CVE-2020-5679

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

Input validation

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

Input validation

Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service DoS condition via unspecified vector...

CVE-2020-5680

EC-CUBE vulnerability CVE-2020-5680: Improper input validation in EC-CUBE 3.0.5–3.0.18 allows a remote attacker to cause a denial-of-service via an unspecified vector. Documented by NVD, RH advisory, OSV, GHSA/JVN; CVSSv3.1 base score 7.5 (HIGH) and CVSSv2 5.0 (MEDIUM). Root cause: input validati...

CVE-2020-5680

Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service DoS condition via unspecified vector...

CVE-2020-5679

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

CVE-2020-5679

EC-CUBE ABClass: CVE-2020-5679 describes an improper restriction of rendered UI layers or frames in EC-CUBE 3.0.0–3.0.18, enabling clickjacking when an admin session is active. The issue arises from rendering UI layers/frames without adequate containment, potentially causing unintended actions by...

Multiple vulnerabilities in EC-CUBE

Overview EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. Clickjacking attacks CWE-1021 - CVE-2020-5679 Improper input validation CWE-20 - CVE-2020-5680 EC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN...

Ec-cube 输入验证错误漏洞

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . An input validation error vulnerability exists in EC-CUBE versions 3.0.5 through 3.0.18, which allows remote attackers to exploit the vulnerability to cause a denial of service DoS condition via an unspecified vector...

JVN#24457594: Multiple vulnerabilities in EC-CUBE

EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. Clickjacking attacks CWE-1021 - CVE-2020-5679 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N| Base Score: 2.6 Imprope...

Ec-cube 安全漏洞

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A security vulnerability exists in EC-CUBE versions 3.0.0 through 3.0.18, which stems from Failure to properly restrict the rendering of UI layers or frames can lead to clickjacking attacks. If a user accesses a special...

cube-design.dk Improper Access Control vulnerability OBB-1451408

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

org.apache.kylin:kylin-cache (>=2.6.0 <=2.6.5), org.apache.kylin:kylin-core-cube (>=1.5.0 <=2.6.5) +16 more potentially affected by CVE-2020-1956 via org.apache.kylin:kylin-core-common (>=1.5.0 <=2.6.5)

org.apache.kylin:kylin-core-common MAVEN version =1.5.0, =2.6.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =2.3.2, =1.5.0, =2.6.0, =2.3.2, =2.3.2, =2.0.0, =2.0.0, =2.6.0, =2.0.0, =2.6.5 - org.apache.kylin:kylin-tool =1.5.1 and more Source cves: CVE-2020-1956 Source advisory: OSV:GHSA-GPRM-XQRC-C2J3...

org.apache.kylin:kylin-cache (>=3.0.0 <=3.0.1), org.apache.kylin:kylin-core-cube (>=3.0.0 <=3.0.1) +14 more potentially affected by CVE-2020-1956 via org.apache.kylin:kylin-core-common (>=3.0.0 <=3.0.1)

org.apache.kylin:kylin-core-common MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2020-1956 Source advisory: OSV:GHSA-GPRM-XQRC-C2J3...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

Directory traversal

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

CVE-2020-5590

CVE-2020-5590 involves a directory traversal vulnerability in EC-CUBE affecting versions 3.0.0–3.0.18 and 4.0.0–4.0.3. The root cause is a directory traversal flaw that enables a remote authenticated attacker to delete arbitrary files and/or directories on the server via unspecified vectors. The ...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

EC-CUBE Path Traversal Vulnerability

EC-CUBE is Japan's EC-CUBE company's set of open source e-commerce system . A path traversal vulnerability exists in EC-CUBE versions 3.0.0 through 3.0.18 and 4.0.0 through 4.0.3. An attacker could exploit this vulnerability to delete arbitrary files or paths on the server...