First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2012-4009

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Aug 31, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-40105.0Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE CVE-2012-40119.3The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive inform CVE-2012-40124.3The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and CVE-2012-40134.3The WebView class in the Cybozu KUNAI Browser for Remote Service application beta for Android allows remote attackers to execute arbitrary J CVE-2012-40147.8Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unkn CVE-2012-40154.3Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers CVE-2012-40164.3The ATOK application before 1.0.4 for Android allows remote attackers to read the learning information file, and obtain sensitive input-stri CVE-2012-40174.3The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class, which allows remote attackers to obtain CVE-2012-40184.3Cross-site scripting (XSS) vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web sc CVE-2012-40194.3Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbit CVE-2012-40204.0MosP kintai kanri before 4.1.0 does not enforce privilege requirements, which allows remote authenticated users to read other users' informa CVE-2012-40215.5MosP kintai kanri before 4.1.0 does not properly perform authentication, which allows remote authenticated users to impersonate arbitrary us

CVE-2012-4009: Medium severity, CVSS 6.8 | Vulnix