Summary
| Detail | |||
|---|---|---|---|
| Vendor | Lockon | First view | 2011-02-03 |
| Product | Ec-Cube | Last view | 2018-04-20 |
| Version | 1.4.1 | Type | Application |
| Update | beta | ||
| Edition | * | ||
| Language | * | ||
| Sofware Edition | * | ||
| Target Software | * | ||
| Target Hardware | * | ||
| Other | * | ||
| CPE Product | cpe:2.3:a:lockon:ec-cube | ||
Activity : Overall
Related : CVE
| Date | Alert | Description | |
|---|---|---|---|
| 8.1 | 2018-04-20 | CVE-2018-0564 | Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15) allows remote attackers to perform arbitrary operations via unspecified vectors. |
| 6.4 | 2014-01-22 | CVE-2014-0807 | data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors. |
| 4.3 | 2013-06-30 | CVE-2013-3653 | Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652. |
| 5 | 2013-06-30 | CVE-2013-3650 | Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-3654. |
| 5.8 | 2011-05-13 | CVE-2011-1325 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| 4.3 | 2011-02-03 | CVE-2011-0451 | Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/campaign/bloc/cart_tag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CWE : Common Weakness Enumeration
| % | id | Name |
|---|---|---|
| 40% (2) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
| 20% (1) | CWE-384 | Session Fixation |
| 20% (1) | CWE-352 | Cross-Site Request Forgery (CSRF) |
| 20% (1) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 72239 | EC-CUBE Admin User Ban CSRF |
| 70746 | EC-CUBE data/Smarty/templates/default/campaign/bloc/cart_tag.tpl Unspecified ... |
| 70745 | EC-CUBE data/Smarty/templates/default/list.tpl Unspecified Parameter XSS |
