Code injection

KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Crlf injection

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

Design/Logic Flaw

KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2016-1136

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1137

Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1139

Cross-site request forgery CSRF vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-1140

KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-1141

KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2016-1144

Cross-site scripting XSS vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1136

KDDI HOME SPOT CUBE devices before version 2 are affected by CVE-2016-1136, a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to the accompanying records, the impact includes partial integrit...

CVE-2016-1137

The CVE-2016-1137 issue affects KDDI HOME SPOT CUBE (pre‑version 2) and is an open redirect vulnerability that could allow remote attackers to redirect users to arbitrary websites, enabling phishing. The available documents indicate the flaw exists in the device’s web interface, with attackers ab...

CVE-2016-1138

KDDI HOME SPOT CUBE devices prior to version 2 are affected by a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. This can enable HTTP header manipulation (including potential cookie value changes) and is associated with the HTTP ...

CVE-2016-1139

The CVE-2016-1139 entry pertains to KDDI HOME SPOT CUBE devices prior to version 2, exposing a Cross-site Request Forgery (CSRF) vulnerability. The vulnerability enables remote attackers to hijack the victim’s authenticated session via unspecified vectors, with potential for unauthorized administ...

CVE-2016-1140

CVE-2016-1140 affects KDDI HOME SPOT CUBE devices (pre‑version 2). The vulnerability is a clickjacking flaw exploitable remotely via unspecified vectors; exploitation details are not provided in the initial or connected documents. Affected product is a wireless router; impact noted includes poten...

CVE-2016-1141

KDDI HOME SPOT CUBE devices are affected by CVE-2016-1141, an OS command injection vulnerability in the application layer that allows remote authenticated users to execute arbitrary OS commands with the privileges of the affected component. Connected sources (JVNDB-2016-000012, JVN #54686544) des...

CVE-2016-1144

Cross-site scripting (CWE-79) vulnerability in WEBSQUARE JOB-CUBE -JOB WEB SYSTEM and -JOB WEB SYSTEM High Income. Affected versions include JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier. An attacker authenticated to the system could inject arbitrary web ...

CVE-2016-1137: Undefined Security Weakness

Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-1136: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...