Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/ec-cube/ec-cube@4.0.6-p1
Typecomposer
Namespaceec-cube
Nameec-cube
Version4.0.6-p1
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version4.1.2-p1
Latest_non_vulnerable_version4.2.3
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-f13c-wzhp-cqap
vulnerability_id VCID-f13c-wzhp-cqap
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
references
0
reference_url https://jvn.jp/en/jp/JVN04785663/
reference_id
reference_type
scores
url https://jvn.jp/en/jp/JVN04785663/
1
reference_url https://www.ec-cube.net/info/weakness/20230214/
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-25077
reference_id CVE-2023-25077
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-25077
fixed_packages
0
url pkg:composer/ec-cube/ec-cube@4.0.6-p1
purl pkg:composer/ec-cube/ec-cube@4.0.6-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.0.6-p1
1
url pkg:composer/ec-cube/ec-cube@4.1.2-p1
purl pkg:composer/ec-cube/ec-cube@4.1.2-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.1.2-p1
2
url pkg:composer/ec-cube/ec-cube@4.2.1
purl pkg:composer/ec-cube/ec-cube@4.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.2.1
aliases CVE-2023-25077
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f13c-wzhp-cqap
1
url VCID-fuus-wqhf-s3be
vulnerability_id VCID-fuus-wqhf-s3be
summary 
Improper Control of Generation of Code ('Code Injection')
EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege.
references
0
reference_url https://jvn.jp/en/jp/JVN29195731/
reference_id
reference_type
scores
url https://jvn.jp/en/jp/JVN29195731/
1
reference_url https://www.ec-cube.net/info/weakness/20231026/index_3.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20231026/index_3.php
2
reference_url https://www.ec-cube.net/info/weakness/20231026/index_40.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20231026/index_40.php
3
reference_url https://www.ec-cube.net/info/weakness/20231026/index.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20231026/index.php
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-46845
reference_id CVE-2023-46845
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-46845
fixed_packages
0
url pkg:composer/ec-cube/ec-cube@4.0.6-p1
purl pkg:composer/ec-cube/ec-cube@4.0.6-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.0.6-p1
1
url pkg:composer/ec-cube/ec-cube@4.1.2-p1
purl pkg:composer/ec-cube/ec-cube@4.1.2-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.1.2-p1
2
url pkg:composer/ec-cube/ec-cube@4.2.3
purl pkg:composer/ec-cube/ec-cube@4.2.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.2.3
aliases CVE-2023-46845
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fuus-wqhf-s3be
2
url VCID-he32-4cf1-akf5
vulnerability_id VCID-he32-4cf1-akf5
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0), EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p5), and EC-CUBE 2 series (EC-CUBE 2.11.0 to 2.11.5, EC-CUBE 2.12.0 to 2.12.6, EC-CUBE 2.13.0 to 2.13.5, and EC-CUBE 2.17.0 to 2.17.2) allows a remote authenticated attacker to inject an arbitrary script.
references
0
reference_url https://jvn.jp/en/jp/JVN04785663/
reference_id
reference_type
scores
url https://jvn.jp/en/jp/JVN04785663/
1
reference_url https://www.ec-cube.net/info/weakness/20230214/
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/
2
reference_url https://www.ec-cube.net/info/weakness/20230214/index_2.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/index_2.php
3
reference_url https://www.ec-cube.net/info/weakness/20230214/index_3.php
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/index_3.php
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22438
reference_id CVE-2023-22438
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-22438
fixed_packages
0
url pkg:composer/ec-cube/ec-cube@4.0.6-p1
purl pkg:composer/ec-cube/ec-cube@4.0.6-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.0.6-p1
1
url pkg:composer/ec-cube/ec-cube@4.1.2-p1
purl pkg:composer/ec-cube/ec-cube@4.1.2-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.1.2-p1
2
url pkg:composer/ec-cube/ec-cube@4.2.1
purl pkg:composer/ec-cube/ec-cube@4.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.2.1
aliases CVE-2023-22438
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-he32-4cf1-akf5
3
url VCID-kgjm-uhbj-gffx
vulnerability_id VCID-kgjm-uhbj-gffx
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script.
references
0
reference_url https://jvn.jp/en/jp/JVN04785663/
reference_id
reference_type
scores
url https://jvn.jp/en/jp/JVN04785663/
1
reference_url https://www.ec-cube.net/info/weakness/20230214/
reference_id
reference_type
scores
url https://www.ec-cube.net/info/weakness/20230214/
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-22838
reference_id CVE-2023-22838
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-22838
fixed_packages
0
url pkg:composer/ec-cube/ec-cube@4.0.6-p1
purl pkg:composer/ec-cube/ec-cube@4.0.6-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.0.6-p1
1
url pkg:composer/ec-cube/ec-cube@4.1.2-p1
purl pkg:composer/ec-cube/ec-cube@4.1.2-p1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.1.2-p1
2
url pkg:composer/ec-cube/ec-cube@4.2.1
purl pkg:composer/ec-cube/ec-cube@4.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.2.1
aliases CVE-2023-22838
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kgjm-uhbj-gffx
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/ec-cube/ec-cube@4.0.6-p1