CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS NVD Description Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script...

curveball

curveball CVE-2020-0601 curveball - Alternative Key Calculator Build Windows Visual Studio 2012 or , then build the solution. Linux / Unix cc altkey.c -lcrypto -o altkey Usage Usage: altkey ecpubliccertificate.pem ecnewprivatekey.pem Example C:\security\curveball\Releasealtkey...

bugstropics

Hunting Bugs in the Tropics This is a repo with the slides used in my presentation "Hunting Bugs in the Tropics" at DEFCON30. It includes the Python script used to calculate the support password based on the private key obtained by breaking Aruba support's EC public key, due to its weak size 64...

Vision-MSI-Thermal-Control

Vision MSI Thermal Control MSI Modern 15H AI C1MG-096IT Linux thermal management - Reverse engineered EC control with fan profiles and battery threshold 🎯 Purpose of this Project This application was born out of necessity for MSI laptop users on Linux. The journey began when I discovered that...

CVE-2026-89316

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

EUVD-2026-108648

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2022-0778

CVE-2022-0778 The discovered vulnerability triggers an infinite loop in the function BNmodsqrt of OpenSSL while parsing an elliptic curve key. This means that a maliciously crafted X.509 certificate can DoS any unpatched server. The core of the vulnerability is in the parsing of EC keys with poin...

CVE-2013-3651

CVE-2013-3651 PoC - EC-CUBE 2 Usage Requirements Python 3 Execution $ python poccve20133651.py - e.g. $ python poccve20133651.py http://127.0.0.1:9000/ Result: Vulnerable! PoC Vulnerability | EC-CUBE, an open platform for building and renewing e-commerce sites...

Astra Linux – Vulnerability in krb5

In kdc/kdcpreauthec.c of the Key Distribution Center KDC in MIT Kerberos 5 also known as krb5, before versions 1.18.4 and 1.19.x, and before version 1.19.2, remote attackers could exploit a vulnerability that led to a NULL pointer dereferencing and a crash of the daemon. This occurs because the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecishtp: Fixed a UAF issue after unbinding the driver. After unbinding the driver, another kthread named crosecconsolelogwork still accesses the device, resulting in a UAF and system crash. The driver does no...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: In readstring, check the sensor index. This prevents potential invalid memory accesses when the requested sensor is not found. findecsensorindex may return a negative value e.g., -ENOENT, but its result was used without...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter

Overview EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin provided by EC-CUBE CO.,LTD. contains the following vulnerability. External Control of Assumed-Immutable Web Parameter CWE-472 - CVE-2026-103671 The developer states that attacks exploiting the vulnerability has been observed. EC-CUBE...

EUVD-2026-100939

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103671

A vulnerability exists in the AmazonPay Plugin for the EC-CUBE 4 series due to an external control of an assumed-immutable web parameter (CWE-472). If exploited, an attacker can redirect users to an arbitrary website during the ordering process, potentially leading to the theft of user account in...

PT-2026-113722

Name of the Vulnerable Software and Affected Versions AmazonPay Plugin for EC-CUBE 4 series affected versions not specified Description An issue exists where an assumed-immutable web parameter is under external control. This allows an attacker to redirect users to an arbitrary website during the...

CVE-2026-103671: External Control of Assumed-Immutable Web Parameter

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

VulnCheck KEV: CVE-2026-103671

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

CVE-2026-103903

A high-severity incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with low-privilege credentials to escalate privileges. The flaw exists because the stage-one EC-SRP challenge is verified against the attacker's acco...