KDDI HOME SPOT CUBE2 Security Vulnerability

KDDI HOME SPOT CUBE2 is a home wireless router from KDDI Japan. A security vulnerability exists in KDDI HOME SPOT CUBE2 version V102 and prior versions. An attacker can exploit the vulnerability to remotely execute code...

KDDI HOME SPOT CUBE2 Security Vulnerability

KDDI HOME SPOT CUBE2 is a home wireless router from KDDI Japan. A security vulnerability exists in KDDI HOME SPOT CUBE2 version V102 and prior versions. An attacker has exploited the vulnerability to cause a denial of service on the system...

CVE-2023-50096

STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeAReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications 1.2.0, and thus c...

Buffer overflow

STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeAReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications 1.2.0, and thus c...

CVE-2023-50096

STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeAReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications 1.2.0, and thus c...

PT-2024-13860 · Stmicroelectronics · Stsafe-A1Xx +1

Name of the Vulnerable Software and Affected Versions: STMicroelectronics STSAFE-A1xx versions prior to 3.3.7 X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications version 1.2.0 Description: The issue allows MCU code execution if an adversary has the ability to read from and write to th...

CVE-2023-50096

STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeAReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications 1.2.0, and thus c...

CVE-2023-50096

STMicroelectronics STSAFE-A1xx middleware (versions prior to 3.3.7) is affected by a buffer overflow in StSafeA_ReceiveBytes within the X-CUBE-SAFEA1 sample package (1.2.0), enabling MCU code execution if an attacker can read/write on the I2C bus. The issue affects user-written code derived from ...

Cube API denial of service attack

Impact It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. Patches The issue has been patched in the v0.34.34 and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent...

@codefresh-io/cubejs-backend-server-core (>=0.30.77 <=0.30.83), @cubejs-backend-json-clone/server (=1.0.0) +16 more potentially affected by CVE-2023-50709 via @cubejs-backend/api-gateway (>=0.0.18 <=0.33.65)

@cubejs-backend/api-gateway NPM version =0.0.18, =0.30.77, =0.0.8, =0.0.7, =0.0.24, =0.10.0, =0.10.0, =0.32.28, =0.29.4, =1.0.0, =0.27.30, =0.30.61, =0.32.0, =0.33.8 and more Source cves: CVE-2023-50709 Source advisory: OSV:GHSA-9759-3276-G2PM...

GHSA-9759-3276-G2PM Cube API denial of service attack

Impact It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. Patches The issue has been patched in the v0.34.34 and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent...

CVE-2023-50709

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in v0.34.34 and it's recommended that all users exposing Cube APIs...

CVE-2023-50709 Denial of service attack on the cube-api endpoint

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in v0.34.34 and it's recommended that all users exposing Cube APIs...

CVE-2023-50709

CVE-2023-50709 affects Cube.js: prior to v0.34.34, a specially crafted request to a Cube API endpoint can render the entire Cube API unavailable (DoS). Root cause is a vulnerability in the Cube API endpoint handling that allows service disruption. The issue has been patched in v0.34.34; upgrade t...

CVE-2023-50709 Denial of service attack on the cube-api endpoint

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in v0.34.34 and it's recommended that all users exposing Cube APIs...

CVE-2023-50709 Denial of service attack on the cube-api endpoint

Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in v0.34.34 and it's recommended that all users exposing Cube APIs...

PT-2023-31615 · Cube · Cube

Name of the Vulnerable Software and Affected Versions: Cube versions prior to 0.34.34 Description: The issue allows an attacker to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The problem has been patched in version 0.34.34. It is...

Apache Kylin 2.3.x < 2.3.3 / 2.4.x < 2.4.2 / 2.5.x < 2.5.3 / 2.6.x < 2.6.6 / 3.x < 3.0.2 Command Injection (CVE-2020-1956)

The instance of Apache Kylin running on the remote host is 2.3.x prior to 2.3.3, 2.4.x prior to 2.4.2, 2.5.x prior to 2.5.3, 2.6.x prior to 2.6.6 or 3.x prior to 3.0.2. Therefore, it is affected by a command injection vulnerability due to some restful APIs concatenating OS commands with user inpu...

cube-homes.com Improper Access Control vulnerability OBB-3796526

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-46845

EC-CUBE 3 series 3.0.0 to 3.0.18-p6 and 4 series 4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2 contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where...