{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000062.html",
  "dc:date": "2013-07-02T16:01+09:00",
  "dcterms:issued": "2013-06-27T14:29+09:00",
  "dcterms:modified": "2013-07-02T16:01+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a code injection vulnerability.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000062.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000062",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN34900750/index.html",
      "@id": "JVN#34900750",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3651",
      "@id": "CVE-2013-3651",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3651",
      "@id": "CVE-2013-3651",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/ciadr/vul/20130627-jvn.html",
      "@id": "Security Updates Available for EC-CUBE (JVN#34900750)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-94",
      "@title": "Code Injection(CWE-94)"
    }
  ],
  "title": "EC-CUBE vulnerable to code injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000042.html",
  "dc:date": "2013-05-23T14:15+09:00",
  "dcterms:issued": "2013-05-23T14:15+09:00",
  "dcterms:modified": "2013-05-23T14:15+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability.\r\n\r\nYuji Tounai of bogus.jp reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000042.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000042",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN00985872/index.html",
      "@id": "JVN#00985872",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2313",
      "@id": "CVE-2013-2313",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2313",
      "@id": "CVE-2013-2313",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE vulnerable to session fixation"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000107.html",
  "dc:date": "2024-05-09T17:17+09:00",
  "dcterms:issued": "2023-11-07T13:47+09:00",
  "dcterms:modified": "2024-05-09T17:17+09:00",
  "description": "EC-CUBE 3 series and 4 series provided by EC-CUBE CO.,LTD. contain an arbitrary code execution vulnerability (CWE-94) due to improper settings of the product\u0027s template engine \"Twig\".\r\n\r\nTakeshi Miura of N.F.Laboratories Inc. reported this vulnerability to EC-CUBE CO.,LTD.\r\nEC-CUBE CO.,LTD. Inc. reported this case to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000107.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.2",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000107",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN29195731/index.html",
      "@id": "JVN#29195731",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-46845",
      "@id": "CVE-2023-46845",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-46845",
      "@id": "CVE-2023-46845",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-94",
      "@title": "Code Injection(CWE-94)"
    }
  ],
  "title": "EC-CUBE 3 series and 4 series vulnerable to arbitrary code execution"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2006/JVNDB-2006-000781.html",
  "dc:date": "2008-05-21T00:00+09:00",
  "dcterms:issued": "2008-05-21T00:00+09:00",
  "dcterms:modified": "2008-05-21T00:00+09:00",
  "description": "EC-CUBE, an open source system for creating shopping websites, contains a cross-site scripting vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2006/JVNDB-2006-000781.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2006-000781",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN61543834/index.html",
      "@id": "JVN#61543834",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6108",
      "@id": "CVE-2006-6108",
      "@source": "CVE"
    },
    {
      "#text": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6108",
      "@id": "CVE-2006-6108",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/vuln/documents/2009/200907_ec-cube.html",
      "@id": "200907_ec-cube",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://secunia.com/advisories/22925",
      "@id": "SA22925",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/21146",
      "@id": "21146",
      "@source": "BID"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/30526",
      "@id": "30526",
      "@source": "XF"
    },
    {
      "#text": "http://securitytracker.com/id?1017277",
      "@id": "1017277",
      "@source": "SECTRACK"
    },
    {
      "#text": "http://www.frsirt.com/english/advisories/2006/4583",
      "@id": "FrSIRT/ADV-2006-4583",
      "@source": "FRSIRT"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE cross-site scripting vulnerability"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000044.html",
  "dc:date": "2013-05-23T15:46+09:00",
  "dcterms:issued": "2013-05-23T15:46+09:00",
  "dcterms:modified": "2013-05-23T15:46+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue with checking input values, which may result in information disclosure.\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\nLOCKON CO.,LTD. credits System Friend,lnc. for reporting this vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000044.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000044",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN39699406/index.html",
      "@id": "JVN#39699406",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2315",
      "@id": "CVE-2013-2315",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2315",
      "@id": "CVE-2013-2315",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "EC-CUBE vulnerable to information disclosure as a result of improper input checking"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000105.html",
  "dc:date": "2013-11-22T14:40+09:00",
  "dcterms:issued": "2013-11-20T15:34+09:00",
  "dcterms:modified": "2013-11-22T14:40+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error messages, which may lead to cross-site scripting.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000105.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000105",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN38790987/index.html",
      "@id": "JVN#38790987",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5992",
      "@id": "CVE-2013-5992",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5992",
      "@id": "CVE-2013-5992",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000035.html",
  "dc:date": "2018-08-22T17:42+09:00",
  "dcterms:issued": "2018-04-17T13:39+09:00",
  "dcterms:modified": "2018-08-22T17:42+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability (CWE-384).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000035.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000035",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN52695336/index.html",
      "@id": "JVN#52695336",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0564",
      "@id": "CVE-2018-0564",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0564",
      "@id": "CVE-2018-0564",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE vulnerable to session fixation"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000081.html",
  "dc:date": "2013-09-02T18:25+09:00",
  "dcterms:issued": "2013-08-30T14:38+09:00",
  "dcterms:modified": "2013-09-02T18:25+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability when used in Windows.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000081.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000081",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN15973066/index.html",
      "@id": "JVN#15973066",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4702",
      "@id": "CVE-2013-4702",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4702",
      "@id": "CVE-2013-4702",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal when used in Windows"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000052.html",
  "dc:date": "2016-05-31T17:41+09:00",
  "dcterms:issued": "2016-04-26T13:56+09:00",
  "dcterms:modified": "2016-05-31T17:41+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions.\r\n\r\nNote that this vulnerability is different from JVN#47473944.\r\n\r\nGen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000052.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.5",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000052",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN11458774/index.html",
      "@id": "JVN#11458774",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1200",
      "@id": "CVE-2016-1200",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1200",
      "@id": "CVE-2016-1200",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000082.html",
  "dc:date": "2024-03-25T18:07+09:00",
  "dcterms:issued": "2023-08-17T15:12+09:00",
  "dcterms:modified": "2024-03-25T18:07+09:00",
  "description": "EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79) in \"mail/template\" and \"products/product\" of Management page.\r\n\r\nShimamine Taihei of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000082.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.1",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000082",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN46993816/index.html",
      "@id": "JVN#46993816",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40281",
      "@id": "CVE-2023-40281",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40281",
      "@id": "CVE-2023-40281",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE 2 series vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000080.html",
  "dc:date": "2020-12-03T18:15+09:00",
  "dcterms:issued": "2020-12-03T18:15+09:00",
  "dcterms:modified": "2020-12-03T18:15+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below.\r\n* Clickjacking attacks (CWE-1021) - CVE-2020-5679\r\n* Improper input validation (CWE-20) - CVE-2020-5680\r\n\r\nEC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
      "@version": "2.0"
    },
    {
      "@score": "5.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN24457594/index.html",
      "@id": "JVN#24457594",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5679",
      "@id": "CVE-2020-5679",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5680",
      "@id": "CVE-2020-5680",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5679",
      "@id": "CVE-2020-5679",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5680",
      "@id": "CVE-2020-5680",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000005.html",
  "dc:date": "2014-01-27T09:51+09:00",
  "dcterms:issued": "2014-01-22T15:27+09:00",
  "dcterms:modified": "2014-01-27T09:51+09:00",
  "description": "EC-CUBE contains an information alteration vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information alteration vulnerability.\r\n\r\naratana inc. reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000005.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000005",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN17849447/index.html",
      "@id": "JVN#17849447",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0807",
      "@id": "CVE-2014-0807",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0807",
      "@id": "CVE-2014-0807",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE vulnerable to information alteration"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000015.html",
  "dc:date": "2024-06-21T17:39+09:00",
  "dcterms:issued": "2022-02-22T14:22+09:00",
  "dcterms:modified": "2024-06-21T17:39+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. improperly handles HTTP Host header values (CWE-913).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000015.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "3.1",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000015",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN53871926/index.html",
      "@id": "JVN#53871926",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-25355",
      "@id": "CVE-2022-25355",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355",
      "@id": "CVE-2022-25355",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE improperly handles HTTP Host header values"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000065.html",
  "dc:date": "2013-07-02T16:15+09:00",
  "dcterms:issued": "2013-06-27T14:33+09:00",
  "dcterms:modified": "2013-07-02T16:15+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability.\r\n\r\nNote that this vulnerability is different from JVN#43886811.\r\nLOCKON CO.,LTD. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\nLOCKON CO.,LTD. credits System Friend,lnc. for reporting this vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000065.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000065",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN04161229/index.html",
      "@id": "JVN#04161229",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3654",
      "@id": "CVE-2013-3654",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3654",
      "@id": "CVE-2013-3654",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000063.html",
  "dc:date": "2008-10-01T16:32+09:00",
  "dcterms:issued": "2008-10-01T16:32+09:00",
  "dcterms:modified": "2008-10-01T16:32+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site scripting vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\nThis vulnerability is different from JVN#61543834, JVN#26621646, and JVN#99916563.\r\n\r\nNaruhisa Tadokoro of Kobe Digital Labo.,Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000063.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-000063",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN36085487/index.html",
      "@id": "JVN#36085487",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4536",
      "@id": "CVE-2008-4536",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4536",
      "@id": "CVE-2008-4536",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/vuln/documents/2009/200907_ec-cube.html",
      "@id": "200907_ec-cube",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://secunia.com/advisories/32065",
      "@id": "SA32065",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000063.html",
      "@id": "JVNDB-2008-000063",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE cross-site scripting vulnerability"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000064.html",
  "dc:date": "2013-07-02T16:10+09:00",
  "dcterms:issued": "2013-06-27T14:31+09:00",
  "dcterms:modified": "2013-07-02T16:10+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\n\r\nNote that this vulnerability is different from JVN#07192063.\r\n\r\nRen Hirasawa of Gehirn Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000064.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000064",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN98665228/index.html",
      "@id": "JVN#98665228",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3653",
      "@id": "CVE-2013-3653",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3653",
      "@id": "CVE-2013-3653",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000073.html",
  "dc:date": "2024-06-13T11:09+09:00",
  "dcterms:issued": "2022-09-15T16:30+09:00",
  "dcterms:modified": "2024-06-13T11:09+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below. \r\n  * Directory traversal vulnerability (CWE-22) - CVE-2022-40199 \r\n  * DOM-based cross-site scripting vulnerability (CWE-79) - CVE-2022-38975 \r\n\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported them to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000073.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "2.7",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000073",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN21213852/index.html",
      "@id": "JVN#21213852",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-40199",
      "@id": "CVE-2022-40199",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-38975",
      "@id": "CVE-2022-38975",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-40199",
      "@id": "CVE-2022-40199",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-38975",
      "@id": "CVE-2022-38975",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000006.html",
  "dc:date": "2024-05-15T14:59+09:00",
  "dcterms:issued": "2014-01-22T15:28+09:00",
  "dcterms:modified": "2024-05-15T14:59+09:00",
  "description": "EC-CUBE contains an authorization bypass vulnerability.\r\n\r\nEC-CUBE from EC-CUBE CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an authorization bypass vulnerability (CWE-639).\r\n\r\nThe developer reported this vulnerability to JPCERT/CC under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000006.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000006",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN51770585/index.html",
      "@id": "JVN#51770585",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0808",
      "@id": "CVE-2014-0808",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0808",
      "@id": "CVE-2014-0808",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE vulnerable to authorization bypass"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000075.html",
  "dc:date": "2009-06-25T15:44+09:00",
  "dcterms:issued": "2008-11-06T16:04+09:00",
  "dcterms:modified": "2009-06-25T15:44+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. contains a SQL injection vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a SQL injection vulnerability.\r\n\r\nThis vulnerability is different from JVN#81111541.\r\n\r\nAn updated version addressing this vulnerability was released on November 7, 2008",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000075.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-000075",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN19072922/index.html",
      "@id": "JVN#19072922",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4991",
      "@id": "CVE-2008-4991",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4991",
      "@id": "CVE-2008-4991",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/english/vuln/200811_EC-CUBE_en.html",
      "@id": "Security Alert for EC-CUBE Vulnerability",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://www.ipa.go.jp/security/vuln/documents/2009/200907_ec-cube.html",
      "@id": "200907_ec-cube",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000075.html",
      "@id": "JVNDB-2008-000075",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "EC-CUBE vulnerable to SQL injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000166.html",
  "dc:date": "2015-11-13T19:36+09:00",
  "dcterms:issued": "2015-10-26T12:27+09:00",
  "dcterms:modified": "2015-11-13T19:36+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nGen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000166.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2015-000166",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN97278546/index.html",
      "@id": "JVN#97278546",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5665",
      "@id": "CVE-2015-5665",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5665",
      "@id": "CVE-2015-5665",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000039.html",
  "dc:date": "2020-06-18T13:48+09:00",
  "dcterms:issued": "2020-06-18T13:48+09:00",
  "dcterms:modified": "2020-06-18T13:48+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains a directory traversal vulnerability (CWE-22).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.\r\nJPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000039.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000039",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN77458946/index.html",
      "@id": "JVN#77458946",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5590",
      "@id": "CVE-2020-5590",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2020-5590",
      "@id": "CVE-2020-5590",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000106.html",
  "dc:date": "2013-11-22T14:18+09:00",
  "dcterms:issued": "2013-11-20T16:14+09:00",
  "dcterms:modified": "2013-11-22T14:18+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability due to an issue in processing front features.\r\n\r\nLAC Co., Ltd. reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000106.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.5",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000106",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN55630933/index.html",
      "@id": "JVN#55630933",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5995",
      "@id": "CVE-2013-5995",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5995",
      "@id": "CVE-2013-5995",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/ciadr/vul/20131120-jvn.html",
      "@id": "Security Alert for EC-CUBE information disclosure vulnerability (JVN#55630933)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "EC-CUBE information disclosure vulnerability"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000080.html",
  "dc:date": "2024-07-30T13:56+09:00",
  "dcterms:issued": "2024-07-30T13:56+09:00",
  "dcterms:modified": "2024-07-30T13:56+09:00",
  "description": "EC-CUBE 4 series provided by EC-CUBE CO.,LTD improperly validates inputs when installing plugins (CWE-349).\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.8",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN48324254/index.html",
      "@id": "JVN#48324254",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-41924",
      "@id": "CVE-2024-41924",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "EC-CUBE 4 Series improper input validation when installing plugins"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000100.html",
  "dc:date": "2021-11-11T15:09+09:00",
  "dcterms:issued": "2021-11-11T15:09+09:00",
  "dcterms:modified": "2021-11-11T15:09+09:00",
  "description": "EC-CUBE 2 series provided by EC-CUBE CO.,LTD. contains multiple vulnerabilities listed below.\r\n* Improper access control in Management screen (CWE-284) - CVE-2021-20841\r\n* Cross-site request forgery vulnerability in Management screen (CWE-352) - CVE-2021-20842\r\n\r\nEC-CUBE CO.,LTD. reported these vulnerabilities to JPCERT/CC to notify users of the solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000100.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000100",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN75444925/index.html",
      "@id": "JVN#75444925",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20841",
      "@id": "CVE-2021-20841",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20842",
      "@id": "CVE-2021-20842",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20841",
      "@id": "CVE-2021-20841",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20842",
      "@id": "CVE-2021-20842",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "Multiple vulnerabilities in EC-CUBE 2 series"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000057.html",
  "dc:date": "2021-06-23T15:15+09:00",
  "dcterms:issued": "2021-06-23T15:15+09:00",
  "dcterms:modified": "2021-06-23T15:15+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below.\r\n*Cross-site scripting vulnerability (CWE-79) - CVE-2021-20750\r\n*Cross-site scripting vulnerability (CWE-79) - CVE-2021-20751\r\n\r\nhibiki moriyama of STNet, Incorporated reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000057.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "6.1",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000057",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN95292458/index.html",
      "@id": "JVN#95292458",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20750",
      "@id": "CVE-2021-20750",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20751",
      "@id": "CVE-2021-20751",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20750",
      "@id": "CVE-2021-20750",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20751",
      "@id": "CVE-2021-20751",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple cross-site scripting vulnerabilities in EC-CUBE"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000041.html",
  "dc:date": "2013-05-23T14:11+09:00",
  "dcterms:issued": "2013-05-23T14:11+09:00",
  "dcterms:modified": "2013-05-23T14:11+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in handling the output of parameters, which may result in cross-site scripting.\r\n\r\nYuji Tounai of bogus.jp reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000041.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000041",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN52552792/index.html",
      "@id": "JVN#52552792",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2312",
      "@id": "CVE-2013-2312",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2312",
      "@id": "CVE-2013-2312",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000087.html",
  "dc:date": "2011-10-14T17:53+09:00",
  "dcterms:issued": "2011-10-14T17:53+09:00",
  "dcterms:modified": "2011-10-14T17:53+09:00",
  "description": "EC-CUBE contains a SQL injection vulnerability.\r\n\r\nEC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an issue in assembling SQL statements, leading to a SQL injection vulnerability.\r\nThis vulnerability is different from JVN#81111541 and JVN#19072922.\r\n\r\nTsukada Nobuhisa of Seasoft reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000087.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2011-000087",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN44496332/index.html",
      "@id": "JVN#44496332",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3988",
      "@id": "CVE-2011-3988",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3988",
      "@id": "CVE-2011-3988",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/english/vuln/201110_eccube_en.html",
      "@id": "Security Alert for Vulnerability in EC-CUBE",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "EC-CUBE vulnerable to SQL injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000104.html",
  "dc:date": "2013-11-22T14:42+09:00",
  "dcterms:issued": "2013-11-20T15:19+09:00",
  "dcterms:modified": "2013-11-22T14:42+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error logs, which may lead to information disclosure.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000104.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000104",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN61077110/index.html",
      "@id": "JVN#61077110",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5991",
      "@id": "CVE-2013-5991",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5991",
      "@id": "CVE-2013-5991",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "EC-CUBE vulnerable to information disclosure"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000035.html",
  "dc:date": "2021-05-10T18:08+09:00",
  "dcterms:issued": "2021-05-10T18:08+09:00",
  "dcterms:modified": "2021-05-10T18:08+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability (CWE-79).\r\nAn arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE.\r\n\r\nAs of 2021 May 10, an attack exploting this vulnerability has been observed in the wild.\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000035.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.1",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000035",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN97554111/index.html",
      "@id": "JVN#97554111",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20717",
      "@id": "CVE-2021-20717",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20717",
      "@id": "CVE-2021-20717",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/security/ciadr/vul/20210510-jvn.html",
      "@id": "Regarding cross-site scripting vulnerability in EC-CUBE (JVN#97554111)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.jpcert.or.jp/english/at/2021/at210022.html",
      "@id": "Alert Regarding Cross Site Scripting Vulnerability (CVE-2021-20717) in EC-CUBE",
      "@source": "JPCERT"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000061.html",
  "dc:date": "2013-07-02T15:57+09:00",
  "dcterms:issued": "2013-06-27T14:29+09:00",
  "dcterms:modified": "2013-07-02T15:57+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a directory traversal vulnerability.\r\n\r\nNote that this vulnerability is different from JVN#04161229.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000061.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000061",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN43886811/index.html",
      "@id": "JVN#43886811",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3650",
      "@id": "CVE-2013-3650",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3650",
      "@id": "CVE-2013-3650",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "EC-CUBE vulnerable to directory traversal"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000098.html",
  "dc:date": "2013-11-22T14:35+09:00",
  "dcterms:issued": "2013-11-20T15:48+09:00",
  "dcterms:modified": "2013-11-22T14:35+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability.\r\n\r\nGen Sato reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000098.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000098",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN06870202/index.html",
      "@id": "JVN#06870202",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5994",
      "@id": "CVE-2013-5994",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5994",
      "@id": "CVE-2013-5994",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "EC-CUBE information disclosure vulnerability"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000063.html",
  "dc:date": "2013-07-02T16:06+09:00",
  "dcterms:issued": "2013-06-27T14:31+09:00",
  "dcterms:modified": "2013-07-02T16:06+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\n\r\nNote that this vulnerability is different from JVN#98665228.\r\n\r\nDaiki Ishimori of Gehirn Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000063.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000063",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN07192063/index.html",
      "@id": "JVN#07192063",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3652",
      "@id": "CVE-2013-3652",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3652",
      "@id": "CVE-2013-3652",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000059.html",
  "dc:date": "2021-07-01T15:49+09:00",
  "dcterms:issued": "2021-07-01T15:49+09:00",
  "dcterms:modified": "2021-07-01T15:49+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions (CWE-284) .\r\n\r\nEC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000059.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000059",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN57942445/index.html",
      "@id": "JVN#57942445",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20778",
      "@id": "CVE-2021-20778",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20778",
      "@id": "CVE-2021-20778",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000062.html",
  "dc:date": "2008-10-01T16:32+09:00",
  "dcterms:issued": "2008-10-01T16:32+09:00",
  "dcterms:modified": "2008-10-01T16:32+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site scripting vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\nThis vulnerability is different from JVN#61543834, JVN#36085487, and JVN#99916563.\r\n\r\nMasako Oono of NetAgent Co., Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000062.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-000062",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN26621646/index.html",
      "@id": "JVN#26621646",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4537",
      "@id": "CVE-2008-4537",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4537",
      "@id": "CVE-2008-4537",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/vuln/documents/2009/200907_ec-cube.html",
      "@id": "200907_ec-cube",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://secunia.com/advisories/32065",
      "@id": "SA32065",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://secunia.com/advisories/32065",
      "@id": "SA32065",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000062.html",
      "@id": "JVNDB-2008-000062",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE cross-site scripting vulnerability"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000097.html",
  "dc:date": "2013-11-22T14:37+09:00",
  "dcterms:issued": "2013-11-20T15:40+09:00",
  "dcterms:modified": "2013-11-22T14:37+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability.\r\n\r\nGen Sato reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000097.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000097",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN11221613/index.html",
      "@id": "JVN#11221613",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5993",
      "@id": "CVE-2013-5993",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5993",
      "@id": "CVE-2013-5993",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000053.html",
  "dc:date": "2016-05-31T17:40+09:00",
  "dcterms:issued": "2016-04-26T14:24+09:00",
  "dcterms:modified": "2016-05-31T17:40+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000053.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000053",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN73776243/index.html",
      "@id": "JVN#73776243",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1201",
      "@id": "CVE-2016-1201",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1201",
      "@id": "CVE-2016-1201",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000051.html",
  "dc:date": "2016-05-31T17:41+09:00",
  "dcterms:issued": "2016-04-26T13:56+09:00",
  "dcterms:modified": "2016-05-31T17:41+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE fails to restrict access permissions.\r\n\r\nNote that this vulnerability is different from JVN#11458774.\r\n\r\nGen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000051.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000051",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN47473944/index.html",
      "@id": "JVN#47473944",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1199",
      "@id": "CVE-2016-1199",
      "@source": "CVE"
    },
    {
      "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1199",
      "@id": "CVE-2016-1199",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000107.html",
  "dc:date": "2013-11-22T13:57+09:00",
  "dcterms:issued": "2013-11-20T15:56+09:00",
  "dcterms:modified": "2013-11-22T13:57+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\n\r\nLAC Co., Ltd. reported this vulnerability to the developer.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000107.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000107",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN06377589/index.html",
      "@id": "JVN#06377589",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5996",
      "@id": "CVE-2013-5996",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5996",
      "@id": "CVE-2013-5996",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000065.html",
  "dc:date": "2008-10-01T16:31+09:00",
  "dcterms:issued": "2008-10-01T16:31+09:00",
  "dcterms:modified": "2008-10-01T16:31+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. contains a SQL injection vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a SQL injection vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000065.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-000065",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN81111541/index.html",
      "@id": "JVN#81111541",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4534",
      "@id": "CVE-2008-4534",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4534",
      "@id": "CVE-2008-4534",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/vuln/documents/2009/200907_ec-cube.html",
      "@id": "200907_ec-cube",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://www.ipa.go.jp/security/english/vuln/200810_EC-CUBE_en.html",
      "@id": "Security Alert for EC-CUBE Vulnerability",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://secunia.com/advisories/32065",
      "@id": "SA32065",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000065.html",
      "@id": "JVNDB-2008-000065",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "EC-CUBE vulnerable to SQL injection"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000078.html",
  "dc:date": "2009-12-07T14:51+09:00",
  "dcterms:issued": "2009-12-07T14:51+09:00",
  "dcterms:modified": "2009-12-07T14:51+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. contains an information disclosure vulnerability. \r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an information disclosure vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000078.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2009-000078",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN79762947/index.html",
      "@id": "JVN#79762947",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4236",
      "@id": "CVE-2009-4236",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4236",
      "@id": "CVE-2009-4236",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/english/vuln/200912_ec-cube_en.html",
      "@id": "Security Alert for EC-CUBE Vulnerability",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://secunia.com/advisories/37603",
      "@id": "SA37603",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/54573",
      "@id": "54573",
      "@source": "XF"
    },
    {
      "#text": "http://www.vupen.com/english/advisories/2009/3421",
      "@id": "VUPEN/ADV-2009-3421",
      "@source": "VUPEN"
    },
    {
      "#text": "http://osvdb.org/60685",
      "@id": "60685",
      "@source": "OSVDB"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "EC-CUBE information disclosure vulnerability"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000011.html",
  "dc:date": "2011-02-02T14:54+09:00",
  "dcterms:issued": "2011-02-02T14:54+09:00",
  "dcterms:modified": "2011-02-02T14:54+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site scripting vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\n\r\nThis vulnerability is different than the previous vulnerabilities disclosed on JVN.\r\n\r\nTakeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000011.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2011-000011",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN84393059/index.html",
      "@id": "JVN#84393059",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0451",
      "@id": "CVE-2011-0451",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0451",
      "@id": "CVE-2011-0451",
      "@source": "NVD"
    },
    {
      "#text": "http://secunia.com/advisories/43153",
      "@id": "SA43153",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/46100",
      "@id": "46100",
      "@source": "BID"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/65079",
      "@id": "65079",
      "@source": "XF"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site scripting"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000127.html",
  "dc:date": "2019-08-28T09:42+09:00",
  "dcterms:issued": "2018-11-28T17:24+09:00",
  "dcterms:modified": "2019-08-28T09:42+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains an open redirect vulnerability (CWE-601).\r\n\r\nLOCKON CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LOCKON CO.,LTD. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000127.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.6",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000127",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN25359688/index.html",
      "@id": "JVN#25359688",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16191",
      "@id": "CVE-2018-16191",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-16191",
      "@id": "CVE-2018-16191",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    }
  ],
  "title": "EC-CUBE vulnerable to open redirect"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000019.html",
  "dc:date": "2024-06-10T17:28+09:00",
  "dcterms:issued": "2023-02-28T16:38+09:00",
  "dcterms:modified": "2024-06-10T17:28+09:00",
  "description": "EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below.\r\n\r\n* Cross-site scripting vulnerability in Contents Management (CWE-79) - CVE-2023-22438\r\n* Cross-site scripting vulnerability in Authentication Key Settings (CWE-79) - CVE-2023-25077\r\n* Cross-site scripting vulnerability in Product List Screen and Product Detail Screen (CWE-79) - CVE-2023-22838\r\n\r\nCVE-2023-22438\r\nGaku Mochizuki, Taiga Shirakura of Mitsui Bussan Secure Directions, Inc. and Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2023-25077\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. Inc. reported it to JPCERT/CC to notify users of its solution through JVN.\r\n\r\nCVE-2023-22838\r\nRei TAKAHASHI of Hashiura Lab., Dept. of Data Science, Nippon Institute of Technology reported this vulnerability to EC-CUBE CO.,LTD. and EC-CUBE CO.,LTD. reported it to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000019.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.4",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2023-000019",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN04785663/index.html",
      "@id": "JVN#04785663",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22438",
      "@id": "CVE-2023-22438",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-25077",
      "@id": "CVE-2023-25077",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2023-22838",
      "@id": "CVE-2023-22838",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22438",
      "@id": "CVE-2023-22438",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-22838",
      "@id": "CVE-2023-22838",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-25077",
      "@id": "CVE-2023-25077",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple cross-site scripting vulnerabilities in EC-CUBE"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000043.html",
  "dc:date": "2013-06-03T16:13+09:00",
  "dcterms:issued": "2013-05-23T15:42+09:00",
  "dcterms:modified": "2013-06-03T16:13+09:00",
  "description": "EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a URL handling issue in certain environments and as a result, access permissions are not restricted.\r\n\r\nGen Sato reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2013/JVNDB-2013-000043.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.4",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2013-000043",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN45306814/index.html",
      "@id": "JVN#45306814",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2314",
      "@id": "CVE-2013-2314",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2314",
      "@id": "CVE-2013-2314",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/ciadr/vul/20130523-jvn.html",
      "@id": "Security Updates Available for EC-CUBE (JVN#45306814)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "EC-CUBE fails to restrict access permissions"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000029.html",
  "dc:date": "2011-05-11T08:44+09:00",
  "dcterms:issued": "2011-05-11T08:44+09:00",
  "dcterms:modified": "2011-05-11T08:44+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site request forgery vulnerability.\r\n\r\nEC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability.\r\n\r\nMasako Oono reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000029.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2011-000029",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN37878530",
      "@id": "JVN#37878530",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1325",
      "@id": "CVE-2011-1325",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1325",
      "@id": "CVE-2011-1325",
      "@source": "NVD"
    },
    {
      "#text": "http://secunia.com/advisories/44487",
      "@id": "SA44487",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://osvdb.org/72239",
      "@id": "72239",
      "@source": "OSVDB"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "EC-CUBE vulnerable to cross-site request forgery"
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000064.html",
  "dc:date": "2008-10-01T16:31+09:00",
  "dcterms:issued": "2008-10-01T16:31+09:00",
  "dcterms:modified": "2008-10-01T16:31+09:00",
  "description": "EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site scripting vulnerability.\r\n\r\nEC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site scripting vulnerability.\r\nThis vulnerability is different from JVN#61543834, JVN#26621646, and JVN#36085487. \r\n\r\nYuya Yoshida of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000064.html",
  "sec:cpe": {
    "#text": "cpe:/a:ec-cube:ec-cube",
    "@product": "EC-CUBE",
    "@vendor": "EC-CUBE CO.,LTD.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-000064",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN99916563/index.html",
      "@id": "JVN#99916563",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4535",
      "@id": "CVE-2008-4535",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4535",
      "@id": "CVE-2008-4535",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/vuln/documents/2009/200907_ec-cube.html",
      "@id": "200907_ec-cube",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://secunia.com/advisories/32065",
      "@id": "SA32065",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000064.html",
      "@id": "JVNDB-2008-000064",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "EC-CUBE cross-site scripting vulnerability"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2014-0808",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T14:04:20.266694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-566",
                "description": "CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T14:07:16.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:27:20.153Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.ec-cube.net/info/weakness/weakness.php?id=57"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN51770585/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ec-orange.jp/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN15637138/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "2.11.0 through 2.12.2"
            }
          ]
        },
        {
          "product": "EC-Orange",
          "vendor": "S\u2011cubism Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "systems deployed before June 29th"
            },
            {
              "status": "affected",
              "version": " 2015"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users\u0027 information by sending a crafted HTTP request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T05:17:08.940Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "http://www.ec-cube.net/info/weakness/weakness.php?id=57"
        },
        {
          "url": "http://jvn.jp/en/jp/JVN51770585/"
        },
        {
          "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000006"
        },
        {
          "url": "https://ec-orange.jp/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN15637138/"
        },
        {
          "url": "https://jvndb.jvn.jp/jvndb/JVNDB-2024-000054"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2014-0808",
    "datePublished": "2014-01-22T21:00:00",
    "dateReserved": "2014-01-06T00:00:00",
    "dateUpdated": "2024-08-06T09:27:20.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:21.816Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0 to 4.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator\u0027s web browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-10T09:10:14",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20717",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0.0 to 4.0.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator\u0027s web browser."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/news/detail.php?news_id=384",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/news/detail.php?news_id=384"
            },
            {
              "name": "https://www.ec-cube.net/news/detail.php?news_id=383",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/news/detail.php?news_id=383"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN97554111/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN97554111/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20717",
    "datePublished": "2021-05-10T09:10:14",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:53:21.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions from 3.0.0 to 3.0.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-03T11:15:32",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5679",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from 3.0.0 to 3.0.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Restriction of Rendered UI Layers or Frames"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN24457594/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5679",
    "datePublished": "2020-12-03T11:15:32",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:39:25.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.017Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-28T00:50:41",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20751",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=78",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN95292458/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20751",
    "datePublished": "2021-06-28T00:50:41",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:53:22.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
          },
          {
            "name": "JVN#57942445",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.6 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-01T06:06:26",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
        },
        {
          "name": "JVN#57942445",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20778",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0.6 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=80",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN57942445/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN57942445/index.html"
            },
            {
              "name": "JVN#57942445",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN57942445/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20778",
    "datePublished": "2021-07-01T05:45:17",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:53:22.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:24.521Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0 to 3.0.18 and 4.0.0 to 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-19T09:35:18",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5590",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.0.0 to 3.0.18 and 4.0.0 to 4.0.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Directory traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=73",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=73"
            },
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=74",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=74"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN77458946/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN77458946/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5590",
    "datePublished": "2020-06-19T09:35:19",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:30:24.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.655Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "versions from 3.0.5 to 3.0.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-03T11:15:33",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5680",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from 3.0.5 to 3.0.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vector."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN24457594/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN24457594/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5680",
    "datePublished": "2020-12-03T11:15:33",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:39:25.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:21.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "EC-CUBE",
          "vendor": "EC-CUBE CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-28T00:50:39",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20750",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "EC-CUBE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "EC-CUBE CO.,LTD."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=79",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=79"
            },
            {
              "name": "https://www.ec-cube.net/info/weakness/weakness.php?id=78",
              "refsource": "MISC",
              "url": "https://www.ec-cube.net/info/weakness/weakness.php?id=78"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN95292458/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN95292458/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20750",
    "datePublished": "2021-06-28T00:50:39",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:53:21.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}