1320 matches found
EC-CUBE vulnerable to SQL injection
Overview EC-CUBE contains a SQL injection vulnerability. EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue in assembling SQL statements, leading to a SQL injection vulnerability. This vulnerability is different from JVN81111541...
JVN#44496332: EC-CUBE vulnerable to SQL injection
EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue in assembling SQL statements, leading to a SQL injection vulnerability. This vulnerability is different from JVN81111541 and JVN19072922. Impact A remote, unauthenticated attacke...
CVE-2011-1325
Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2011-1325
Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2011-1325
EC-CUBE (vulnerability in EC-CUBE before 2.11.0) is affected by a cross-site request forgery (CSRF) that can hijack a logged-in user’s session via unknown vectors. The root cause is a CSRF flaw in handling authenticated requests. Impact is unauthorized actions in authenticated sessions. Remediati...
CVE-2011-1325: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
PT-2011-3056
Name of the Vulnerable Software and Affected Versions EC-CUBE versions prior to 2.11.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims. The exact vectors used for the attack are not specified. Recommendations For versions prior t...
EC-CUBE vulnerable to cross-site request forgery
Overview EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site request forgery vulnerability. EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability. Masako Oono reported this vulnerability to IP...
JVN#37878530: EC-CUBE vulnerable to cross-site request forgery
EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, information stored within EC-CUBE may be altered. Solution Update the Software Apply t...
CVE-2011-0451
Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2011-0451
Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2011-0451
EC-CUBE (LOCKON) before version 2.4.4 contains XSS flaws in data/Smarty/templates/default/list.tpl and data/Smarty/templates/default/campaign/bloc/cart_tag.tpl. The root cause is cross-site scripting via unspecified vectors, enabling remote script/HTML execution in users’ browsers. Affected versi...
CVE-2011-0451: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
PT-2011-2354
Name of the Vulnerable Software and Affected Versions EC-CUBE versions prior to 2.4.4 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, due to multiple cross-site scripting XSS vulnerabilities in the data/Smarty/templates/default/list.tp...
EC-CUBE vulnerable to cross-site scripting
Overview EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site scripting vulnerability. EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. This vulnerability is different than the previous vulnerabilitie...
JVN#84393059: EC-CUBE vulnerable to cross-site scripting
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. This vulnerability is different than the previous vulnerabilities disclosed on JVN. Impact An arbitrary script may be executed on the user's web browser...
Cube Cart 3.0.19 FCKeditor Remote Upload File Exploit
Exploit for php platform in category web applications ===================================================== Cube Cart 3.0.19 FCKeditor Remote Upload File Exploit ===================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /'...
Design/Logic Flaw
The process function in data/class/pages/admin/customer/LCPageAdminCustomerSearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information customer data via unknown vectors related to sessions...