Vulnerabilities > Lockon > EC Cube > 2.11.1
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2015-10-27 | CVE-2015-5665 | Cross-Site Request Forgery (CSRF) vulnerability in Lockon Ec-Cube Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication of arbitrary users for requests that write to PHP scripts, related to the doValidToken function. | 5.1 |
2014-01-22 | CVE-2014-0808 | Unspecified vulnerability in Lockon Ec-Cube The lfCheckError function in data/class/pages/shopping/LC_Page_Shopping_Multiple.php in LOCKON EC-CUBE 2.11.0 through 2.12.2 allows remote attackers to obtain sensitive shipping information via unspecified vectors. | 5.0 |
2014-01-22 | CVE-2014-0807 | Access Security Bypass vulnerability in EC-CUBE data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors. | 6.4 |
2013-11-21 | CVE-2013-5996 | Cross-Site Scripting vulnerability in Lockon Ec-Cube Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject arbitrary web script or HTML via crafted values. | 4.3 |
2013-11-21 | CVE-2013-5993 | Cross-Site Request Forgery (CSRF) vulnerability in Lockon Ec-Cube Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals. | 6.8 |
2013-11-21 | CVE-2013-5992 | Cross-Site Scripting vulnerability in Lockon Ec-Cube Cross-site scripting (XSS) vulnerability in the displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to inject arbitrary web script or HTML by leveraging incorrect handling of error-message output. | 4.3 |
2013-11-21 | CVE-2013-5991 | Information Exposure vulnerability in Lockon Ec-Cube The displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output. | 4.3 |
2013-06-30 | CVE-2013-3653 | Cross-Site Scripting vulnerability in Lockon Ec-Cube Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than CVE-2013-3652. | 4.3 |
2013-06-30 | CVE-2013-3652 | Cross-Site Scripting vulnerability in Lockon Ec-Cube Cross-site scripting (XSS) vulnerability in data/class/pages/products/LC_Page_Products_List.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategory_id2 field, a different vulnerability than CVE-2013-3653. | 4.3 |
2013-06-30 | CVE-2013-3650 | Path Traversal vulnerability in Lockon Ec-Cube Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different vulnerability than CVE-2013-3654. | 5.0 |