Code injection

KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors...

Open redirect

Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Crlf injection

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1137

The CVE-2016-1137 issue affects KDDI HOME SPOT CUBE (pre‑version 2) and is an open redirect vulnerability that could allow remote attackers to redirect users to arbitrary websites, enabling phishing. The available documents indicate the flaw exists in the device’s web interface, with attackers ab...

CVE-2016-1138

KDDI HOME SPOT CUBE devices prior to version 2 are affected by a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. This can enable HTTP header manipulation (including potential cookie value changes) and is associated with the HTTP ...

CVE-2016-1141

KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2016-1137

Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-1139

Cross-site request forgery CSRF vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-1140

CVE-2016-1140 affects KDDI HOME SPOT CUBE devices (pre‑version 2). The vulnerability is a clickjacking flaw exploitable remotely via unspecified vectors; exploitation details are not provided in the initial or connected documents. Affected product is a wireless router; impact noted includes poten...

CVE-2016-1139

The CVE-2016-1139 entry pertains to KDDI HOME SPOT CUBE devices prior to version 2, exposing a Cross-site Request Forgery (CSRF) vulnerability. The vulnerability enables remote attackers to hijack the victim’s authenticated session via unspecified vectors, with potential for unauthorized administ...

CVE-2016-1136

KDDI HOME SPOT CUBE devices before version 2 are affected by CVE-2016-1136, a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to the accompanying records, the impact includes partial integrit...

CVE-2016-1141

KDDI HOME SPOT CUBE devices are affected by CVE-2016-1141, an OS command injection vulnerability in the application layer that allows remote authenticated users to execute arbitrary OS commands with the privileges of the affected component. Connected sources (JVNDB-2016-000012, JVN #54686544) des...

CVE-2016-1140

KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1136

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

HOME SPOT CUBE vulnerable to OS command injection

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains an OS command injection vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

HOME SPOT CUBE vulnerable to clickjacking

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a clickjacking vulnerabilitiy. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

HOME SPOT CUBE vulnerable to cross-site request forgery

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a cross-site request forgery vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warnin...

HOME SPOT CUBE vulnerable to HTTP header injection

Overview HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a HTTP header injection vulnerability. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...