CVE-2016-1201

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

Design/Logic Flaw

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

CVE-2016-1201

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

CVE-2016-1199

CVE-2016-1199 affects LOCKON EC-CUBE, specifically the management login page for versions 3.0.0 to 3.0.9. The description notes(remote) attackers can bypass the intended IP address restrictions via unspecified vectors, indicating an access control bypass in the login/management interface. The acc...

CVE-2016-1200

The CVE-2016-1200 entry affects LOCKON EC-CUBE 3.0.7–3.0.9. The vulnerability is described as a bypass of intended access restrictions on the management screen by remote authenticated users, via unspecified vectors (a distinct issue from CVE-2016-1199). Connected documents confirm the affected pr...

CVE-2016-1201

Vulnerability summary: CVE-2016-1201 is a cross-site request forgery (CSRF) bug in EC-CUBE.6,7 The connected sources confirm affected product EC-CUBE (LOCKON) versions 3.0.0 through 3.0.9, where an attacker can cause an administrator’s session to perform unintended actions when visiting a malicio...

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1201: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators...

CVE-2016-1200: Improper Access Control

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199...

PT-2016-4637

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 3.0.0 through 3.0.9 Description The issue allows remote attackers to bypass intended IP address restrictions on the login page in the management screen. Recommendations For versions 3.0.0 through 3.0.9, update to a...

PT-2016-4639

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 3.0.0 through 3.0.9 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators. This can be exploited by tricking administrators into performing unintended...

PT-2016-4638

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions 3.0.7 through 3.0.9 Description The management screen in the affected software allows remote authenticated users to bypass intended access restrictions. Recommendations For versions 3.0.7 through 3.0.9, update to a...

CVE-2016-1199: Exposure of Sensitive Information to an Unauthorized Actor

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200...

CVE-2016-1205

Cross-site scripting XSS vulnerability in the shiro8 1 categoryfreearea additionplugin plugin 1.0 and 2 itemdetailfreearea additionplugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-1205

Cross-site scripting XSS vulnerability in the shiro8 1 categoryfreearea additionplugin plugin 1.0 and 2 itemdetailfreearea additionplugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...