Skip to content
Noroxi

lockon records

26 published records for vendor lockon.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
7.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2014-0808
    37Monitor

    Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29

    CriticalCVSS 9.1No exploitEPSS 2%

    lockon · ec-cubeJan 22, 2014

  • CVE-2016-1201
    35Monitor

    Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication o

    HighCVSS 8.8No exploitEPSS 1%

    lockon · ec-cubeApr 30, 2016

  • CVE-2018-0564
    32Monitor

    Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE

    HighCVSS 8.1No exploitEPSS 1%

    lockon · ec-cubeApr 20, 2018

  • CVE-2013-3651
    31Monitor

    LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related

    HighCVSS 7.5Proof of conceptEPSS 4%

    lockon · ec-cubeJun 30, 2013

  • CVE-2011-3988
    31Monitor

    SQL injection vulnerability in data/class/SC_Query.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL com

    HighCVSS 7.5No exploitEPSS 2%

    lockon · ec-cubeOct 21, 2011

  • CVE-2013-5993
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication

    MediumCVSS 6.8No exploitEPSS 1%

    lockon · ec-cubeNov 21, 2013

  • CVE-2014-0807
    25Monitor

    data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers

    MediumCVSS 6.4No exploitEPSS 2%

    lockon · ec-cubeJan 22, 2014

  • CVE-2016-1200
    25Monitor

    The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via uns

    MediumCVSS 6.3No exploitEPSS 1%

    lockon · ec-cubeApr 30, 2016

  • CVE-2011-1325
    23Monitor

    Cross-site request forgery (CSRF) vulnerability in EC-CUBE before 2.11.0 allows remote attackers to hijack the authentication of unspecified

    MediumCVSS 5.8No exploitEPSS 1%

    lockon · ec-cubeMay 13, 2011

  • CVE-2013-5995
    22Monitor

    data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authentic

    MediumCVSS 5.5No exploitEPSS 1%

    lockon · ec-cubeNov 21, 2013

  • CVE-2013-4702
    21Monitor

    Multiple directory traversal vulnerabilities in the doApiAction function in data/class/api/SC_Api_Operation.php in LOCKON EC-CUBE 2.12.0 thr

    MediumCVSS 5.0No exploitEPSS 2%

    lockon · ec-cubeAug 30, 2013

  • CVE-2013-3650
    21Monitor

    Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.

    MediumCVSS 5.0No exploitEPSS 2%

    lockon · ec-cubeJun 30, 2013

  • CVE-2013-3654
    21Monitor

    Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors

    MediumCVSS 5.0No exploitEPSS 2%

    lockon · ec-cubeJun 30, 2013

  • CVE-2016-1199
    21Monitor

    The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrict

    MediumCVSS 5.3No exploitEPSS 1%

    lockon · ec-cubeApr 30, 2016

  • CVE-2013-5994
    20Monitor

    data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive

    MediumCVSS 5.0No exploitEPSS 2%

    lockon · ec-cubeNov 21, 2013

  • CVE-2013-2315
    20Monitor

    data/class/pages/forgot/LC_Page_Forgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password

    MediumCVSS 5.0No exploitEPSS 1%

    lockon · ec-cubeMay 29, 2013

  • CVE-2015-5665
    20Monitor

    Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.3 allows remote attackers to hijack the authentication

    MediumCVSS 5.1No exploitEPSS 1%

    lockon · ec-cubeOct 26, 2015

  • CVE-2013-3652
    19Monitor

    Cross-site scripting (XSS) vulnerability in data/class/pages/products/LC_Page_Products_List.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allo

    MediumCVSS 4.3No exploitEPSS 6%

    lockon · ec-cubeJun 30, 2013

  • CVE-2011-0451
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/camp

    MediumCVSS 4.3No exploitEPSS 2%

    lockon · ec-cubeFeb 3, 2011

  • CVE-2013-5996
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote

    MediumCVSS 4.3No exploitEPSS 2%

    lockon · ec-cubeNov 21, 2013

  • CVE-2013-3653
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5

    MediumCVSS 4.3No exploitEPSS 2%

    lockon · ec-cubeJun 30, 2013

  • CVE-2013-2314
    18Monitor

    Cross-site scripting (XSS) vulnerability in the adminAuthorization function in data/class/helper/SC_Helper_Session.php in LOCKON EC-CUBE 2.1

    MediumCVSS 4.3No exploitEPSS 2%

    lockon · ec-cubeMay 29, 2013

  • CVE-2013-2312
    18Monitor

    Cross-site scripting (XSS) vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to

    MediumCVSS 4.3No exploitEPSS 2%

    lockon · ec-cubeMay 29, 2013

  • CVE-2013-2313
    17Monitor

    Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified ve

    MediumCVSS 4.0No exploitEPSS 2%

    lockon · ec-cubeMay 29, 2013

  • CVE-2013-5991
    17Monitor

    The displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive

    MediumCVSS 4.3No exploitEPSS 1%

    lockon · ec-cubeNov 21, 2013