Open redirect

Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1139

Cross-site request forgery CSRF vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-1137

The CVE-2016-1137 issue affects KDDI HOME SPOT CUBE (pre‑version 2) and is an open redirect vulnerability that could allow remote attackers to redirect users to arbitrary websites, enabling phishing. The available documents indicate the flaw exists in the device’s web interface, with attackers ab...

CVE-2016-1141

KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2016-1144

Cross-site scripting (CWE-79) vulnerability in WEBSQUARE JOB-CUBE -JOB WEB SYSTEM and -JOB WEB SYSTEM High Income. Affected versions include JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier. An attacker authenticated to the system could inject arbitrary web ...

CVE-2016-1144

Cross-site scripting XSS vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1136

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1137

Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-1140

CVE-2016-1140 affects KDDI HOME SPOT CUBE devices (pre‑version 2). The vulnerability is a clickjacking flaw exploitable remotely via unspecified vectors; exploitation details are not provided in the initial or connected documents. Affected product is a wireless router; impact noted includes poten...

CVE-2016-1139

The CVE-2016-1139 entry pertains to KDDI HOME SPOT CUBE devices prior to version 2, exposing a Cross-site Request Forgery (CSRF) vulnerability. The vulnerability enables remote attackers to hijack the victim’s authenticated session via unspecified vectors, with potential for unauthorized administ...

CVE-2016-1138

KDDI HOME SPOT CUBE devices prior to version 2 are affected by a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. This can enable HTTP header manipulation (including potential cookie value changes) and is associated with the HTTP ...

CVE-2016-1136

KDDI HOME SPOT CUBE devices before version 2 are affected by CVE-2016-1136, a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to the accompanying records, the impact includes partial integrit...

CVE-2016-1141

KDDI HOME SPOT CUBE devices are affected by CVE-2016-1141, an OS command injection vulnerability in the application layer that allows remote authenticated users to execute arbitrary OS commands with the privileges of the affected component. Connected sources (JVNDB-2016-000012, JVN #54686544) des...

CVE-2016-1140

KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

JOB-CUBE vulnerable to cross-site scripting

Overview JOB-CUBE provided by WEBSQUARE Co.,Ltd. is software to build websites. JOB-CUBE contains a cross-site scripting vulnerability CWE-79. Masamu Asato of National institute of Technology,Okinawa College reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#26921563: JOB-CUBE vulnerable to cross-site scripting

JOB-CUBE provided by WEBSQUARE Co.,Ltd. is software to build websites. JOB-CUBE contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the administrator's web browser. Solution Update the Software Update to the latest version according to the informati...

HOME SPOT CUBE vulnerable to OS command injection

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains an OS command injection vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

HOME SPOT CUBE vulnerable to clickjacking

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a clickjacking vulnerabilitiy. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...