Multiple vulnerabilities in EC-CUBE

Overview EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. Clickjacking attacks CWE-1021 - CVE-2020-5679 Improper input validation CWE-20 - CVE-2020-5680 EC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN...

Ec-cube 安全漏洞

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A security vulnerability exists in EC-CUBE versions 3.0.0 through 3.0.18, which stems from Failure to properly restrict the rendering of UI layers or frames can lead to clickjacking attacks. If a user accesses a special...

Ec-cube 输入验证错误漏洞

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . An input validation error vulnerability exists in EC-CUBE versions 3.0.5 through 3.0.18, which allows remote attackers to exploit the vulnerability to cause a denial of service DoS condition via an unspecified vector...

PT-2020-18640

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 3.0.5 through 3.0.18 Description The issue is related to improper input validation, allowing a remote attacker to cause a denial-of-service DoS condition via an unspecified vector. Recommendations For EC-CUBE versions 3.0.5...

CVE-2020-5680: Improper Input Validation

Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service DoS condition via unspecified vector...

CVE-2020-5679: Improper Restriction of Rendered UI Layers or Frames

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted...

JVN#24457594: Multiple vulnerabilities in EC-CUBE

EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. Clickjacking attacks CWE-1021 - CVE-2020-5679 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N| Base Score: 2.6 Imprope...

PT-2020-18639

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 3.0.0 through 3.0.18 Description The issue is related to improper restriction of rendered UI layers or frames, which can lead to clickjacking attacks. If a user accesses a specially crafted page while logged into the...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

Directory traversal

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

CVE-2020-5590

CVE-2020-5590 involves a directory traversal vulnerability in EC-CUBE affecting versions 3.0.0–3.0.18 and 4.0.0–4.0.3. The root cause is a directory traversal flaw that enables a remote authenticated attacker to delete arbitrary files and/or directories on the server via unspecified vectors. The ...

CVE-2020-5590

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

EC-CUBE Path Traversal Vulnerability

EC-CUBE is Japan's EC-CUBE company's set of open source e-commerce system . A path traversal vulnerability exists in EC-CUBE versions 3.0.0 through 3.0.18 and 4.0.0 through 4.0.3. An attacker could exploit this vulnerability to delete arbitrary files or paths on the server...

EC-CUBE Path Traversal Vulnerability

EC-CUBE is Japan's EC-CUBE company's set of open source e-commerce system . A path traversal vulnerability exists in EC-CUBE versions 3.0.0 through 3.0.18 and 4.0.0 through 4.0.3. An attacker could exploit this vulnerability to delete arbitrary files or paths on the server...

PT-2020-18564

Name of the Vulnerable Software and Affected Versions EC-CUBE versions 3.0.0 through 3.0.18 EC-CUBE versions 4.0.0 through 4.0.3 Description A directory traversal issue allows remote authenticated attackers to delete arbitrary files and/or directories on the server. Recommendations For versions...

CVE-2020-5590: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...

EC-CUBE vulnerable to directory traversal

Overview EC-CUBE provided by EC-CUBE CO.,LTD. contains a directory traversal vulnerability CWE-22. EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning...