CVE-2013-2312

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2314

Cross-site scripting XSS vulnerability in the adminAuthorization function in data/class/helper/SCHelperSession.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL associated with the management screen...

CVE-2013-2315

data/class/pages/forgot/LCPageForgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-2313

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

Session fixation

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2312

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2313

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-2315

data/class/pages/forgot/LCPageForgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-2312

The CVE affects EC-CUBE (LOCKON) shopping-cart: XSS via crafted URL in EC-CUBE 2.11.0–2.12.3enP2 caused by improper handling/output of parameters. Impact is arbitrary script execution in the user’s browser when a cart item is present. Remediation: apply the vendor patch/update (per JVN entries li...

CVE-2013-2313

CVE-2013-2313 refers to a session fixation vulnerability in LOCKON EC-CUBE, affecting EC-CUBE versions 2.11.0 through 2.12.3enP2. The underlying issue allows a remote attacker to hijack a user session, potentially leading to impersonation and unauthorized access or data modification. Public docum...

CVE-2013-2314

CVE-2013-2314 affects EC-CUBE 2.11.0–2.12.3enP2. The vulnerability is a cross-site scripting (XSS) in the adminAuthorization function within SC_Helper_Session.php, allowing a remote attacker to inject arbitrary script/HTML via a crafted URL used on the management screen. Root cause: improper hand...

CVE-2013-2315

EC-CUBE v2.11.0–v2.12.3enP2 suffers an information disclosure vulnerability due to improper input validation in LC_Page_Forgot.php’s password reminder flow. A remote, unauthenticated attacker can craft a request that triggers leakage of sensitive data. The issue is documented across multiple sour...

PT-2013-3659

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.12.3enP2 Description The issue concerns the password reminder function in LOCKON EC-CUBE, where input is not properly validated. This allows remote attackers to obtain sensitive information by sending a...

CVE-2013-2312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2313: Improper Authentication

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-2314: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the adminAuthorization function in data/class/helper/SCHelperSession.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL associated with the management screen...

PT-2013-3657

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.12.3enP2 Description A session fixation issue allows remote attackers to hijack web sessions. The exact vectors used for the attack are not specified. Recommendations For versions 2.11.0 through...

PT-2013-3656

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.12.3enP2 Description A cross-site scripting XSS issue exists in the shopping-cart screen, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. Recommendations For versions...

CVE-2013-2315: Improper Input Validation

data/class/pages/forgot/LCPageForgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request...