CVE-2016-1140

CVE-2016-1140 affects KDDI HOME SPOT CUBE devices (pre‑version 2). The vulnerability is a clickjacking flaw exploitable remotely via unspecified vectors; exploitation details are not provided in the initial or connected documents. Affected product is a wireless router; impact noted includes poten...

CVE-2016-1139

The CVE-2016-1139 entry pertains to KDDI HOME SPOT CUBE devices prior to version 2, exposing a Cross-site Request Forgery (CSRF) vulnerability. The vulnerability enables remote attackers to hijack the victim’s authenticated session via unspecified vectors, with potential for unauthorized administ...

CVE-2016-1136

KDDI HOME SPOT CUBE devices before version 2 are affected by CVE-2016-1136, a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to the accompanying records, the impact includes partial integrit...

CVE-2016-1141

KDDI HOME SPOT CUBE devices are affected by CVE-2016-1141, an OS command injection vulnerability in the application layer that allows remote authenticated users to execute arbitrary OS commands with the privileges of the affected component. Connected sources (JVNDB-2016-000012, JVN #54686544) des...

CVE-2016-1140

KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1136

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

HOME SPOT CUBE vulnerable to cross-site request forgery

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a cross-site request forgery vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warnin...

CVE-2012-4006

The GREE application before 1.4.0, GREE Tanken Dorirando application before 1.0.7, GREE Tsurisuta application before 1.5.0, GREE Monpura application before 1.1.1, GREE Kaizokuoukoku Columbus application before 1.3.5, GREE haconiwa application before 1.1.0, GREE Seisen Cerberus application before...

Website connection problem when a mobile phone terminal uses specific QR code

Overview Mobile phone terminals supporting the two-dimensional code QR code read function are reported to have a website connection problem. When specific QR code is read, even if a user tries to connect to the URL string in the first line of the two URL lines displayed, the connection is...

Problem with referer header handling on mobile phone web browsers

Overview We have confirmed that web browser products from Openwave Systems Inc. used for the Internet connection service for mobile phones have a problem in its function of sending referer information under certain circumstances. This problem has been reported for KDDI's au mobile phones. KDDI,...

KDDI sample CGI download program directory traversal vulnerability

Overview A directory traversal vulnerability exists in a sample CGI download program included with KDDI's EZFactory. A sample CGI download program is included with KDDI's EZFactory for downloading and saving data such as images and ringtones to EZweb compatible cellular phones. A directory...

CVE-2007-3692

Directory traversal vulnerability in download.cgi in EZFactory KDDI Download CGI 1.x allows remote attackers to read and download arbitrary files via a .. dot dot in the name parameter...

Directory traversal

Directory traversal vulnerability in download.cgi in EZFactory KDDI Download CGI 1.x allows remote attackers to read and download arbitrary files via a .. dot dot in the name parameter...

CVE-2007-3692

Directory traversal vulnerability in download.cgi in EZFactory KDDI Download CGI 1.x allows remote attackers to read and download arbitrary files via a .. dot dot in the name parameter...

CVE-2007-3692

The CVE-2007-3692 issue concerns EZFactory KDDI Download CGI 1.x, where the download.cgi component is vulnerable to a directory traversal via the name parameter containing .., enabling remote attackers to read/download arbitrary server files. The JVN entry for KDDI’s EZFactory sample CGI download...

JVN#33593387 KDDI sample CGI download program directory traversal vulnerability

A sample CGI download program is included with KDDI's EZFactory for downloading and saving data such as images and ringtones to EZweb compatible cellular phones. A directory traversal vulnerability exists in this program. Impact A remote anauthenticated attacker could access files on the server...

Gracenote CDDB ActiveX control buffer overflow

Overview The Gracenote CDDB ActiveX control contains a buffer overflow vulnerability, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description CDDB CDDB CD Data Base is an internet database provided by Gracenote. CDDB contains track lists and other informati...