CVE-2016-4896

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via unspecified vectors.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN80157683/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000201.htmlVDB Entry
http://www.securityfocus.com/bid/93475Third Party Advisory, VDB Entry
http://jvn.jp/en/jp/JVN80157683/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000201.htmlVDB Entry
http://www.securityfocus.com/bid/93475Third Party Advisory, VDB Entry

Timeline

Published: Apr 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-48976.1Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin befo CVE-2016-48989.8The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec CVE-2016-48999.8The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec CVE-2016-49007.8Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan ho CVE-2016-49017.8Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan CVE-2016-49027.8Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)"CVE-2016-49036.1Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attacke CVE-2016-49048.8Cross-site request forgery (CSRF) vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows r CVE-2016-49059.8SQL injection vulnerability in the WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows attackers with ad CVE-2016-49066.1Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messa CVE-2016-49078.8Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.CVE-2016-49084.3Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RS