Refine your search

46 vulnerabilities found for EC-CUBE by EC-CUBE CO.,LTD.

jvndb-2024-000080
Vulnerability from jvndb
Published
2024-07-30 13:56
Modified
2024-07-30 13:56
Severity ?
6.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Summary
EC-CUBE 4 Series improper input validation when installing plugins
Details
EC-CUBE 4 series provided by EC-CUBE CO.,LTD improperly validates inputs when installing plugins (CWE-349). EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000080.html",
  "dc:date": "2024-07-30T13:56+09:00",
  "dcterms:issued": "2024-07-30T13:56+09:00",
  "dcterms:modified": "2024-07-30T13:56+09:00",
  "description": "EC-CUBE 4 series provided by EC-CUBE CO.,LTD improperly validates inputs when installing plugins (CWE-349).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.8",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN48324254/index.html",
      "@id": "JVN#48324254",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-41924",
      "@id": "CVE-2024-41924",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE 4 Series improper input validation when installing plugins"
}

jvndb-2023-000107
Vulnerability from jvndb
Published
2023-11-07 13:47
Modified
2024-05-09 17:17
Severity ?
7.2 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
EC-CUBE 3 series and 4 series vulnerable to arbitrary code execution
Details
EC-CUBE 3 series and 4 series provided by EC-CUBE CO.,LTD. contain an arbitrary code execution vulnerability (CWE-94) due to improper settings of the product's template engine "Twig". Takeshi Miura of N.F.Laboratories Inc. reported this vulnerability to EC-CUBE CO.,LTD. EC-CUBE CO.,LTD. Inc. reported this case to JPCERT/CC to notify users of its solution through JVN.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000107.html",
  "dc:date": "2024-05-09T17:17+09:00",
  "dcterms:issued": "2023-11-07T13:47+09:00",
  "dcterms:modified": "2024-05-09T17:17+09:00",
  "description": "EC-CUBE 3 series and 4 series provided by EC-CUBE CO.,LTD. contain an arbitrary code execution vulnerability (CWE-94) due to improper settings of the product\u0027s template engine \"Twig\".\r\n\r\nTakeshi Miura of N.F.Laboratories Inc. reported this vulnerability to EC-CUBE CO.,LTD.\r\nEC-CUBE CO.,LTD. Inc. reported this case to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000107.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.2",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000107",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN29195731/index.html",
      "@id": "JVN#29195731",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-46845",
      "@id": "CVE-2023-46845",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-46845",
      "@id": "CVE-2023-46845",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-94",
      "@title": "Code Injection(CWE-94)"
    }
  ],
  "title": "EC-CUBE 3 series and 4 series vulnerable to arbitrary code execution"
}

jvndb-2023-000082
Vulnerability from jvndb
Published
2023-08-17 15:12
Modified
2024-03-25 18:07
Severity ?
4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Summary
EC-CUBE 2 series vulnerable to cross-site scripting
Details
EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79) in "mail/template" and "products/product" of Management page. Shimamine Taihei of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000082.html",
  "dc:date": "2024-03-25T18:07+09:00",
  "dcterms:issued": "2023-08-17T15:12+09:00",
  "dcterms:modified": "2024-03-25T18:07+09:00",
  "description": "EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79) in \"mail/template\" and \"products/product\" of Management page.\r\n\r\nShimamine Taihei of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000082.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.1",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000082",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN46993816/index.html",
      "@id": "JVN#46993816",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40281",
      "@id": "CVE-2023-40281",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40281",
      "@id": "CVE-2023-40281",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE 2 series vulnerable to cross-site scripting"
}

jvndb-2023-000019
Vulnerability from jvndb
Published
2023-02-28 16:38
Modified
2024-06-10 17:28
Severity ?
5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple cross-site scripting vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below. * Cross-site scripting vulnerability in Contents Management (CWE-79) - CVE-2023-22438 * Cross-site scripting vulnerability in Authentication Key Settings (CWE-79) - CVE-2023-25077 * Cross-site scripting vulnerability in Product List Screen and Product Detail Screen (CWE-79) - CVE-2023-22838 CVE-2023-22438 Gaku Mochizuki, Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. and Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2023-25077 Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. Inc. reported it to JPCERT/CC to notify users of its solution through JVN. CVE-2023-22838 Rei TAKAHASHI of Hashiura Lab., Dept. of Data Science, Nippon Institute of Technology reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000019.html",
  "dc:date": "2024-06-10T17:28+09:00",
  "dcterms:issued": "2023-02-28T16:38+09:00",
  "dcterms:modified": "2024-06-10T17:28+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below.\r\n\r\n* Cross-site scripting vulnerability in Contents Management (CWE-79) - CVE-2023-22438\r\n* Cross-site scripting vulnerability in Authentication Key Settings (CWE-79) - CVE-2023-25077\r\n* Cross-site scripting vulnerability in Product List Screen and Product Detail Screen (CWE-79) - CVE-2023-22838\r\n\r\nCVE-2023-22438\r\nGaku Mochizuki, Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. and Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-25077\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. Inc. reported it to JPCERT/CC to notify users of its solution through JVN.\r\n\r\nCVE-2023-22838\r\nRei TAKAHASHI of Hashiura Lab., Dept. of Data Science, Nippon Institute of Technology reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000019.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000019",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN04785663/index.html",
      "@id": "JVN#04785663",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22438",
      "@id": "CVE-2023-22438",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-25077",
      "@id": "CVE-2023-25077",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22838",
      "@id": "CVE-2023-22838",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22438",
      "@id": "CVE-2023-22438",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22838",
      "@id": "CVE-2023-22838",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-25077",
      "@id": "CVE-2023-25077",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple cross-site scripting vulnerabilities in EC-CUBE"
}

jvndb-2022-000073
Vulnerability from jvndb
Published
2022-09-15 16:30
Modified
2024-06-13 11:09
Severity ?
2.7 (Low) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Summary
Multiple vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. * Directory traversal vulnerability (CWE-22) - CVE-2022-40199 * DOM-based cross-site scripting vulnerability (CWE-79) - CVE-2022-38975 Noriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported them to JPCERT/CC to notify users of the solutions through JVN.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000073.html",
  "dc:date": "2024-06-13T11:09+09:00",
  "dcterms:issued": "2022-09-15T16:30+09:00",
  "dcterms:modified": "2024-06-13T11:09+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. \r\n  * Directory traversal vulnerability (CWE-22) - CVE-2022-40199 \r\n  * DOM-based cross-site scripting vulnerability (CWE-79) - CVE-2022-38975 \r\n\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported them to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000073.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "2.7",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000073",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN21213852/index.html",
      "@id": "JVN#21213852",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-40199",
      "@id": "CVE-2022-40199",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-38975",
      "@id": "CVE-2022-38975",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-40199",
      "@id": "CVE-2022-40199",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-38975",
      "@id": "CVE-2022-38975",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE"
}

jvndb-2022-000015
Vulnerability from jvndb
Published
2022-02-22 14:22
Modified
2024-06-21 17:39
Severity ?
3.1 (Low) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
EC-CUBE improperly handles HTTP Host header values
Details
EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values (CWE-913). EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000015.html",
  "dc:date": "2024-06-21T17:39+09:00",
  "dcterms:issued": "2022-02-22T14:22+09:00",
  "dcterms:modified": "2024-06-21T17:39+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values (CWE-913).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000015.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "3.1",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000015",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN53871926/index.html",
      "@id": "JVN#53871926",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-25355",
      "@id": "CVE-2022-25355",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355",
      "@id": "CVE-2022-25355",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE improperly handles HTTP Host header values"
}

jvndb-2021-000100
Vulnerability from jvndb
Published
2021-11-11 15:09
Modified
2021-11-11 15:09
Severity ?
4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
Multiple vulnerabilities in EC-CUBE 2 series
Details
EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. * Improper access control in Management screen (CWE-284) - CVE-2021-20841 * Cross-site request forgery vulnerability in Management screen (CWE-352) - CVE-2021-20842 EC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of the solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000100.html",
  "dc:date": "2021-11-11T15:09+09:00",
  "dcterms:issued": "2021-11-11T15:09+09:00",
  "dcterms:modified": "2021-11-11T15:09+09:00",
  "description": "EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below.\r\n* Improper access control in Management screen (CWE-284) - CVE-2021-20841\r\n* Cross-site request forgery vulnerability in Management screen (CWE-352) - CVE-2021-20842\r\n\r\nEC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of the solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000100.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000100",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN75444925/index.html",
      "@id": "JVN#75444925",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20841",
      "@id": "CVE-2021-20841",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20842",
      "@id": "CVE-2021-20842",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20841",
      "@id": "CVE-2021-20841",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20842",
      "@id": "CVE-2021-20842",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE 2 series"
}

jvndb-2021-000059
Vulnerability from jvndb
Published
2021-07-01 15:49
Modified
2021-07-01 15:49
Severity ?
7.5 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
EC-CUBE fails to restrict access permissions
Details
EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions (CWE-284) . EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000059.html",
  "dc:date": "2021-07-01T15:49+09:00",
  "dcterms:issued": "2021-07-01T15:49+09:00",
  "dcterms:modified": "2021-07-01T15:49+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions (CWE-284) .\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000059.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000059",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN57942445/index.html",
      "@id": "JVN#57942445",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20778",
      "@id": "CVE-2021-20778",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20778",
      "@id": "CVE-2021-20778",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

jvndb-2021-000057
Vulnerability from jvndb
Published
2021-06-23 15:15
Modified
2021-06-23 15:15
Severity ?
6.1 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple cross-site scripting vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below. *Cross-site scripting vulnerability (CWE-79) - CVE-2021-20750 *Cross-site scripting vulnerability (CWE-79) - CVE-2021-20751 hibiki moriyama of STNet, Incorporated reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000057.html",
  "dc:date": "2021-06-23T15:15+09:00",
  "dcterms:issued": "2021-06-23T15:15+09:00",
  "dcterms:modified": "2021-06-23T15:15+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below.\r\n*Cross-site scripting vulnerability (CWE-79) - CVE-2021-20750\r\n*Cross-site scripting vulnerability (CWE-79) - CVE-2021-20751\r\n\r\nhibiki moriyama of STNet, Incorporated reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000057.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "6.1",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000057",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN95292458/index.html",
      "@id": "JVN#95292458",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20750",
      "@id": "CVE-2021-20750",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20751",
      "@id": "CVE-2021-20751",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20750",
      "@id": "CVE-2021-20750",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20751",
      "@id": "CVE-2021-20751",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple cross-site scripting vulnerabilities in EC-CUBE"
}

jvndb-2021-000035
Vulnerability from jvndb
Published
2021-05-10 18:08
Modified
2021-05-10 18:08
Severity ?
7.1 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Summary
EC-CUBE vulnerable to cross-site scripting
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79). An arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE. As of 2021 May 10, an attack exploting this vulnerability has been observed in the wild. EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000035.html",
  "dc:date": "2021-05-10T18:08+09:00",
  "dcterms:issued": "2021-05-10T18:08+09:00",
  "dcterms:modified": "2021-05-10T18:08+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79).\r\nAn arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE.\r\n\r\nAs of 2021 May 10, an attack exploting this vulnerability has been observed in the wild.\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000035.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.1",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000035",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN97554111/index.html",
      "@id": "JVN#97554111",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20717",
      "@id": "CVE-2021-20717",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20717",
      "@id": "CVE-2021-20717",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/security/ciadr/vul/20210510-jvn.html",
      "@id": "Regarding cross-site scripting vulnerability in EC-CUBE (JVN#97554111)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.jpcert.or.jp/english/at/2021/at210022.html",
      "@id": "Alert Regarding Cross Site Scripting Vulnerability (CVE-2021-20717) in EC-CUBE",
      "@source": "JPCERT"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

jvndb-2020-000080
Vulnerability from jvndb
Published
2020-12-03 18:15
Modified
2020-12-03 18:15
Severity ?
5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Multiple vulnerabilities in EC-CUBE
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. * Clickjacking attacks (CWE-1021) - CVE-2020-5679 * Improper input validation (CWE-20) - CVE-2020-5680 EC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000080.html",
  "dc:date": "2020-12-03T18:15+09:00",
  "dcterms:issued": "2020-12-03T18:15+09:00",
  "dcterms:modified": "2020-12-03T18:15+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below.\r\n* Clickjacking attacks (CWE-1021) - CVE-2020-5679\r\n* Improper input validation (CWE-20) - CVE-2020-5680\r\n\r\nEC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "@version": "2.0"
    },
    {
      "@score": "5.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN24457594/index.html",
      "@id": "JVN#24457594",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5679",
      "@id": "CVE-2020-5679",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5680",
      "@id": "CVE-2020-5680",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5679",
      "@id": "CVE-2020-5679",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5680",
      "@id": "CVE-2020-5680",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE"
}

jvndb-2020-000039
Vulnerability from jvndb
Published
2020-06-18 13:48
Modified
2020-06-18 13:48
Severity ?
4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
EC-CUBE vulnerable to directory traversal
Details
EC-CUBE provided by EC-CUBE CO.,LTD. contains a directory traversal vulnerability (CWE-22). EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000039.html",
  "dc:date": "2020-06-18T13:48+09:00",
  "dcterms:issued": "2020-06-18T13:48+09:00",
  "dcterms:modified": "2020-06-18T13:48+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains a directory traversal vulnerability (CWE-22).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.\r\nJPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000039.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000039",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN77458946/index.html",
      "@id": "JVN#77458946",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5590",
      "@id": "CVE-2020-5590",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5590",
      "@id": "CVE-2020-5590",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal"
}

jvndb-2018-000127
Vulnerability from jvndb
Published
2018-11-28 17:24
Modified
2019-08-28 09:42
Severity ?
4.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Summary
EC-CUBE vulnerable to open redirect
Details
EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an open redirect vulnerability (CWE-601). LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000127.html",
  "dc:date": "2019-08-28T09:42+09:00",
  "dcterms:issued": "2018-11-28T17:24+09:00",
  "dcterms:modified": "2019-08-28T09:42+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an open redirect vulnerability (CWE-601).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000127.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000127",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN25359688/index.html",
      "@id": "JVN#25359688",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16191",
      "@id": "CVE-2018-16191",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-16191",
      "@id": "CVE-2018-16191",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "EC-CUBE vulnerable to open redirect"
}

jvndb-2018-000035
Vulnerability from jvndb
Published
2018-04-17 13:39
Modified
2018-08-22 17:42
Severity ?
4.2 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Summary
EC-CUBE vulnerable to session fixation
Details
EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability (CWE-384). LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000035.html",
  "dc:date": "2018-08-22T17:42+09:00",
  "dcterms:issued": "2018-04-17T13:39+09:00",
  "dcterms:modified": "2018-08-22T17:42+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability (CWE-384).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000035.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000035",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN52695336/index.html",
      "@id": "JVN#52695336",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0564",
      "@id": "CVE-2018-0564",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0564",
      "@id": "CVE-2018-0564",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE vulnerable to session fixation"
}

jvndb-2016-000053
Vulnerability from jvndb
Published
2016-04-26 14:24
Modified
2016-05-31 17:40
Severity ?
4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
EC-CUBE vulnerable to cross-site request forgery
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352). LOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000053.html",
  "dc:date": "2016-05-31T17:40+09:00",
  "dcterms:issued": "2016-04-26T14:24+09:00",
  "dcterms:modified": "2016-05-31T17:40+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000053.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000053",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN73776243/index.html",
      "@id": "JVN#73776243",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1201",
      "@id": "CVE-2016-1201",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1201",
      "@id": "CVE-2016-1201",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

jvndb-2016-000051
Vulnerability from jvndb
Published
2016-04-26 13:56
Modified
2016-05-31 17:41
Severity ?
5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
EC-CUBE fails to restrict access permissions
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions. Note that this vulnerability is different from JVN#11458774. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000051.html",
  "dc:date": "2016-05-31T17:41+09:00",
  "dcterms:issued": "2016-04-26T13:56+09:00",
  "dcterms:modified": "2016-05-31T17:41+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions.\r\n\r\nNote that this vulnerability is different from JVN#11458774.\r\n\r\nGen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000051.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000051",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN47473944/index.html",
      "@id": "JVN#47473944",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1199",
      "@id": "CVE-2016-1199",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1199",
      "@id": "CVE-2016-1199",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

jvndb-2016-000052
Vulnerability from jvndb
Published
2016-04-26 13:56
Modified
2016-05-31 17:41
Severity ?
5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Summary
EC-CUBE fails to restrict access permissions
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions. Note that this vulnerability is different from JVN#47473944. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000052.html",
  "dc:date": "2016-05-31T17:41+09:00",
  "dcterms:issued": "2016-04-26T13:56+09:00",
  "dcterms:modified": "2016-05-31T17:41+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions.\r\n\r\nNote that this vulnerability is different from JVN#47473944.\r\n\r\nGen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000052.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000052",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN11458774/index.html",
      "@id": "JVN#11458774",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1200",
      "@id": "CVE-2016-1200",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1200",
      "@id": "CVE-2016-1200",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

jvndb-2015-000166
Vulnerability from jvndb
Published
2015-10-26 12:27
Modified
2015-11-13 19:36
Severity ?
() - -
Summary
EC-CUBE vulnerable to cross-site request forgery
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352). Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000166.html",
  "dc:date": "2015-11-13T19:36+09:00",
  "dcterms:issued": "2015-10-26T12:27+09:00",
  "dcterms:modified": "2015-11-13T19:36+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nGen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000166.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2015-000166",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN97278546/index.html",
      "@id": "JVN#97278546",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5665",
      "@id": "CVE-2015-5665",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5665",
      "@id": "CVE-2015-5665",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

jvndb-2014-000006
Vulnerability from jvndb
Published
2014-01-22 15:28
Modified
2024-05-15 14:59
Severity ?
() - -
Summary
EC-CUBE vulnerable to authorization bypass
Details
EC-CUBE contains an authorization bypass vulnerability. EC-CUBE from EC-CUBE CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an authorization bypass vulnerability (CWE-639). The developer reported this vulnerability to JPCERT/CC under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000006.html",
  "dc:date": "2024-05-15T14:59+09:00",
  "dcterms:issued": "2014-01-22T15:28+09:00",
  "dcterms:modified": "2024-05-15T14:59+09:00",
  "description": "EC-CUBE contains an authorization bypass vulnerability.\r\n\r\nEC-CUBE from EC-CUBE CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an authorization bypass vulnerability (CWE-639).\r\n\r\nThe developer reported this vulnerability to JPCERT/CC under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000006.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000006",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN51770585/index.html",
      "@id": "JVN#51770585",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0808",
      "@id": "CVE-2014-0808",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0808",
      "@id": "CVE-2014-0808",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE vulnerable to authorization bypass"
}

jvndb-2014-000005
Vulnerability from jvndb
Published
2014-01-22 15:27
Modified
2014-01-27 09:51
Severity ?
() - -
Summary
EC-CUBE vulnerable to information alteration
Details
EC-CUBE contains an information alteration vulnerability. EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information alteration vulnerability. aratana inc. reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000005.html",
  "dc:date": "2014-01-27T09:51+09:00",
  "dcterms:issued": "2014-01-22T15:27+09:00",
  "dcterms:modified": "2014-01-27T09:51+09:00",
  "description": "EC-CUBE contains an information alteration vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information alteration vulnerability.\r\n\r\naratana inc. reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000005.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000005",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN17849447/index.html",
      "@id": "JVN#17849447",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0807",
      "@id": "CVE-2014-0807",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0807",
      "@id": "CVE-2014-0807",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE vulnerable to information alteration"
}

jvndb-2013-000106
Vulnerability from jvndb
Published
2013-11-20 16:14
Modified
2013-11-22 14:18
Severity ?
() - -
Summary
EC-CUBE information disclosure vulnerability
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability due to an issue in processing front features. LAC Co., Ltd. reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000106.html",
  "dc:date": "2013-11-22T14:18+09:00",
  "dcterms:issued": "2013-11-20T16:14+09:00",
  "dcterms:modified": "2013-11-22T14:18+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability due to an issue in processing front features.\r\n\r\nLAC Co., Ltd. reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000106.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.5",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000106",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN55630933/index.html",
      "@id": "JVN#55630933",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5995",
      "@id": "CVE-2013-5995",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5995",
      "@id": "CVE-2013-5995",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/ciadr/vul/20131120-jvn.html",
      "@id": "Security Alert for EC-CUBE information disclosure vulnerability (JVN#55630933)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "EC-CUBE information disclosure vulnerability"
}

jvndb-2013-000107
Vulnerability from jvndb
Published
2013-11-20 15:56
Modified
2013-11-22 13:57
Severity ?
() - -
Summary
EC-CUBE vulnerable to cross-site scripting
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. LAC Co., Ltd. reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000107.html",
  "dc:date": "2013-11-22T13:57+09:00",
  "dcterms:issued": "2013-11-20T15:56+09:00",
  "dcterms:modified": "2013-11-22T13:57+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\n\r\nLAC Co., Ltd. reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000107.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000107",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN06377589/index.html",
      "@id": "JVN#06377589",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5996",
      "@id": "CVE-2013-5996",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5996",
      "@id": "CVE-2013-5996",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

jvndb-2013-000098
Vulnerability from jvndb
Published
2013-11-20 15:48
Modified
2013-11-22 14:35
Severity ?
() - -
Summary
EC-CUBE information disclosure vulnerability
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability. Gen Sato reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000098.html",
  "dc:date": "2013-11-22T14:35+09:00",
  "dcterms:issued": "2013-11-20T15:48+09:00",
  "dcterms:modified": "2013-11-22T14:35+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability.\r\n\r\nGen Sato reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000098.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000098",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN06870202/index.html",
      "@id": "JVN#06870202",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5994",
      "@id": "CVE-2013-5994",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5994",
      "@id": "CVE-2013-5994",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "EC-CUBE information disclosure vulnerability"
}

jvndb-2013-000097
Vulnerability from jvndb
Published
2013-11-20 15:40
Modified
2013-11-22 14:37
Severity ?
() - -
Summary
EC-CUBE vulnerable to cross-site request forgery
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability. Gen Sato reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000097.html",
  "dc:date": "2013-11-22T14:37+09:00",
  "dcterms:issued": "2013-11-20T15:40+09:00",
  "dcterms:modified": "2013-11-22T14:37+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability.\r\n\r\nGen Sato reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000097.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000097",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN11221613/index.html",
      "@id": "JVN#11221613",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5993",
      "@id": "CVE-2013-5993",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5993",
      "@id": "CVE-2013-5993",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

jvndb-2013-000105
Vulnerability from jvndb
Published
2013-11-20 15:34
Modified
2013-11-22 14:40
Severity ?
() - -
Summary
EC-CUBE vulnerable to cross-site scripting
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error messages, which may lead to cross-site scripting. Gen Sato reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000105.html",
  "dc:date": "2013-11-22T14:40+09:00",
  "dcterms:issued": "2013-11-20T15:34+09:00",
  "dcterms:modified": "2013-11-22T14:40+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error messages, which may lead to cross-site scripting.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000105.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000105",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN38790987/index.html",
      "@id": "JVN#38790987",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5992",
      "@id": "CVE-2013-5992",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5992",
      "@id": "CVE-2013-5992",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

jvndb-2013-000104
Vulnerability from jvndb
Published
2013-11-20 15:19
Modified
2013-11-22 14:42
Severity ?
() - -
Summary
EC-CUBE vulnerable to information disclosure
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error logs, which may lead to information disclosure. Gen Sato reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000104.html",
  "dc:date": "2013-11-22T14:42+09:00",
  "dcterms:issued": "2013-11-20T15:19+09:00",
  "dcterms:modified": "2013-11-22T14:42+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error logs, which may lead to information disclosure.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000104.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000104",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN61077110/index.html",
      "@id": "JVN#61077110",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5991",
      "@id": "CVE-2013-5991",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5991",
      "@id": "CVE-2013-5991",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "EC-CUBE vulnerable to information disclosure"
}

jvndb-2013-000081
Vulnerability from jvndb
Published
2013-08-30 14:38
Modified
2013-09-02 18:25
Severity ?
() - -
Summary
EC-CUBE vulnerable to directory traversal when used in Windows
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability when used in Windows. Gen Sato reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000081.html",
  "dc:date": "2013-09-02T18:25+09:00",
  "dcterms:issued": "2013-08-30T14:38+09:00",
  "dcterms:modified": "2013-09-02T18:25+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability when used in Windows.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000081.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000081",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN15973066/index.html",
      "@id": "JVN#15973066",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4702",
      "@id": "CVE-2013-4702",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4702",
      "@id": "CVE-2013-4702",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal when used in Windows"
}

jvndb-2013-000065
Vulnerability from jvndb
Published
2013-06-27 14:33
Modified
2013-07-02 16:15
Severity ?
() - -
Summary
EC-CUBE vulnerable to directory traversal
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability. Note that this vulnerability is different from JVN#43886811. LOCKON CO.,LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. LOCKON CO.,LTD. credits System Friend,lnc. for reporting this vulnerability.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000065.html",
  "dc:date": "2013-07-02T16:15+09:00",
  "dcterms:issued": "2013-06-27T14:33+09:00",
  "dcterms:modified": "2013-07-02T16:15+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability.\r\n\r\nNote that this vulnerability is different from JVN#43886811.\r\nLOCKON CO.,LTD. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\nLOCKON CO.,LTD. credits System Friend,lnc. for reporting this vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000065.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000065",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN04161229/index.html",
      "@id": "JVN#04161229",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3654",
      "@id": "CVE-2013-3654",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3654",
      "@id": "CVE-2013-3654",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal"
}

jvndb-2013-000063
Vulnerability from jvndb
Published
2013-06-27 14:31
Modified
2013-07-02 16:06
Severity ?
() - -
Summary
EC-CUBE vulnerable to cross-site scripting
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. Note that this vulnerability is different from JVN#98665228. Daiki Ishimori of Gehirn Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000063.html",
  "dc:date": "2013-07-02T16:06+09:00",
  "dcterms:issued": "2013-06-27T14:31+09:00",
  "dcterms:modified": "2013-07-02T16:06+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\n\r\nNote that this vulnerability is different from JVN#98665228.\r\n\r\nDaiki Ishimori of Gehirn Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000063.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000063",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN07192063/index.html",
      "@id": "JVN#07192063",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3652",
      "@id": "CVE-2013-3652",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3652",
      "@id": "CVE-2013-3652",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

jvndb-2013-000064
Vulnerability from jvndb
Published
2013-06-27 14:31
Modified
2013-07-02 16:10
Severity ?
() - -
Summary
EC-CUBE vulnerable to cross-site scripting
Details
EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability. Note that this vulnerability is different from JVN#07192063. Ren Hirasawa of Gehirn Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000064.html",
  "dc:date": "2013-07-02T16:10+09:00",
  "dcterms:issued": "2013-06-27T14:31+09:00",
  "dcterms:modified": "2013-07-02T16:10+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\n\r\nNote that this vulnerability is different from JVN#07192063.\r\n\r\nRen Hirasawa of Gehirn Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000064.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000064",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN98665228/index.html",
      "@id": "JVN#98665228",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3653",
      "@id": "CVE-2013-3653",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3653",
      "@id": "CVE-2013-3653",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}