JVN#36085487 EC-CUBE cross-site scripting vulnerability

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. This vulnerability is different from JVN61543834, JVN26621646, and JVN99916563. Impact An arbitrary script could be executed on the user's web browser...

JVN#81111541 EC-CUBE vulnerable to SQL injection

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a SQL injection vulnerability. Impact A remote attacker could obtain the website administrator's privilege which was created using EC-CUBE. Solution Update the Software Apply the latest updates...

Gentoo Security Advisory GLSA 200603-10 (cube)

The remote host is missing updates announced in advisory GLSA 200603-10. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

EC-CUBE cross-site scripting vulnerability

Overview EC-CUBE, an open source system for creating shopping websites, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution None...

CVE-2008-2035

Cross-site scripting XSS vulnerability in the Bluemoon, Inc. 1 BackPack 0.91 and earlier, 2 BmSurvey 0.84 and earlier, 3 newbbfileup 1.83 and earlier, 4 Newsembed newsfileup 1.44 and earlier, and 5 PopnupBlog 3.19 and earlier modules for XOOPS 2.0.x, XOOPS Cube 2.1, and ImpressCMS allows remote...

CVE-2008-2035: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Bluemoon, Inc. 1 BackPack 0.91 and earlier, 2 BmSurvey 0.84 and earlier, 3 newbbfileup 1.83 and earlier, 4 Newsembed newsfileup 1.44 and earlier, and 5 PopnupBlog 3.19 and earlier modules for XOOPS 2.0.x, XOOPS Cube 2.1, and ImpressCMS allows remote...

Default credentials

The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View...

CVE-2006-6108

Cross-site scripting XSS vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2006-6108

Cross-site scripting XSS vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2006-6108

CVE-2006-6108 affects EC-CUBE prior to 1.0.1a-beta. It is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. The vulnerability can cause browsers to execute injected scripts, which could lead to user data expo...

CVE-2006-6108: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

JVN#61543834 EC-CUBE cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected EC-CUBE v1.0.0 and earlier For more information, refer to the vendor's website...

Integer overflow

Integer signedness error in the enetprotocolhandleincomingcommands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including 1 Cube, 2 Sauerbraten, and 3 Duke3dw32, allows remote attackers to cause a denial of service application crash via a packet wi...

CVE-2006-1194

The CVE-2006-1194 entry concerns an integer signedness error in the ENet library’s enet_protocol_handle_incoming_commands (protocol.c) affecting CVS-version Jul 2005 and earlier. It is used by products including Cube, Sauerbraten, and Duke3d_w32. The flaw allows a remote attacker to cause an appl...

Cube: Multiple vulnerabilities

Background Cube is an open source first person shooter game engine supporting multiplayer via LAN or internet. Description Luigi Auriemma reported that Cube is vulnerable to a buffer overflow in the sgetstr function CVE-2006-1100 and that the sgetstr and getint functions fail to verify the length...

GLSA-200603-10 : Cube: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200603-10 Cube: Multiple vulnerabilities Luigi Auriemma reported that Cube is vulnerable to a buffer overflow in the sgetstr function CVE-2006-1100 and that the sgetstr and getint functions fail to verify the length of the supplie...

Design/Logic Flaw

Sauerbraten 20060228, as derived from the Cube engine, allows remote attackers to cause a denial of service client exit by forcing the server to change to a map ogz file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz" extension...

Null pointer dereference

engine/server.cpp in Sauerbraten 20060228, as derived from the Cube engine, allows remote attackers to cause a denial of service segmentation fault via a client that does not completely join the game and times out, which results in a null pointer dereference...

CVE-2006-1100

Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 20060228 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data...

CVE-2006-1101

The 1 sgetstr and 2 getint functions in Sauerbraten 20060228, as derived from the Cube engine, allow remote attackers to cause a denial of service segmentation fault via long streams of input data that trigger an out-of-bounds read, as demonstrated using SVEXT tag data in the Cube engine, which i...