JVN#79254445: Multiple ETUNA EC-CUBE plugins vulnerable to cross-site scripting

Multiple EC-CUBE plugins provided by ETUNA contain a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE. As of 2021 June 15, an attack exploting this vulnerability has been observed in the wild. Impact...

Ec-cube 跨站脚本漏洞

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . Ec-cube suffers from a cross-site scripting vulnerability that can be exploited by an attacker to trick a victim into following a specially crafted link and executing arbitrary HTML and script code in the user's browser...

EC-CUBE cross-site scripting vulnerability (CNVD-2021-34683)

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in EC-CUBE versions 4.0.0 through 4.0.5. The vulnerability stems from a program that allows remote attackers to inject specially crafted script into specific input fields of E...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

Cross site scripting

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

CVE-2021-20717 affects EC-CUBE 4.0.0–4.0.5. The vulnerability is a Cross-site Scripting (CWE-79) in input handling on EC‑built sites, allowing a remote attacker to inject a crafted script that can execute in an administrator’s browser. The root cause is an input field within EC‑Cube’s web pages t...

EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE. As of 2021 May 10, an attack exploting this vulnerability has been observed in the wild...

JVN#97554111: EC-CUBE vulnerable to cross-site scripting

EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE. As of 2021 May 10, an attack exploting this vulnerability has been observed in the wild. Impact If a...

Ec-cube 跨站脚本漏洞

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in EC-CUBE versions 4.0.0 through 4.0.5. The vulnerability stems from a program that allows remote attackers to inject specially crafted script into specific input fields of E...

Unspecified Vulnerability in Ec-cube

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A security vulnerability exists in EC-CUBE versions 3.0.0 through 3.0.18, which stems from Failure to properly restrict the rendering of UI layers or frames can lead to clickjacking attacks. If a user accesses a special...

Ec-cube Input Validation Error Vulnerability

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . An input validation error vulnerability exists in EC-CUBE versions 3.0.5 through 3.0.18, which allows remote attackers to exploit the vulnerability to cause a denial of service DoS condition via an unspecified vector...

CVE-2020-5680

Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service DoS condition via unspecified vector...

CVE-2020-5680

Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service DoS condition via unspecified vector...

CVE-2020-5679

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

CVE-2020-5679

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

CVE-2020-5680

Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service DoS condition via unspecified vector...

Input validation

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...