PT-2016-4599

Name of the Vulnerable Software and Affected Versions KDDI HOME SPOT CUBE devices version 2 and earlier Description The issue allows remote authenticated users to execute arbitrary OS commands. Recommendations For versions prior to 2, update to version 2 or later to resolve the issue...

CVE-2016-1138: Undefined Security Weakness

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1144: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1139: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

PT-2016-4596

Name of the Vulnerable Software and Affected Versions KDDI HOME SPOT CUBE devices version 2 and earlier Description A CRLF injection issue allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. Recommendations For KDDI HOME SPOT CUBE devices version 2 and earlier, updat...

PT-2016-4598

Name of the Vulnerable Software and Affected Versions KDDI HOME SPOT CUBE devices versions prior to 2 Description The issue allows remote attackers to conduct clickjacking attacks via unspecified vectors. Recommendations For versions prior to 2, update to version 2 or later to resolve the issue...

CVE-2016-1136: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1137: Undefined Security Weakness

Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-1141: Improper Neutralization of Special Elements used in an OS Command

KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...

PT-2016-4595

Name of the Vulnerable Software and Affected Versions KDDI HOME SPOT CUBE versions prior to 2 Description The issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. This is achieved via unspecified vectors. Recommendations For versions pri...

PT-2016-4597

Name of the Vulnerable Software and Affected Versions KDDI HOME SPOT CUBE versions prior to 2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims via unknown vectors. Recommendations For versions prior to 2, update to version 2 or...

CVE-2016-1140: Undefined Security Weakness

KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors...

PT-2016-4602

Name of the Vulnerable Software and Affected Versions JOB-CUBE -JOB WEB SYSTEM versions prior to 1.2.2 -JOB WEB SYSTEM High Income versions prior to 1.0.6 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

JOB-CUBE vulnerable to cross-site scripting

Overview JOB-CUBE provided by WEBSQUARE Co.,Ltd. is software to build websites. JOB-CUBE contains a cross-site scripting vulnerability CWE-79. Masamu Asato of National institute of Technology,Okinawa College reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#26921563: JOB-CUBE vulnerable to cross-site scripting

JOB-CUBE provided by WEBSQUARE Co.,Ltd. is software to build websites. JOB-CUBE contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the administrator's web browser. Solution Update the Software Update to the latest version according to the informati...

HOME SPOT CUBE vulnerable to OS command injection

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains an OS command injection vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

HOME SPOT CUBE vulnerable to clickjacking

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a clickjacking vulnerabilitiy. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

HOME SPOT CUBE vulnerable to cross-site request forgery

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a cross-site request forgery vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warnin...

HOME SPOT CUBE vulnerable to HTTP header injection

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a HTTP header injection vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

HOME SPOT CUBE vulnerable to open redirect

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains an open redirect vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnershi...