Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
LockonEc-cube

26 matches found

CVE
CVE•added 2013/11/21 4:40 a.m.•87 views

CVE-2013-5993

Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals.

6.8CVSS7.3AI score0.00182EPSS
CVE
CVE•added 2013/11/21 4:40 a.m.•40 views

CVE-2013-5992

Cross-site scripting (XSS) vulnerability in the displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to inject arbitrary web script or HTML by leveraging incorrect handling of error-message output.

4.3CVSS5.9AI score0.00254EPSS
CVE
CVE•added 2014/01/22 9:55 p.m.•40 views

CVE-2014-0808

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request.

9.1CVSS6.2AI score0.00388EPSS
CVE
CVE•added 2016/04/30 10:59 a.m.•37 views

CVE-2016-1199

The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200.

5.3CVSS5.5AI score0.0024EPSS
CVE
CVE•added 2013/06/30 8:56 p.m.•36 views

CVE-2013-3653

Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652.

4.3CVSS5.7AI score0.00472EPSS
CVE
CVE•added 2013/11/21 4:40 a.m.•36 views

CVE-2013-5996

Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject arbitrary web script or HTML via crafted values.

4.3CVSS5.9AI score0.00256EPSS
CVE
CVE•added 2011/02/03 4:0 p.m.•35 views

CVE-2011-0451

Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/campaign/bloc/cart_tag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.0048EPSS
CVE
CVE•added 2013/05/29 7:55 p.m.•35 views

CVE-2013-2315

data/class/pages/forgot/LC_Page_Forgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request.

5CVSS6.4AI score0.00319EPSS
CVE
CVE•added 2013/06/30 8:56 p.m.•34 views

CVE-2013-3652

Cross-site scripting (XSS) vulnerability in data/class/pages/products/LC_Page_Products_List.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategory_id2 field, a different vulnerability than CVE-2013-3653.

4.3CVSS5.7AI score0.00472EPSS
CVE
CVE•added 2014/01/22 9:55 p.m.•34 views

CVE-2014-0807

data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.

6.4CVSS6.8AI score0.00527EPSS
CVE
CVE•added 2013/06/30 7:28 p.m.•33 views

CVE-2013-3651

LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SC_CheckError.php and data/class/SC_FormParam.php.

7.5CVSS6.9AI score0.10093EPSS
CVE
CVE•added 2016/04/30 10:59 a.m.•33 views

CVE-2016-1200

The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199.

6.5CVSS5.2AI score0.0024EPSS
CVE
CVE•added 2013/06/30 7:28 p.m.•32 views

CVE-2013-3650

Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-...

5CVSS6.7AI score0.0032EPSS
CVE
CVE•added 2013/11/21 4:40 a.m.•32 views

CVE-2013-5991

The displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output.

4.3CVSS6.4AI score0.00283EPSS
CVE
CVE•added 2018/04/20 1:29 p.m.•32 views

CVE-2018-0564

Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE ...

8.1CVSS7.9AI score0.00686EPSS
CVE
CVE•added 2013/05/29 7:55 p.m.•31 views

CVE-2013-2314

Cross-site scripting (XSS) vulnerability in the adminAuthorization function in data/class/helper/SC_Helper_Session.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL associated with the management screen.

4.3CVSS5.8AI score0.00256EPSS
CVE
CVE•added 2013/06/30 7:28 p.m.•31 views

CVE-2013-3654

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php, a different vulnerability than CVE-2013-3650.

5CVSS6.7AI score0.0032EPSS
CVE
CVE•added 2013/08/30 9:55 p.m.•31 views

CVE-2013-4702

Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 through 2.12.5 on Windows allow remote attackers to read arbitrary files via vectors involving a (1) Operation, (2) Service, (3) Style, (4) Validate, or (5) Versi...

5CVSS7AI score0.00745EPSS
CVE
CVE•added 2013/11/21 4:40 a.m.•31 views

CVE-2013-5994

data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

5CVSS6.3AI score0.00319EPSS
CVE
CVE•added 2013/11/21 4:40 a.m.•31 views

CVE-2013-5995

data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses.

5.5CVSS5.8AI score0.00218EPSS
CVE
CVE•added 2016/04/30 10:59 a.m.•31 views

CVE-2016-1201

Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators.

8.8CVSS8.9AI score0.0013EPSS
CVE
CVE•added 2011/05/13 5:5 p.m.•30 views

CVE-2011-1325

Cross-site request forgery (CSRF) vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

5.8CVSS7.3AI score0.00164EPSS
CVE
CVE•added 2011/10/21 6:55 p.m.•29 views

CVE-2011-3988

SQL injection vulnerability in data/class/SC_Query.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

7.5CVSS8.6AI score0.01208EPSS
CVE
CVE•added 2013/05/29 7:55 p.m.•29 views

CVE-2013-2313

Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors.

4CVSS6.8AI score0.00312EPSS
CVE
CVE•added 2013/05/29 7:55 p.m.•28 views

CVE-2013-2312

Cross-site scripting (XSS) vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

4.3CVSS5.8AI score0.00256EPSS
CVE
CVE•added 2015/10/27 2:59 a.m.•25 views

CVE-2015-5665

Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function.

5.1CVSS7.6AI score0.00146EPSS