JVN#11458774: EC-CUBE fails to restrict access permissions

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions. Impact A logged in attacker may bypass access restrictions, or delete access restriction settings. Solution Apply the update or the patch Apply the update or the pat...

CVE-2016-1180

Cross-site scripting XSS vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1180

Cross-site scripting XSS vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1180

Cross-site scripting XSS vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1180

The CVE-2016-1180 issue concerns the Cyber-Will EC-CUBE Social-button Premium plugin. A cross-site scripting (XSS) vulnerability exists in the Social-button Premium plugin before version 1.1 for EC-CUBE 2.13.x, allowing remote attackers to inject arbitrary web script or HTML via unspecified vecto...

EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" vulnerable to cross-site scripting

Overview EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" provided by Cyber-Will Inc. contain a cross-site scripting vulnerability CWE-79. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#78482127: EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" vulnerable to cross-site scripting

EC-CUBE plugin "Social-button Plugin Premium" and "Social-button Plugin" provided by Cyber-Will Inc. contain a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to th...

Cuore EC-CUBE Help plug-in SQL Injection Vulnerability

Cuore EC-CUBE Help plug-in is a Japan Cuore company's use in EC-CUBE open source e-commerce site building platform and provide help function plug-in. A SQL injection vulnerability exists in the Cuore EC-CUBE Help plug-in, which allows remote attackers to execute arbitrary SQL commands via...

CVE-2016-1154

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-1154

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-1154

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-1154

Cuore EC-CUBE Help plug-in (version 1.3.5 and earlier) contains an SQL injection (CWE-89) vulnerability. Remote attackers can execute arbitrary SQL via unspecified vectors, potentially exposing or altering database information. The affected component is the Help plug-in for EC-CUBE created by Cuo...

EC-CUBE plugin "Help plug-in" vulnerable to SQL injection

Overview EC-CUBE plugin "Help plug-in" provided by Cuore contains an SQL injection vulnerability CWE-89. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact...

JVN#31524757: EC-CUBE plugin "Help plug-in" vulnerable to SQL injection

EC-CUBE plugin "Help plug-in" provided by Cuore contains an SQL injection vulnerability CWE-89. Impact Information stored in the database may be obtained or altered by a remote attacker. Solution Update the plugin Update to the latest version according to the information provided by the developer...

CVE-2015-7784

SQL injection vulnerability in the BOKUBLOCK 1 BbAdminViewsControl213 plugin before 1.1 and 2 BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the BOKUBLOCK 1 BbAdminViewsControl213 plugin before 1.1 and 2 BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7784

SQL injection vulnerability in the BOKUBLOCK 1 BbAdminViewsControl213 plugin before 1.1 and 2 BbAdminViewsControl plugin before 2.1 for EC-CUBE allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7784

CVE-2015-7784 affects EC-CUBE via the BbAdminViewsControl213 plugin (versions before 1.1) and BbAdminViewsControl plugin (versions before 2.1). The vulnerability is an SQL injection (CWE-89) that allows a logged-in, remote, authenticated attacker to execute arbitrary SQL commands via unspecified ...

EC-CUBE plugin BbAdminViewsControl vulnerable to SQL injection

Overview BbAdminViewsControl from BOKUBLOCK CO., LTD. is an EC-CUBE plugin. BbAdminViewsControl contains an SQL injection vulnerability CWE-89. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...