CVE-2011-3988

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988

EC-CUBE v2.11.0–2.11.2 is affected by a SQL injection vulnerability in data/class/SC_Query.php, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. The vulnerability enables viewing/modifying data and affects systems that process the vulnerable code path. Public s...

CVE-2011-3988: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2011-4800

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 2.11.0 through 2.11.2 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions 2.11.0 through 2.11.2, update to a version that contains a fix for this issue...

EC-CUBE vulnerable to SQL injection

Overview EC-CUBE contains a SQL injection vulnerability. EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue in assembling SQL statements, leading to a SQL injection vulnerability. This vulnerability is different from JVN81111541...

JVN#44496332: EC-CUBE vulnerable to SQL injection

EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue in assembling SQL statements, leading to a SQL injection vulnerability. This vulnerability is different from JVN81111541 and JVN19072922. Impact A remote, unauthenticated attacke...

CVE-2011-1325

Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2011-1325

Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2011-1325

EC-CUBE (vulnerability in EC-CUBE before 2.11.0) is affected by a cross-site request forgery (CSRF) that can hijack a logged-in user’s session via unknown vectors. The root cause is a CSRF flaw in handling authenticated requests. Impact is unauthorized actions in authenticated sessions. Remediati...

CVE-2011-1325: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

PT-2011-3056

Name of the Vulnerable Software and Affected Versions EC-CUBE versions prior to 2.11.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims. The exact vectors used for the attack are not specified. Recommendations For versions prior t...

EC-CUBE vulnerable to cross-site request forgery

Overview EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site request forgery vulnerability. EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability. Masako Oono reported this vulnerability to IP...

JVN#37878530: EC-CUBE vulnerable to cross-site request forgery

EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, information stored within EC-CUBE may be altered. Solution Update the Software Apply t...

CVE-2011-0451

Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0451

Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0451

EC-CUBE (LOCKON) before version 2.4.4 contains XSS flaws in data/Smarty/templates/default/list.tpl and data/Smarty/templates/default/campaign/bloc/cart_tag.tpl. The root cause is cross-site scripting via unspecified vectors, enabling remote script/HTML execution in users’ browsers. Affected versi...

CVE-2011-0451: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 data/Smarty/templates/default/list.tpl and 2 data/Smarty/templates/default/campaign/bloc/carttag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...