795 matches found
CVE-2021-20842
Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...
CVE-2021-20841
Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...
Improper access control
Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...
CVE-2021-20842
Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...
CVE-2021-20842
EC-CUBE 2 series versions 2.11.0–2.17.1 are affected by a CSRF vulnerability in the admin interface that can hijack the administrator’s session and delete the administrator via a crafted page. The root cause is cross-site request forgery; impact includes administrator deletion and potential confi...
CVE-2021-20841
Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...
CVE-2021-20841
CVE-2021-20841 affects EC-CUBE 2.x (2.11.2–2.17.1). Root cause: improper access control in the Management screen allows a remote authenticated attacker to bypass restrictions and alter system settings via unspecified vectors. Impact: privileges can be abused to change configuration without proper...
CVE-2021-20842: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...
PT-2021-14286
Name of the Vulnerable Software and Affected Versions: EC-CUBE 2 series versions 2.11.0 through 2.17.1 Description: A cross-site request forgery CSRF issue allows a remote attacker to hijack the authentication of an Administrator and potentially delete the Administrator account via a specially...
PT-2021-14285
Name of the Vulnerable Software and Affected Versions: EC-CUBE 2 series versions 2.11.2 through 2.17.1 Description: The issue concerns improper access control in the Management screen, allowing a remote authenticated attacker to bypass access restrictions and alter System settings. Recommendation...
CVE-2021-20841: Undefined Security Weakness
Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...
EC-CUBE improper access control vulnerability
EC-CUBE is an open source system for creating shopping websites. EC-CUBE version 2.11.2 - 2.17.1 contains an improper access control vulnerability in the administration interface. An attacker could use this vulnerability to change system settings without proper privileges...
EC-CUBE Cross-site Request Forgery Vulnerability (CNVD-2022-03132)
EC-CUBE is an open source system for creating shopping websites. EC-CUBE versions 2.11.0 - 2.17.1 have a cross-site request forgery vulnerability in the administration interface. An attacker could exploit the vulnerability to remove administrators by tricking a user with administrative privileges...
Multiple vulnerabilities in EC-CUBE 2 series
Overview EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. Improper access control in Management screen CWE-284 - CVE-2021-20841 Cross-site request forgery vulnerability in Management screen CWE-352 - CVE-2021-20842 EC-CUBE CO.,LTD. reported these...
JVN#75444925: Multiple vulnerabilities in EC-CUBE 2 series
EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. Improper access control in Management screen CWE-284 - CVE-2021-20841 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2|...
Ec-cube 跨站请求伪造漏洞
EC-CUBE is an open source system for creating shopping websites. EC-CUBE versions 2.11.0 - 2.17.1 have a cross-site request forgery vulnerability in the administration interface. An attacker could exploit the vulnerability to remove administrators by tricking a user with administrative privileges...
EC-CUBE 安全漏洞
EC-CUBE is an open source system for creating shopping websites. EC-CUBE version 2.11.2 - 2.17.1 contains an improper access control vulnerability in the administration interface. An attacker could use this vulnerability to change system settings without proper privileges...
