CVE-2021-33394

Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker...

CVE-2020-24395

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

CVE-2020-24396

homee Brain Cube v2 2.28.2 and 2.28.4 devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy...

CVE-2020-24396

homee Brain Cube v2 2.28.2 and 2.28.4 devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy...

CVE-2020-24395

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

Input validation

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

Hardcoded credentials

homee Brain Cube v2 2.28.2 and 2.28.4 devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy...

CVE-2020-24395

The CVE-2020-24395 issue affects homee Brain Cube v2 (firmware versions 2.28.2 and 2.28.4). Affected component: USB firmware update script. Root cause: insufficient validation of the firmware image file, enabling an attacker with physical access to install compromised firmware and potentially ach...

CVE-2020-24395

The USB firmware update script of homee Brain Cube v2 2.28.2 and 2.28.4 devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device...

CVE-2020-24396

CVE-2020-24396 affects homee Brain Cube v2 (firmware 2.28.2 and 2.28.4). The issue is that sensitive SSH keys are stored within downloadable and unencrypted firmware images, enabling remote attackers to use the support server as a SOCKS proxy. Documented impact is exposure of credentials and pote...

CVE-2020-24396

homee Brain Cube v2 2.28.2 and 2.28.4 devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy...

Homee Brain Cube 数据伪造问题漏洞

Homee Brain Cube is a smart home central control unit from Homee, Germany. A security vulnerability exists in the homee Brain Cube v2, which stems from insufficient validation of the firmware image file and could lead to code execution on the device...

Homee Brain Cube 安全漏洞

Homee Brain Cube is a smart home central control unit from Homee, Germany. A security vulnerability exists in homee Brain Cube v2, which allows remote attackers to exploit the vulnerability to use the support server as a SOCKS proxy...

PT-2021-11032 · Homee · Homee Brain Cube

Name of the Vulnerable Software and Affected Versions: homee Brain Cube v2 versions 2.28.2 through 2.28.4 Description: The issue allows remote attackers to use the support server as a SOCKS proxy due to sensitive SSH keys being present within downloadable and unencrypted firmware images...

EC-CUBE cross-site scripting vulnerability (CNVD-2021-34683)

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in EC-CUBE versions 4.0.0 through 4.0.5. The vulnerability stems from a program that allows remote attackers to inject specially crafted script into specific input fields of E...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

Cross site scripting

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

CVE-2021-20717 affects EC-CUBE 4.0.0–4.0.5. The vulnerability is a Cross-site Scripting (CWE-79) in input handling on EC‑built sites, allowing a remote attacker to inject a crafted script that can execute in an administrator’s browser. The root cause is an input field within EC‑Cube’s web pages t...