CVE-2018-0564

EC-CUBE 3.x versions (3.0.0 through 3.0.15) are affected by a session fixation vulnerability. The issue arises from lack of renewal of session cookies, enabling remote attackers to impersonate authenticated users and perform arbitrary operations via unspecified vectors. Public references (JVN/JVN...

CVE-2018-0564: Session Fixation

Session fixation vulnerability in EC-CUBE EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE...

PT-2018-8922

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 3.0.0 through 3.0.15 Description A session fixation issue allows remote attackers to perform arbitrary operations. Recommendations For EC-CUBE versions 3.0.0 through 3.0.15, at the moment, there is no information about a newer...

Session Fixation

ec-cube/ec-cube is vulnerable to session fixation attacks. The vulnerability exists due to the lack of renewal of session cookies, allowing attackers to impersonate an authenticated user...

EC-CUBE vulnerable to session fixation

Overview EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability CWE-384. LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD...

JVN#52695336: EC-CUBE vulnerable to session fixation

EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability CWE-384. Impact A remote attacker impersonating a logged in user may perform an unintended operation with the user's privilege. Solution Update the Softwa...

Oracle Flex Cube Direct BA v10.5 - Cross Site Vulnerability

Document Title: =============== Oracle Flex Cube Direct BA v10.5 - Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2101 Release Date: ============= 2017-10-31 Vulnerability Laboratory ID VL-ID: ==================================...

iSmartAlarm cube Device Access Control Error Vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. An access control error vulnerability exists in the iSmartAlarm cube devices, where the vulnerable program passes a newly created key in plaintext. No details of the vulnerability are provided at this time...

iSmartAlarm cube Device Information Disclosure Vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. An information disclosure vulnerability exists in the iSmartAlarm cube devices. A remote attack could exploit this vulnerability to obtain arbitrary passwords or personal data...

iSmartAlarm cube device encryption issue vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. An authentication bypass vulnerability exists in iSmartAlarm cube devices. A remote attacker can exploit this vulnerability to execute commands...

iSmartAlarm cube device input validation vulnerability

The iSmartAlarm cube devices are a smart home device from iSmartAlarm USA. A denial of service vulnerability exists in iSmartAlarm cube devices. An attacker can exploit this vulnerability to cause a denial of service device stops responding...

iSmartAlarm CubeOne Remote Command Execution Exploit

iSmartAlarm CubeOne suffers from a remote command execution vulnerability that allows disabling the alarm and setting it off. + Credits: Ilia Shnaidman + @0x496c on Twitter + Source: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/...

Input validation

iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability...

Design/Logic Flaw

iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and it will stop responding...

CVE-2017-7728

On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands e.g., setting the alarm on/off, related to incorrect cryptography...

CVE-2017-7726

CVE-2017-7726 affects iSmartAlarm cube devices. The vulnerability is a missing SSL certificate validation in the cube’s TLS connections to the backend (port 8443), enabling potential integrity impact due to untrusted server validation. References in connected records describe the SSL-validation w...

CVE-2017-7729

CVE-2017-7729 concerns iSmartAlarm cube devices, where an incorrect access control vulnerability arises because a newly created key is transmitted in cleartext. The issue is documented with a network-attack surface and low attack complexity, resulting in a high impact on integrity (partial) per C...

CVE-2017-7730

The CVE-2017-7730 issue affects iSmartAlarm cube devices and describes a Denial of Service caused by a SYN flood to TCP port 12345, which can freeze the cube and render it unresponsive. Public details indicate an internal LAN attack vector (no user interaction required) with a low attack complexi...

CVE-2017-7729: Missing Encryption of Sensitive Data

On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext...

CVE-2017-7728: Undefined Security Weakness

On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands e.g., setting the alarm on/off, related to incorrect cryptography...