CVE-2012-4011

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 8, 2012
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-40124.3The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, andCVE-2012-40134.3The WebView class in the Cybozu KUNAI Browser for Remote Service application beta for Android allows remote attackers to execute arbitrary JCVE-2012-40147.8Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unknCVE-2012-40154.3Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackersCVE-2012-40164.3The ATOK application before 1.0.4 for Android allows remote attackers to read the learning information file, and obtain sensitive input-striCVE-2012-40174.3The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class, which allows remote attackers to obtain CVE-2012-40184.3Cross-site scripting (XSS) vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web scCVE-2012-40194.3Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbitCVE-2012-40204.0MosP kintai kanri before 4.1.0 does not enforce privilege requirements, which allows remote authenticated users to read other users' informaCVE-2012-40215.5MosP kintai kanri before 4.1.0 does not properly perform authentication, which allows remote authenticated users to impersonate arbitrary usCVE-2012-40226.4Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment.CVE-2012-40234.3CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response split
CVE-2012-4011: Critical severity, CVSS 9.3 | Vulnix