnerable to multiple SQL injections"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-002779.html",
  "dc:date": "2023-01-11T16:55+09:00",
  "dcterms:issued": "2022-12-16T13:29+09:00",
  "dcterms:modified": "2023-01-11T16:55+09:00",
  "description": "CONPROSYS HMI System (CHS) provided by Contec Co., Ltd. contains multiple vulnerabilities listed below.\r\n \r\n  * OS Command Injection (CWE-78) - CVE-2022-44456\r\n  * Use of Default Credentials (CWE-1392) - CVE-2023-22331\r\n  * Use of Password Hash Instead of Password for Authentication (CWE-836) - CVE-2023-22334\r\n  * Cross-site Scripting (CWE-79) - CVE-2023-22373\r\n  * Improper Access Control (CWE-284) - CVE-2023-22339\r\n\r\nFloris Hendriks and Jeroen Wijenbergh of Radboud University reported these vulnerabilities to Contec Co., Ltd. and coordinated. Contec Co., Ltd. and JPCERT/CC published respective advisories in order to notify users of its solution.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-002779.html",
  "sec:cpe": {
    "#text": "cpe:/a:contec:conprosys_hmi_system",
    "@product": "CONPROSYS HMI System (CHS)",
    "@vendor": "Contec",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "10.0",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2022-002779",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU96873821/index.html",
      "@id": "JVNVU#96873821",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-44456",
      "@id": "CVE-2022-44456",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22331",
      "@id": "CVE-2023-22331",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22334",
      "@id": "CVE-2023-22334",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22373",
      "@id": "CVE-2023-22373",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22339",
      "@id": "CVE-2023-22339",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-44456",
      "@id": "CVE-2022-44456",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22331",
      "@id": "CVE-2023-22331",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22334",
      "@id": "CVE-2023-22334",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22339",
      "@id": "CVE-2023-22339",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22373",
      "@id": "CVE-2023-22373",
      "@source": "NVD"
    },
    {
      "#text": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-03",
      "@id": "ICSA-22-347-03",
      "@source": "ICS-CERT ADVISORY"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/836.html",
      "@id": "CWE-836",
      "@title": "Use of Password Hash Instead of Password for Authentication(CWE-836)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/284.html",
      "@id": "CWE-284",
      "@title": "Improper Access Control(CWE-284)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1392.html",
      "@id": "CWE-1392",
      "@title": "Use of Default Credentials(CWE-1392)"
    }
  ],
  "title": "Multiple vulnerabilities in Contec CONPROSYS HMI System (CHS)"
}