JVN#54686544: HOME SPOT CUBE multiple vulnerabilities

HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains multiple vulnerabilities listed below. Cross-site scripting - CVE-2016-1136 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N| Base Score: 4.3 CVSS v2|...

Password Security — Who's to Blame for Weak Passwords? Users, Really?

The majority of Internet users are vulnerable to cyber threats because of their own weaknesses in setting up a strong password. But, are end-users completely responsible for choosing weak passwords? Give a thought. Recently we wrote an article revealing the list of Worst Passwords of 2015 that...

WEG SuperDrive G2 12.0.0 - Insecure File Permissions

WEG SuperDrive G2 12.0.0 - Insecure File Permissions WEG SuperDrive G2 v12.0.0 Insecure File Permissions Vendor: WEG Group Product web page: http://www.weg.net Affected version: SuperDrive G2 v12.0.0 Build 20150930-J1.8.060-NB8.0.2 SuperDrive v7.0.0 Summary: SuperDrive is a Windows graph tool for...

WEG SuperDrive G2 12.0.0 - Insecure File Permissions

Exploit for windows platform in category local exploits WEG SuperDrive G2 v12.0.0 Insecure File Permissions Vendor: WEG Group Product web page: http://www.weg.net Affected version: SuperDrive G2 v12.0.0 Build 20150930-J1.8.060-NB8.0.2 SuperDrive v7.0.0 Summary: SuperDrive is a Windows graph tool...

ntp: time alteration

If ntpd is always started with the -g option, which is common and against long-standing recommendation, and if at the moment ntpd is restarted an attacker can immediately respond to enough requests from enough sources trusted by the target, which is difficult and not common, there is a window of...

Adobe Flash - Use-After-Free When Setting Stage

Source: https://code.google.com/p/google-security-research/issues/detail?id=629 The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows. Proof of Concept:...

CVE-2015-6861

HPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote authenticated users to bypass an intended AssumeRole permission requirement and assume an IAM role by leveraging a policy setting for a user's account...

Arastta 1.1.5 - SQL Injection

Arastta 1.1.5 - SQL Injection Security Advisory - Curesec Research Team 1. Introduction Affected Product: Arastta 1.1.5 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://arastta.org/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 11/21/2015 Disclose...

Arastta 1.1.5 - SQL Injection

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Arastta 1.1.5 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://arastta.org/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 11/21/2015 Disclosed to public: 12/21/2015 Releas...

Arastta 1.1.5 - SQL Injection Vulnerability

Exploit for php platform in category web applications Security Advisory - Curesec Research Team 1. Introduction Affected Product: Arastta 1.1.5 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://arastta.org/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to...

Arastta 1.1.5 SQL Injection

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Arastta 1.1.5 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://arastta.org/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 11/21/2015 Disclosed to public: 12/21/2015 Releas...

User Picker Custom field HTML tags showing when creating new issues

h3. Summary Customer reported that when creating custom field User Picker and added html tags in description field, text link shows correctly in Custom Field screen under Administration Setting. However when creating new issues, the create issue form for User Picker field shows the HTML code not...

UBUNTU-CVE-2015-8213

The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...

CVE-2015-2924

The receivera function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery ND protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hoplimit value in a Router Advertisement RA message, a similar issue to CVE-2015-2922...

Mozilla Firefox Add-on SDK Cross-Site Scripting Vulnerability

Mozilla Firefox is an open source web browser. A cross-site scripting vulnerability exists in the Mozilla Firefox Add-on SDK due to a failure of the program to properly handle the 'script: false' panel setting, which allows remote attackers to conduct cross-site scripting attacks using inline...

CVE-2015-7187

The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via inline JavaScript code that is executed within a third-party extension...

CVE-2015-7187

The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via inline JavaScript code that is executed within a third-party extension...

CVE-2015-5212

Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...

HackerOne: HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com

The subdomain info.hackerone.com is vulnerable to HTTP header injection. I'm aware that you are only interested in critical issues affecting this subdomain. However, you may be interested in this issue as a vulnerability in this domain may affect the domain hackerone.com. The vulnerability is a...

MS15-111: Security Update for Windows Kernel to Address Elevation of Privilege (3096447)

The remote Windows host is affected by the following vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, via a specially crafted application, to execute...