PT-2013-3658

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.12.3enP2 Description A cross-site scripting XSS issue exists in the adminAuthorization function, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL associated with the...

EC-CUBE vulnerable to information disclosure as a result of improper input checking

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue with checking input values, which may result in information disclosure. LOCKON CO.,LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

EC-CUBE fails to restrict access permissions

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a URL handling issue in certain environments and as a result, access permissions are not restricted. Gen Sato reported this vulnerability to IPA. JPCERT/CC coordinated with the develope...

EC-CUBE vulnerable to session fixation

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in handling the output of parameters, which may result in cross-site scripting. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with th...

JVN#39699406: EC-CUBE vulnerable to information disclosure as a result of improper input checking

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue with checking input values, which may result in information disclosure. Impact A remote, unauthenticated attacker may obtain information stored in the product. Solution Apply the update...

JVN#45306814: EC-CUBE fails to restrict access permissions

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a URL handling issue in certain environments and as a result, access permissions are not restricted. Impact A remote, unauthenticated attacker may access the management screen. Solution Apply th...

JVN#00985872: EC-CUBE vulnerable to session fixation

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability. Impact A remote unauthenticated attacker may impersonate a user. As a result, information may be disclosed or altered. Solution Apply the update or patch Apply...

JVN#52552792: EC-CUBE vulnerable to cross-site scripting

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in handling the output of parameters, which may result in cross-site scripting. Impact When a user accesses a specially crafted URL while there is an item in the shopping cart, a...

Fedora 17 : roundcubemail-0.8.5-1.fc17 (2013-2177)

A cross-site scripting XSS flaws were round in the way Round Cube Webmail, a browser-based multilingual IMAP client, performed sanitization of 'data' and 'vbscript' URLs. A remote attacker could provide a specially crafted URL that, when opened would lead to arbitrary JavaScript, VisualBasic scri...

[SECURITY] Fedora 17 Update: redeclipse-1.2-12.fc17

A single-player and multi-player first-person ego-shooter, built on Cube Engine 2, which lends itself toward a balanced gameplay, completely at the control of map makers, while maintaining a general theme of agility in a variety of environments. Features: Balanced gameplay, with a general theme o...

XOOPS Cube PROJECT FileManager - 'xupload.php' Arbitrary File Upload

source: https://www.securityfocus.com/bid/53945/info FileManager is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the...

Add Comment Script 2.2 CSRF Vulnerability (Add Admin)

Exploit for php platform in category web applications Add Comment Script 2.2 CSRF Vulnerability Add Admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST email protected .:. Script : http://www.cubescripts.com/comment-script.php .:. Dork : "PRO A...

The Rubik's Cube Network Camera System injection vulnerability and exploit-vulnerability warning-the black bar safety net

The Rubik's Cube Network Camera System Injection point:/news. php? action=detail&id=SQLi Using the method, the first step through the injection point to obtain the administrator account and password, the password actually is plaintext The second step, 后台地址为/admin.php,go in the admin backend tryin...

Sql injection

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988

EC-CUBE v2.11.0–2.11.2 is affected by a SQL injection vulnerability in data/class/SC_Query.php, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. The vulnerability enables viewing/modifying data and affects systems that process the vulnerable code path. Public s...

CVE-2011-3988: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2011-4800

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 2.11.0 through 2.11.2 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions 2.11.0 through 2.11.2, update to a version that contains a fix for this issue...