CVE-2016-1200

The CVE-2016-1200 entry affects LOCKON EC-CUBE 3.0.7–3.0.9. The vulnerability is described as a bypass of intended access restrictions on the management screen by remote authenticated users, via unspecified vectors (a distinct issue from CVE-2016-1199). Connected documents confirm the affected pr...

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1199

CVE-2016-1199 affects LOCKON EC-CUBE, specifically the management login page for versions 3.0.0 to 3.0.9. The description notes(remote) attackers can bypass the intended IP address restrictions via unspecified vectors, indicating an access control bypass in the login/management interface. The acc...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1201

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

CVE-2016-1201

Vulnerability summary: CVE-2016-1201 is a cross-site request forgery (CSRF) bug in EC-CUBE.6,7 The connected sources confirm affected product EC-CUBE (LOCKON) versions 3.0.0 through 3.0.9, where an attacker can cause an administrator’s session to perform unintended actions when visiting a malicio...

CVE-2016-1205

Cross-site scripting XSS vulnerability in the shiro8 1 categoryfreearea additionplugin plugin 1.0 and 2 itemdetailfreearea additionplugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1205

Cross-site scripting XSS vulnerability in the shiro8 1 categoryfreearea additionplugin plugin 1.0 and 2 itemdetailfreearea additionplugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the shiro8 1 categoryfreearea additionplugin plugin 1.0 and 2 itemdetailfreearea additionplugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1205

Cross-site scripting XSS vulnerability in the shiro8 1 categoryfreearea additionplugin plugin 1.0 and 2 itemdetailfreearea additionplugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1205

CVE-2016-1205 is a cross-site scripting (XSS) vulnerability in EC-CUBE shiro8 Co., Ltd. plugins “category_freearea_ addition_plugin” and “itemdetail_freearea_ addition_plugin” (version 1.0). The underlying issue is CWE-79, enabling remote attackers to inject arbitrary web script/HTML via unspecif...

LOCKON EC-CUBE Cross-Site Request Forgery Vulnerability (CNVD-2016-02684)

LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. The platform supports product login, user evaluation, artwork layout and so on. A cross-site request forgery vulnerability exists in LOCKON EC-CUBE versions 3.0.0 through 3.0.9. An attacker can...

Shiro8 category_freearea_ addition_plugin for LOCKON EC-CUBE plugin and itemdetail_freearea_ addition_plugin for LOCKON EC-CUBE plugin Cross Site Scripting Vulnerability

LOCKON EC-CUBE is an open source e-commerce website building platform developed by LOCKON Corporation. The platform supports product login , user reviews , art layout , etc. Shiro8 categoryfreearea additionplugin and itemdetailfreearea additionplugin are Japan Shiro8 company for the EC-CUBE...

LOCKON EC-CUBE Access Privilege Vulnerability

LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. The platform supports product login, user evaluation, artwork layout and so on. An access privilege vulnerability exists in LOCKON EC-CUBE versions 3.0.7 through 3.0.9. An attacker can exploit the...

EC-CUBE vulnerable to cross-site request forgery

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability CWE-352. LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD...

EC-CUBE fails to restrict access permissions

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions. Note that this vulnerability is different from JVN47473944. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC...

EC-CUBE fails to restrict access permissions

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions. Note that this vulnerability is different from JVN11458774. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC...

JVN#73776243: EC-CUBE vulnerable to cross-site request forgery

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability CWE-352. Impact If an administrator views a malicious page while logged in, unintended operations may be performed. Solution Apply the update or the...

JVN#63384827: Multiple shiro8 Co., Ltd. freearea_ addition_plugins for EC-CUBE vulnerable to cross-site scripting

EC-CUBE plugin "categoryfreearea additionplugin" and "itemdetailfreearea additionplugin" provided by shiro8 Co., Ltd. contain a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the Software Update to the...

JVN#47473944: EC-CUBE fails to restrict access permissions

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions. Impact A remote attacker may bypass IP address restrictions and access the login page to the management screen. Solution Apply the update or the patch Apply the upda...