CVE-2018-0685

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the Denbun POP version V3.3P R4.0 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via HTTP requests for mail search.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
NEOJAPAN Inc.	Denbun POP version V3.3P R4.0 and earlier	Denbun POP version V3.3P R4.0 and earlier

References

http://jvn.jp/en/jp/JVN00344155/index.htmlThird Party Advisory
https://www.denbun.com/en/imap/support/security/181003.htmlVendor Advisory
https://www.denbun.com/en/pop/support/security/181003.htmlVendor Advisory
http://jvn.jp/en/jp/JVN00344155/index.htmlThird Party Advisory
https://www.denbun.com/en/imap/support/security/181003.htmlVendor Advisory
https://www.denbun.com/en/pop/support/security/181003.htmlVendor Advisory

Timeline

Published: Nov 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-06868.8Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) allows remote authenticated CVE-2018-06876.1Cross-site scripting vulnerability in Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and CVE-2018-06886.1Open redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmwar CVE-2018-06898.8HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N CVE-2018-06907.5An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to t CVE-2018-06915.9Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7, Softbank +Message App for iOS prior to version 1.1.23, NT CVE-2018-06927.8Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan h CVE-2018-06937.5Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbitrary file in the specific directory CVE-2018-06949.8FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2018-06956.1Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web scr CVE-2018-06967.5OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the sec CVE-2018-06976.1Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via