EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in handling the output of parameters, which may result in cross-site scripting. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with th...

JVN#45306814: EC-CUBE fails to restrict access permissions

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a URL handling issue in certain environments and as a result, access permissions are not restricted. Impact A remote, unauthenticated attacker may access the management screen. Solution Apply th...

JVN#00985872: EC-CUBE vulnerable to session fixation

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability. Impact A remote unauthenticated attacker may impersonate a user. As a result, information may be disclosed or altered. Solution Apply the update or patch Apply...

JVN#39699406: EC-CUBE vulnerable to information disclosure as a result of improper input checking

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue with checking input values, which may result in information disclosure. Impact A remote, unauthenticated attacker may obtain information stored in the product. Solution Apply the update...

JVN#52552792: EC-CUBE vulnerable to cross-site scripting

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in handling the output of parameters, which may result in cross-site scripting. Impact When a user accesses a specially crafted URL while there is an item in the shopping cart, a...

CVE-2012-5798

The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5798: Improper Input Validation

The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Smartfren Connex EC 1261-2 UI OUC Local Privilege Escalation Vulnerability

========================================================================== Smartfren Connex EC 1261-2 UI OUC Local Privilege Escalation Vulnerability ==========================================================================...

Smartfren Connex EC 1261-2 UI OUC Local Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits ========================================================================== Smartfren Connex EC 1261-2 UI OUC Local Privilege Escalation Vulnerability ==========================================================================...

Smartfren Connex EC 1261-2 UI OUC - Local Privilege Escalation

========================================================================== Smartfren Connex EC 1261-2 UI OUC Local Privilege Escalation Vulnerability ==========================================================================...

Smartfren Connex EC 1261-2 UI OUC - Local Privilege Escalation

Smartfren Connex EC 1261-2 UI OUC - Local Privilege Escalation ========================================================================== Smartfren Connex EC 1261-2 UI OUC Local Privilege Escalation Vulnerability ==========================================================================...

Sql injection

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988

EC-CUBE v2.11.0–2.11.2 is affected by a SQL injection vulnerability in data/class/SC_Query.php, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. The vulnerability enables viewing/modifying data and affects systems that process the vulnerable code path. Public s...

CVE-2011-3988

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3988: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

EC-CUBE vulnerable to SQL injection

Overview EC-CUBE contains a SQL injection vulnerability. EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue in assembling SQL statements, leading to a SQL injection vulnerability. This vulnerability is different from JVN81111541...

JVN#44496332: EC-CUBE vulnerable to SQL injection

EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue in assembling SQL statements, leading to a SQL injection vulnerability. This vulnerability is different from JVN81111541 and JVN19072922. Impact A remote, unauthenticated attacke...

Global CyberLympics - Middle East & India Championships 11-12 October at Gitex 2011 Dubai

The Europe Championships of the Global CyberLympics has just concluded! It is now time to crown new CHAMPIONS for the Middle East & India Regional ! About the Global CyberLympics: The Global CyberLympics www.cyberlympics.org is the world's first international team ethical hacking championships, a...

Hacker Halted USA 2011 - 10 Reasons Why You Should Attend

Hacker Halted USA 2011 - 10 Reasons Why You Should Attend Hacker Halted is a global series of Computer and Information Security conferences presented by EC-Council. The objective of the Hacker Halted conferences is to raise international awareness towards increased education and ethics in IT...