CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-2098
https://notcve.org/view.php?id=CVE-2017-2098
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en CubeCart en versiones anteriores a 6.1.4 permite a los atacantes autenticados remotos leer archivos arbitrarios a través de vectores no especificados. • http://jvn.jp/en/jp/JVN81618356/index.html http://www.securityfocus.com/bid/95866 https://forums.cubecart.com/topic/52088-cubecart-614-released • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-2090
https://notcve.org/view.php?id=CVE-2017-2090
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en CubeCart en versiones anteriores a 6.1.4 permite a los atacantes autenticados remotos leer archivos arbitrarios a través de vectores no especificados. • http://jvn.jp/en/jp/JVN73182875/index.html http://www.securityfocus.com/bid/96429 https://support.cybozu.com/ja-jp/article/9499 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-2117
https://notcve.org/view.php?id=CVE-2017-2117
Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en CubeCart en versiones anteriores a 6.1.5 permite al atacante con derechos de administrador leer archivos arbitrarios a través de vectores no especificados. • http://jvn.jp/en/jp/JVN63474730/index.html http://www.securityfocus.com/bid/96466 https://forums.cubecart.com/topic/52188-cubecart-615-released • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 16%CPEs: 9EXPL: 2CVE-2014-2341 – CubeCart 5.2.8 - Session Fixation
https://notcve.org/view.php?id=CVE-2014-2341
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter. Vulnerabilidad de fijación de sesión en CubeCart anterior a 5.2.9 permite a atacantes remotos secuestrar sesiones web a través del parámetro PHPSESSID. • https://www.exploit-db.com/exploits/32830 http://forums.cubecart.com/topic/48427-cubecart-529-relased http://secunia.com/advisories/57856 http://www.exploit-db.com/exploits/32830 http://www.osvdb.org/105784 http://www.securityfocus.com/bid/66805 http://www.securitytracker.com/id/1030086 https://exchange.xforce.ibmcloud.com/vulnerabilities/92526 • CWE-287: Improper Authentication •
CVSS: 5.8EPSS: 1%CPEs: 21EXPL: 9CVE-2012-0865 – CubeCart 3.0.20 - '/admin/login.php?goto' Arbitrary Site Redirect
https://notcve.org/view.php?id=CVE-2012-0865
Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php. Múltiples vulnerabilidades de redirección abierta en CubeCart v3.0.20 y anteriores permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarias y llevar a cabo ataques de phishing a través de una URL en el parámetro (1) r para switch.php o (2) el parámetro goto para admin / login. php. • https://www.exploit-db.com/exploits/36686 https://www.exploit-db.com/exploits/36685 https://www.exploit-db.com/exploits/36687 http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.html http://osvdb.org/79140 http://osvdb.org/79141 http://www.openwall.com/lists/oss-security/2012/02/12/4 http://www.openwall.com/lists/oss-security/2012/02/13/5 http://www.openwall.com/lists/oss-security/2012/02/18/1 http://www.securityfocus.com/bid/51966 http:&#x • CWE-20: Improper Input Validation •