CVE-2016-1851

The Screen Lock feature in Apple OS X before 10.11.5 mishandles password profiles, which allows physically proximate attackers to reset expired passwords in the lock-screen state via unspecified vectors...

CVE-2016-1852

CVE-2016-1852 is tied to iOS prior to 9.3.2 where Siri could expose contacts and photos from the lock screen due to a state-management issue with data detectors in Siri results. The Apple security content for iOS 9.3.2 states the fix involved addressing such issues in that release; remediation is...

CVE-2016-1852

Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and photo information via unspecified vectors...

CVE-2016-1851

CVE-2016-1851 affects macOS OS X El Capitan v10.11.0–10.11.4 and later; the Screen Lock feature mishandles password profiles, enabling a physically proximate local attacker to reset expired passwords from the lock screen via unspecified vectors. Impacted component: Screen Lock handling of passwor...

PT-2016-2104

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.11.5 Description The issue exists due to the improper handling of password profiles by the Screen Lock feature. This allows a physically proximate attacker to reset expired passwords when the system is in the...

PT-2016-2103

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3.2 Description The issue is related to Siri in Apple iOS, where data detectors within results are not blocked in the lock-screen state. This allows physically proximate attackers to obtain sensitive contact and...

CVE-2016-1851: Undefined Security Weakness

The Screen Lock feature in Apple OS X before 10.11.5 mishandles password profiles, which allows physically proximate attackers to reset expired passwords in the lock-screen state via unspecified vectors...

CVE-2016-1852: Exposure of Sensitive Information to an Unauthorized Actor

Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and photo information via unspecified vectors...

May 10, 2016 — KB3156421 (OS Build 10586.318)

None None...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

Design/Logic Flaw

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1199: Exposure of Sensitive Information to an Unauthorized Actor

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1200: Improper Access Control

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

PT-2016-4638

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 3.0.7 through 3.0.9 Description The management screen in the affected software allows remote authenticated users to bypass intended access restrictions. Recommendations For versions 3.0.7 through 3.0.9, update to a...

PT-2016-4637

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 3.0.0 through 3.0.9 Description The issue allows remote attackers to bypass intended IP address restrictions on the login page in the management screen. Recommendations For versions 3.0.0 through 3.0.9, update to a...

EC-CUBE fails to restrict access permissions

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions. Note that this vulnerability is different from JVN11458774. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC...