Oracle Flex Cube Direct BA v10.5 - Cross Site Vulnerability

Document Title: =============== Oracle Flex Cube Direct BA v10.5 - Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2101 Release Date: ============= 2017-10-31 Vulnerability Laboratory ID VL-ID: ==================================...

iSmartAlarm cube Device Access Control Error Vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. An access control error vulnerability exists in the iSmartAlarm cube devices, where the vulnerable program passes a newly created key in plaintext. No details of the vulnerability are provided at this time...

iSmartAlarm cube Device Information Disclosure Vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. An information disclosure vulnerability exists in the iSmartAlarm cube devices. A remote attack could exploit this vulnerability to obtain arbitrary passwords or personal data...

iSmartAlarm cube device encryption issue vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. An authentication bypass vulnerability exists in iSmartAlarm cube devices. A remote attacker can exploit this vulnerability to execute commands...

iSmartAlarm cube device input validation vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. A denial of service vulnerability exists in iSmartAlarm cube devices. An attacker can exploit this vulnerability to cause a denial of service device stops responding...

iSmartAlarm CubeOne Remote Command Execution Exploit

iSmartAlarm CubeOne suffers from a remote command execution vulnerability that allows disabling the alarm and setting it off. + Credits: Ilia Shnaidman + @0x496c on Twitter + Source: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/...

Design/Logic Flaw

iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and it will stop responding...

Input validation

iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability...

CVE-2017-7729

CVE-2017-7729 concerns iSmartAlarm cube devices, where an incorrect access control vulnerability arises because a newly created key is transmitted in cleartext. The issue is documented with a network-attack surface and low attack complexity, resulting in a high impact on integrity (partial) per C...

CVE-2017-7726

CVE-2017-7726 affects iSmartAlarm cube devices. The vulnerability is a missing SSL certificate validation in the cube’s TLS connections to the backend (port 8443), enabling potential integrity impact due to untrusted server validation. References in connected records describe the SSL-validation w...

CVE-2017-7728

On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands e.g., setting the alarm on/off, related to incorrect cryptography...

CVE-2017-7730

The CVE-2017-7730 issue affects iSmartAlarm cube devices and describes a Denial of Service caused by a SYN flood to TCP port 12345, which can freeze the cube and render it unresponsive. Public details indicate an internal LAN attack vector (no user interaction required) with a low attack complexi...

CVE-2017-2185

HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI...

CVE-2017-2186

HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to bypass authentication to load malicious firmware via WebUI...

HOME SPOT CUBE2 vulnerable to buffer overflow in WebUI

Overview HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains buffer overflow in WebUI. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Earl...

cube.anker.eu XSS vulnerability

Vulnerable URL: https://cube.anker.eu/de Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check cube.anker.eu SSL connection:| Grade:...

CVE-2017-2117

Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors...

CVE-2017-2098

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-2090

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

emobility cube - BSD license, MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application emobility cube published at the 'play' market has multiple vulnerabilities...