JVN#15973066: EC-CUBE vulnerable to directory traversal when used in Windows

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability when used in Windows. Impact A remote attacker may obtain arbitrary files on the server. Solution Apply the update or patch Apply the update or patch accordin...

Fedora Update for kubrick FEDORA-2013-13499

Check for the Version of kubrick OpenVAS Vulnerability Test Fedora Update for kubrick FEDORA-2013-13499 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

[SECURITY] Fedora 17 Update: kubrick-4.10.5-1.fc17

Kubrick is a puzzle cube solving game. The cube sizes range from 2x2x2 easy up to 6x6x6 very hard, or you can play with irregular =E2=80=9Cbricks=E2=80=9D such as 5x3x2 and =E2=80=9Cmats=E2=80=9D one cubi e thick such as 6x4x1. The game has a selection of puzzles at several levels of difficulty, ...

[SECURITY] Fedora 18 Update: kubrick-4.10.5-1.fc18

Kubrick is a puzzle cube solving game. The cube sizes range from 2x2x2 easy up to 6x6x6 very hard, or you can play with irregular =E2=80=9Cbricks=E2=80=9D such as 5x3x2 and =E2=80=9Cmats=E2=80=9D one cubi e thick such as 6x4x1. The game has a selection of puzzles at several levels of difficulty, ...

CVE-2013-3653

Multiple cross-site scripting XSS vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652...

CVE-2013-3652

Cross-site scripting XSS vulnerability in data/class/pages/products/LCPageProductsList.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategoryid2 field, a different vulnerability than CVE-2013-3653...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652...

Cross site scripting

Cross-site scripting XSS vulnerability in data/class/pages/products/LCPageProductsList.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategoryid2 field, a different vulnerability than CVE-2013-3653...

CVE-2013-3654

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SCCheckError.php and data/class/SCFormParam.php, a different vulnerability than CVE-2013-3650...

CVE-2013-3651

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SCCheckError.php and data/class/SCFormParam.php...

CVE-2013-3650

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LCPageResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resizeimage.php, a different vulnerability than...

Directory traversal

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LCPageResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resizeimage.php, a different vulnerability than...

Code injection

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SCCheckError.php and data/class/SCFormParam.php...

Directory traversal

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SCCheckError.php and data/class/SCFormParam.php, a different vulnerability than CVE-2013-3650...

CVE-2013-3654

CVE-2013-3654 is a confirmed vulnerability affecting LOCKON EC-CUBE versions 2.12.0 through 2.12.4. The issue is a directory traversal that allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php. This is described ...

CVE-2013-3650

CVE-2013-3650 is a directory traversal vulnerability in LOCKON EC-CUBE, affecting versions before 2.12.5. The flaw resides in the lfCheckFileName function used by resize_image.php, allowing remote attackers to read arbitrary image files via the image parameter. This is tied to EC-CUBE’s data/clas...

CVE-2013-3651

EC-CUBE vulnerability CVE-2013-3651 affects EC-CUBE versions 2.11.2–2.12.4. A crafted string can trigger remote PHP code execution via in-scope code paths in data/class/SC_CheckError.php and data/class/SC_FormParam.php, allowing arbitrary code execution with the application’s privileges on the se...

CVE-2013-3651

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SCCheckError.php and data/class/SCFormParam.php...

CVE-2013-3650

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LCPageResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resizeimage.php, a different vulnerability than...

CVE-2013-3654

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SCCheckError.php and data/class/SCFormParam.php, a different vulnerability than CVE-2013-3650...