VulnCheck KEV: CVE-2013-0322

Cross-site scripting XSS vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field...

CVE-2015-5504

CVE-2015-5504 describes an SQL injection in the Novalnet Payment Module Ubercart for Drupal. The vulnerability stems from failing to sanitize a database query via user-controlled input, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected products: Novalne...

CVE-2015-5504: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Drupal Novalnet Payment - Ubercart Module SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP.Novalnet Payment is a payment module. A SQL injection vulnerability exists in the Drupal Novalnet Payment - Ubercart module due to the program failing to adequately filter user-supplied input. The vulnerability allows...

PT-2014-8796

Name of the Vulnerable Software and Affected Versions Ubercart module versions 7.x-3.x before 7.x-3.7 Description The issue allows remote authenticated users with the "view own orders" permission to obtain sensitive information. This is due to the module not properly protecting the per-user order...

CVE-2013-7302

CVE-2013-7302 affects the Ubercart module for Drupal (versions 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6). The root cause is a session fixation flaw when the “Log in new customers after checkout” option is enabled, allowing an attacker to hijack a user’s session by leveraging knowledge o...

CVE-2013-7302

Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID...

CVE-2013-0322

Cross-site scripting XSS vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field...

PT-2013-2234

Name of the Vulnerable Software and Affected Versions Ubercart module versions 7.x-3.x before 7.x-3.4 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the full name field. Recommendations For Uberca...

CVE-2012-2300

Multiple cross-site scripting XSS vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal allow remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via unspecified vectors...

PT-2012-3933

Name of the Vulnerable Software and Affected Versions Ubercart module versions 6.x-2.x through 6.x-2.7 Ubercart module versions 7.x-3.x through 7.x-3.0 Description The issue allows local users to obtain sensitive information by reading from the database because passwords for new customers are...

PT-2012-3934

Name of the Vulnerable Software and Affected Versions Ubercart module versions 6.x-2.x before 6.x-2.8 Ubercart module versions 7.x-3.x before 7.x-3.1 Description The issue allows remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via...

SA-CONTRIB-2010-108 - Who Bought What|Ubercart - Multiple Vulnerabilities

The Who Bought What-module collects and displays relevant information about purchases, including purchaser name, quantity, payment status, and all attributes. The module does not properly sanitize arguments passed via the URL when used in SQL queries, leading to a SQL Injection vulnerability...

CVE-2009-4772

Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors...

CVE-2009-4773

Cross-site request forgery CSRF vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Code injection

The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors...

CVE-2008-1428

Multiple cross-site scripting XSS vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inject arbitrary web script or HTML via a text attribute value for a product...