CVE-2013-5995

data/class/helper/SCHelperAddress.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses...

CVE-2013-5993

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals...

PT-2013-5907

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.13.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the shopping/payment.tpl components. These vulnerabilities allow remote attackers to inject arbitrary web script ...

PT-2013-5906

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 2.12.3 through 2.13.0 Description The issue allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses in the front-features implementation. Recommendations For versions 2.12...

PT-2013-5902

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.11.5 Description The issue concerns the displaySystemError function in html/handle error.php, which incorrectly handles error-log output. This allows remote attackers to obtain sensitive information...

PT-2013-5903

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.11.5 Description A cross-site scripting issue exists due to incorrect handling of error-message output in the displaySystemError function. This allows remote attackers to inject arbitrary web script or...

PT-2013-5904

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.0 through 2.13.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals. Recommendations For versions...

PT-2013-5905

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 2.11.2 through 2.13.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a specific page, which reveals the full path in an error message. This occurs in the...

CVE-2013-5995: Exposure of Sensitive Information to an Unauthorized Actor

data/class/helper/SCHelperAddress.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses...

CVE-2013-5993: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals...

CVE-2013-5994: Exposure of Sensitive Information to an Unauthorized Actor

data/class/pages/mypage/LCPageMypageDeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...

CVE-2013-5992: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the displaySystemError function in html/handleerror.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to inject arbitrary web script or HTML by leveraging incorrect handling of error-message output...

CVE-2013-5991: Exposure of Sensitive Information to an Unauthorized Actor

The displaySystemError function in html/handleerror.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output...

CVE-2013-5996: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject arbitrary web script or HTML via crafted values...

EC-CUBE information disclosure vulnerability

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability due to an issue in processing front features. LAC Co., Ltd. reported this vulnerability to the developer. JPCERT/CC coordinated with the develope...

EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. LAC Co., Ltd. reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning...

EC-CUBE information disclosure vulnerability

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability. Gen Sato reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning...

EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error messages, which may lead to cross-site scripting. Gen Sato reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

JVN#06377589: EC-CUBE vulnerable to cross-site scripting

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Apply the update or the patch Apply the update or the patch according to the...

JVN#55630933: EC-CUBE information disclosure vulnerability

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability due to an issue in processing front features. Impact User's information may be obtained or altered by other user who visits the shopping site. Solution...