Find a vulnerability

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000069.html",
  "dc:date": "2026-05-13T15:41+09:00",
  "dcterms:issued": "2026-05-13T15:41+09:00",
  "dcterms:modified": "2026-05-13T15:41+09:00",
  "description": "Android App \"Anshin Filter for au\" provided by KDDI CORPORATION contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/319.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eCleartext transmission of sensitive information (CWE-319) - CVE-2026-41281\u003c/li\u003e\u003c/ul\u003e",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000069.html",
  "sec:cpe": {
    "#text": "cpe:/a:kddi:anshin_filter_for_au_for_android",
    "@product": "Android App \"Anshin Filter for au\"",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.8",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000069",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN24167657/index.html",
      "@id": "JVN#24167657",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-41281",
      "@id": "CVE-2026-41281",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Android App \"Anshin Filter for au\" vulnerable to cleartext transmission of sensitive information"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
  "dc:date": "2026-03-25T18:41+09:00",
  "dcterms:issued": "2026-03-25T18:41+09:00",
  "dcterms:modified": "2026-03-25T18:41+09:00",
  "description": "SHARP routers do not perform authentication for some web APIs.\r\nThose web APIs provide device information, and the initial administrative password is based on a part of the device information.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-32326\u003c/li\u003e\u003c/ul\u003eShota Zaizen reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:kddi:speed_wi-fi_5g_x01",
      "@product": "Speed Wi-Fi 5G X01",
      "@vendor": "KDDI",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:home_5g_hr01",
      "@product": "home 5G HR01",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:home_5g_hr02",
      "@product": "home 5G HR02",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52a_firmware",
      "@product": "Wi-Fi STATION SH-52A",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52b_firmware",
      "@product": "Wi-Fi STATION SH-52B",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-54c_firmware",
      "@product": "Wi-Fi STATION SH-54C",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:softbank:5gmobile_wi-fi_router_sh-u01",
      "@product": "5G Mobile Router SH-U01",
      "@vendor": "SoftBank",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:softbank:pocket_wifi_5g_a503sh",
      "@product": "Pocket WiFi 5G A503SH versions",
      "@vendor": "SoftBank",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "5.7",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000043",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN49524110/index.html",
      "@id": "JVN#49524110",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-32326",
      "@id": "CVE-2026-32326",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "SHARP routers missing authentication for some web APIs"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000097.html",
  "dc:date": "2025-11-17T14:09+09:00",
  "dcterms:issued": "2025-11-17T14:09+09:00",
  "dcterms:modified": "2025-11-17T14:09+09:00",
  "description": "\"Dejira\" App for iOS provided by KDDI CORPORATION contains the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eImproper server certificate verification (CWE-295)\u003c/li\u003e\u003c/ul\u003e\r\nTsuyoshi Ogawa of SIE Co.,Ltd reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000097.html",
  "sec:cpe": {
    "#text": "cpe:/a:kddi:dejira_app",
    "@product": "\"Dejira\" App for iOS",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.8",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000097",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN54005037/index.html",
      "@id": "JVN#54005037",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-60022",
      "@id": "CVE-2025-60022",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "\"Dejira\" App for iOS vulnerable to improper server certificate verification"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000018.html",
  "dc:date": "2025-03-28T11:48+09:00",
  "dcterms:issued": "2025-03-19T15:33+09:00",
  "dcterms:modified": "2025-03-28T11:48+09:00",
  "description": "Home gateway HGW-BL1500HM provided by KDDI CORPORATION contains multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eStored cross-site scripting in the NickName registration screen (CWE-79) - CVE-2025-27567\u003c/li\u003e\u003cli\u003eStored cross-site scripting in the USB storage file-sharing function (CWE-79) - CVE-2025-27574\u003c/li\u003e\u003cli\u003ePath traversal in the file/folder listing process of the USB storage file-sharing function (CWE-22) - CVE-2025-27716\u003c/li\u003e\u003cli\u003ePath traversal in the file upload process of the USB storage file-sharing function (CWE-22) - CVE-2025-27718\u003c/li\u003e\u003cli\u003ePath traversal in the file download process of the USB storage file-sharing function (CWE-22) -   CVE-2025-27726\u003c/li\u003e\u003cli\u003ePath traversal in the file deletion process of the USB storage file-sharing function (CWE-22) - CVE-2025-27932\u003c/li\u003e\u003c/ul\u003e\r\nHuiseong Seo reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000018.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:hgw-bl1500hm",
    "@product": "HGW-BL1500HM",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000018",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN04278547/index.html",
      "@id": "JVN#04278547",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-27567",
      "@id": "CVE-2025-27567",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-27574",
      "@id": "CVE-2025-27574",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-27716",
      "@id": "CVE-2025-27716",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-27718",
      "@id": "CVE-2025-27718",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-27726",
      "@id": "CVE-2025-27726",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-27932",
      "@id": "CVE-2025-27932",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in home gateway HGW-BL1500HM"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000123.html",
  "dc:date": "2024-11-29T15:30+09:00",
  "dcterms:issued": "2024-11-29T15:30+09:00",
  "dcterms:modified": "2024-11-29T15:30+09:00",
  "description": "Multiple FCNT Android devices provide security features such as \"privacy mode\" where arbitrary applications can be set not to be displayed, etc.\r\nThe devices contain an authentication bypass vulnerability (CWE-306), where, under certain conditions, the setting pages may be accessed without authentication.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000123.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:kddi:arrows",
      "@product": "arrows",
      "@vendor": "KDDI",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:arrows",
      "@product": "arrows",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:arrows",
      "@product": "arrows",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:softbank:arrows",
      "@product": "arrows",
      "@vendor": "SoftBank",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "3.1",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000123",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN43845108/index.html",
      "@id": "JVN#43845108",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-53701",
      "@id": "CVE-2024-53701",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple FCNT Android devices vulnerable to authentication bypass"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003016.html",
  "dc:date": "2025-03-28T12:01+09:00",
  "dcterms:issued": "2024-03-25T17:28+09:00",
  "dcterms:modified": "2025-03-28T12:01+09:00",
  "description": "Home gateway HGW BL1500HM provided by KDDI CORPORATION contains multiple vulnerabilities listed below.\r\n\r\n  * Use of weak credentials (CWE-1391) - CVE-2024-21865, CVE-2024-29071\r\n  * Command injection (CWE-77) - CVE-2024-28041\r\n\r\nChuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003016.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:hgw_bl1500hm_firmware",
    "@product": "HGW BL1500HM firmware",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-003016",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93546510/index.html",
      "@id": "JVNVU#93546510",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-21865",
      "@id": "CVE-2024-21865",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-28041",
      "@id": "CVE-2024-28041",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-29071",
      "@id": "CVE-2024-29071",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1391.html",
      "@id": "CWE-1391",
      "@title": "Use of Weak Credentials(CWE-1391)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/77.html",
      "@id": "CWE-77",
      "@title": "Command Injection(CWE-77)"
    }
  ],
  "title": "Multiple vulnerabilities in home gateway HGW BL1500HM"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-001804.html",
  "dc:date": "2024-03-11T17:32+09:00",
  "dcterms:issued": "2024-02-06T15:02+09:00",
  "dcterms:modified": "2024-03-11T17:32+09:00",
  "description": "HOME SPOT CUBE2 provided by KDDI CORPORATION contains multiple vulnerabilities listed below.\r\n\r\n  * Stack-based buffer overflow (CWE-121) - CVE-2024-21780\r\n  * Heap-based buffer overflow (CWE-122) - CVE-2024-23978\r\n\r\nChuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-001804.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:home_spot_cube_2_firmware",
    "@product": "HOME SPOT CUBE2 firmware",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-001804",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93740658/index.html",
      "@id": "JVNVU#93740658",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-21780",
      "@id": "CVE-2024-21780",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-23978",
      "@id": "CVE-2024-23978",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2024-21780",
      "@id": "CVE-2024-21780",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2024-23978",
      "@id": "CVE-2024-23978",
      "@source": "NVD"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/121.html",
      "@id": "CWE-121",
      "@title": "Stack-based Buffer Overflow(CWE-121)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/122.html",
      "@id": "CWE-122",
      "@title": "Heap-based Buffer Overflow(CWE-122)"
    }
  ],
  "title": "Multiple buffer overflow vulnerabilities in HOME SPOT CUBE2"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000101.html",
  "dc:date": "2022-12-21T14:13+09:00",
  "dcterms:issued": "2022-12-21T14:13+09:00",
  "dcterms:modified": "2022-12-21T14:13+09:00",
  "description": "+Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character\u0027s specifications.\r\nTherefore, a crafted text may display misleading web links (CWE-451).\r\n\r\nAkaki Tsunoda reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000101.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:kddi:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "KDDI",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:nttdocomo:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:softbank:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "SoftBank",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000101",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN43561812/index.html",
      "@id": "JVN#43561812",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-43543",
      "@id": "CVE-2022-43543",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-43543",
      "@id": "CVE-2022-43543",
      "@source": "NVD"
    },
    {
      "#text": "https://unicode.org/reports/tr36/",
      "@id": "Unicode Technical Report #36",
      "@source": "Related document"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "+Message App improper handling of Unicode control characters"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000049.html",
  "dc:date": "2024-06-17T10:45+09:00",
  "dcterms:issued": "2022-06-29T13:42+09:00",
  "dcterms:modified": "2024-06-17T10:45+09:00",
  "description": "HOME SPOT CUBE2 provided by KDDI CORPORATION contains an OS command injection vulnerability (CWE-78) due to improper processing of data received from DHCP server.\r\n\r\nAlice Rose reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000049.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:home_spot_cube_2",
    "@product": "HOME SPOT CUBE2",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "8.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000049",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN41017328/index.html",
      "@id": "JVN#41017328",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-33948",
      "@id": "CVE-2022-33948",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-33948",
      "@id": "CVE-2022-33948",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "HOME SPOT CUBE2 vulnerable to OS command injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2019/JVNDB-2019-000053.html",
  "dc:date": "2019-10-08T17:35+09:00",
  "dcterms:issued": "2019-08-23T15:57+09:00",
  "dcterms:modified": "2019-10-08T17:35+09:00",
  "description": "Smart TV Box provided by KDDI CORPORATION enables access to Android Debug Bridge via port 5555/TCP of LAN side interface.\r\nWhen a cable television provider sets up Smart TV Box at an individual residence, direct access from outside to the LAN side interface of Smart TV Box is disabled.  However if the original setting is changed later, for example, LAN side interface connection to internet directly is enabled, access to Android Debug Bridge via port 5555/TCP of LAN side interface becomes enabled.  As a result, arbitrary operations without users intent becomes possible, and a remote attacker may conduct arbitrary operations on the device.\r\n\r\nYoshiki Mori and Masaki Kubo of Cybersecurity Laboratory, National Institute of Information and Communications Technology reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2019/JVNDB-2019-000053.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:smart_tv_box_firmware",
    "@product": "Smart TV Box",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.3",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2019-000053",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN17127920/index.html",
      "@id": "JVN#17127920",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6005",
      "@id": "CVE-2019-6005",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2019-6005",
      "@id": "CVE-2019-6005",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Smart TV Box fails to restrict access permissions"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
  "dc:date": "2019-08-27T17:22+09:00",
  "dcterms:issued": "2018-09-27T16:52+09:00",
  "dcterms:modified": "2019-08-27T17:22+09:00",
  "description": "+Message App fails to verify SSL server certificates.\r\n\r\nma.la of LINE Corporation reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:kddi:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "KDDI",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:nttdocomo:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:softbank:%2b_message",
      "@product": "+Message (PlusMessage)",
      "@vendor": "SoftBank",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000100",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN37288228/",
      "@id": "JVN#37288228",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0691",
      "@id": "CVE-2018-0691",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0691",
      "@id": "CVE-2018-0691",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "+Message App fails to verify SSL server certificates"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000009.html",
  "dc:date": "2018-04-11T12:13+09:00",
  "dcterms:issued": "2018-02-06T15:05+09:00",
  "dcterms:modified": "2018-04-11T12:13+09:00",
  "description": "Anshin net security for Windows provided by KDDI CORPORATION is an Internet Security suite. The installer of Anshin net security for Windows contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).\r\n\r\nEili Masami of Tachibana Lab. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000009.html",
  "sec:cpe": {
    "#text": "cpe:/a:kddi:anshin_net_security",
    "@product": "Anshin net security",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000009",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN70615027/index.html",
      "@id": "JVN#70615027",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/ta/JVNTA91240916/index.html",
      "@id": "JVNTA#91240916",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0517",
      "@id": "CVE-2018-0517",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0517",
      "@id": "CVE-2018-0517",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "The installer of Anshin net security for Windows may insecurely load Dynamic Link Libraries"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000191.html",
  "dc:date": "2018-02-14T12:14+09:00",
  "dcterms:issued": "2017-08-08T15:35+09:00",
  "dcterms:modified": "2018-02-14T12:14+09:00",
  "description": "Qua station provided KDDI CORPORATION is a 4G LTE photostrage. Qua station connection tool is used to view data saved on Qua station from a PC and/or save data on a PC.  Installer of Qua station connection tool for Windows contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).\r\n\r\nEili Masami of Tachibana Lab. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000191.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:qua_station",
    "@product": "Qua station connection tool",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000191",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN81659403/index.html",
      "@id": "JVN#81659403",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/ta/JVNTA91240916/index.html",
      "@id": "JVNTA#91240916",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2289",
      "@id": "CVE-2017-2289",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2289",
      "@id": "CVE-2017-2289",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Installer of Qua station connection tool for Windows may insecurely load Dynamic Link Libraries"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000137.html",
  "dc:date": "2018-02-14T11:59+09:00",
  "dcterms:issued": "2017-06-21T13:45+09:00",
  "dcterms:modified": "2018-02-14T11:59+09:00",
  "description": "HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains OS command injection in WebUI.\r\n\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000137.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:home_spot_cube_2_firmware",
    "@product": "HOME SPOT CUBE2 firmware",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000137",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN24348065/index.html",
      "@id": "JVN#24348065",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2185",
      "@id": "CVE-2017-2185",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2185",
      "@id": "CVE-2017-2185",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "HOME SPOT CUBE2 vulnerable to OS command injection in WebUI"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000138.html",
  "dc:date": "2018-02-14T11:59+09:00",
  "dcterms:issued": "2017-06-21T13:45+09:00",
  "dcterms:modified": "2018-02-14T11:59+09:00",
  "description": "HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains improper authentication in WebUI.\r\n\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000138.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:home_spot_cube_2_firmware",
    "@product": "HOME SPOT CUBE2 firmware",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.3",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "6.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000138",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN24348065/index.html",
      "@id": "JVN#24348065",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2186",
      "@id": "CVE-2017-2186",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2186",
      "@id": "CVE-2017-2186",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "HOME SPOT CUBE2 vulnerable to improper authentication in WebUI"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000136.html",
  "dc:date": "2018-02-14T11:59+09:00",
  "dcterms:issued": "2017-06-21T13:44+09:00",
  "dcterms:modified": "2018-02-14T11:59+09:00",
  "description": "HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains buffer overflow in WebUI.\r\n\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000136.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:home_spot_cube_2_firmware",
    "@product": "HOME SPOT CUBE2 firmware",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "8.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000136",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN24348065/index.html",
      "@id": "JVN#24348065",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2184",
      "@id": "CVE-2017-2184",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2184",
      "@id": "CVE-2017-2184",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    }
  ],
  "title": "HOME SPOT CUBE2 vulnerable to buffer overflow in WebUI"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000135.html",
  "dc:date": "2018-02-14T11:54+09:00",
  "dcterms:issued": "2017-06-21T13:44+09:00",
  "dcterms:modified": "2018-02-14T11:54+09:00",
  "description": "HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains OS command injection in clock settings.\r\n\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000135.html",
  "sec:cpe": {
    "#text": "cpe:/o:kddi:home_spot_cube_2_firmware",
    "@product": "HOME SPOT CUBE2 firmware",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000135",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN24348065/index.html",
      "@id": "JVN#24348065",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2183",
      "@id": "CVE-2017-2183",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2183",
      "@id": "CVE-2017-2183",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "HOME SPOT CUBE2 vulnerable to OS command injection in clock settings"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000010.html",
  "dc:date": "2016-02-16T17:26+09:00",
  "dcterms:issued": "2016-01-27T14:40+09:00",
  "dcterms:modified": "2016-02-16T17:26+09:00",
  "description": "HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a cross-site request forgery vulnerability.\r\n\r\nMasaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000010.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:home_spot_cube",
    "@product": "HOME SPOT CUBE",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000010",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN54686544/index.html",
      "@id": "JVN#54686544",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1139",
      "@id": "CVE-2016-1139",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1139",
      "@id": "CVE-2016-1139",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "HOME SPOT CUBE vulnerable to cross-site request forgery"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000009.html",
  "dc:date": "2016-02-16T17:26+09:00",
  "dcterms:issued": "2016-01-27T14:40+09:00",
  "dcterms:modified": "2016-02-16T17:26+09:00",
  "description": "HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a HTTP header injection vulnerability.\r\n\r\nMasaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000009.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:home_spot_cube",
    "@product": "HOME SPOT CUBE",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000009",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN54686544/index.html",
      "@id": "JVN#54686544",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1138",
      "@id": "CVE-2016-1138",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1138",
      "@id": "CVE-2016-1138",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "HOME SPOT CUBE vulnerable to HTTP header injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000012.html",
  "dc:date": "2016-02-16T17:26+09:00",
  "dcterms:issued": "2016-01-27T14:40+09:00",
  "dcterms:modified": "2016-02-16T17:26+09:00",
  "description": "HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains an OS command injection vulnerability.\r\n\r\nMasaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000012.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:home_spot_cube",
    "@product": "HOME SPOT CUBE",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000012",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN54686544/index.html",
      "@id": "JVN#54686544",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1141",
      "@id": "CVE-2016-1141",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1141",
      "@id": "CVE-2016-1141",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "HOME SPOT CUBE vulnerable to OS command injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000011.html",
  "dc:date": "2016-02-16T17:26+09:00",
  "dcterms:issued": "2016-01-27T14:40+09:00",
  "dcterms:modified": "2016-02-16T17:26+09:00",
  "description": "HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a clickjacking vulnerabilitiy.\r\n\r\nMasaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000011.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:home_spot_cube",
    "@product": "HOME SPOT CUBE",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000011",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN54686544/index.html",
      "@id": "JVN#54686544",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1140",
      "@id": "CVE-2016-1140",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1140",
      "@id": "CVE-2016-1140",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "HOME SPOT CUBE vulnerable to clickjacking"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000007.html",
  "dc:date": "2016-02-16T17:26+09:00",
  "dcterms:issued": "2016-01-27T14:40+09:00",
  "dcterms:modified": "2016-02-16T17:26+09:00",
  "description": "HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains a cross-site scripting vulnerability.\r\n\r\nMasaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000007.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:home_spot_cube",
    "@product": "HOME SPOT CUBE",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.7",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000007",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN54686544/index.html",
      "@id": "JVN#54686544",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1136",
      "@id": "CVE-2016-1136",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1136",
      "@id": "CVE-2016-1136",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "HOME SPOT CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000008.html",
  "dc:date": "2016-02-16T17:26+09:00",
  "dcterms:issued": "2016-01-27T14:40+09:00",
  "dcterms:modified": "2016-02-16T17:26+09:00",
  "description": "HOME SPOT CUBE provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE contains an open redirect vulnerability.\r\n\r\nMasaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000008.html",
  "sec:cpe": {
    "#text": "cpe:/h:kddi:home_spot_cube",
    "@product": "HOME SPOT CUBE",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000008",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN54686544/index.html",
      "@id": "JVN#54686544",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1137",
      "@id": "CVE-2016-1137",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1137",
      "@id": "CVE-2016-1137",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "HOME SPOT CUBE vulnerable to open redirect"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2005/JVNDB-2005-000799.html",
  "dc:date": "2008-05-21T00:00+09:00",
  "dcterms:issued": "2008-05-21T00:00+09:00",
  "dcterms:modified": "2008-05-21T00:00+09:00",
  "description": "We have confirmed that web browser products from Openwave Systems Inc. used for the Internet connection service for mobile phones have a problem in its function of sending referer information under certain circumstances.\r\n\r\nThis problem has been reported for KDDI\u0027s au mobile phones. KDDI, regarding this problem as a defect which leads to behaviors inconsistent with the specification of RFC2616, provides countermeasure information. JVN has publicized this issue in coordination with vendors to make it known to users.",
  "link": "https://jvndb.jvn.jp/en/contents/2005/JVNDB-2005-000799.html",
  "sec:cpe": {
    "#text": "cpe:/a:kddi:ezweb_browser",
    "@product": "EZweb Browser",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2005-000799",
  "sec:references": {
    "#text": "http://jvn.jp/en/jp/JVN15243167/index.html",
    "@id": "JVN#15243167",
    "@source": "JVN"
  },
  "title": "Problem with referer header handling on mobile phone web browsers"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2005/JVNDB-2005-000764.html",
  "dc:date": "2008-05-21T00:00+09:00",
  "dcterms:issued": "2008-05-21T00:00+09:00",
  "dcterms:modified": "2008-05-21T00:00+09:00",
  "description": "Mobile phone terminals supporting the two-dimensional code (QR code) read function are reported to have a website connection problem. When specific QR code is read, even if a user tries to connect to the URL string in the first line of the two URL lines displayed, the connection is established with the second URL. \r\n\r\nThis problem has been reported for KDDI mobile phones. The developer provides countermeasure information although they judged this problem not a vulnerability. JVN has publicized this issue in coordination with the developer to make it known to users.",
  "link": "https://jvndb.jvn.jp/en/contents/2005/JVNDB-2005-000764.html",
  "sec:cpe": {
    "#text": "cpe:/a:kddi:barcode_reader_2d",
    "@product": "Barcode Reader (two dimension)",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2005-000764",
  "sec:references": {
    "#text": "http://jvn.jp/en/jp/JVN9ADCBB12/index.html",
    "@id": "JVN#9ADCBB12",
    "@source": "JVN"
  },
  "title": "Website connection problem when a mobile phone terminal uses specific QR code"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000494.html",
  "dc:date": "2008-05-21T00:00+09:00",
  "dcterms:issued": "2008-05-21T00:00+09:00",
  "dcterms:modified": "2008-05-21T00:00+09:00",
  "description": "A directory traversal vulnerability exists in a sample CGI download program included with KDDI\u0027s EZFactory.\r\n\r\nA sample CGI download program is included with KDDI\u0027s EZFactory for downloading and saving data such as images and ringtones to EZweb compatible cellular phones. A directory traversal vulnerability exists in this program.",
  "link": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000494.html",
  "sec:cpe": {
    "#text": "cpe:/a:kddi:download_cgi_sample_program",
    "@product": "Download CGI Sample Program",
    "@vendor": "KDDI",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2007-000494",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN33593387/index.html",
      "@id": "JVN#33593387",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3692",
      "@id": "CVE-2007-3692",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3692",
      "@id": "CVE-2007-3692",
      "@source": "NVD"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/35323",
      "@id": "35323",
      "@source": "XF"
    },
    {
      "#text": "http://securitytracker.com/id?1018344",
      "@id": "1018344",
      "@source": "SECTRACK"
    },
    {
      "#text": "http://www.vupen.com/english/advisories/2007/2472",
      "@id": "VUPEN/ADV-2007-2472",
      "@source": "VUPEN"
    },
    {
      "#text": "http://osvdb.org/38453",
      "@id": "38453",
      "@source": "OSVDB"
    }
  ],
  "title": "KDDI sample CGI download program directory traversal vulnerability"
}