CVE-2026-81159

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

CVE-2026-81159 Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

EUVD-2026-70005

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

CVE-2026-81159 Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

CVE-2026-81159

The Drupal Commerce CyberSource module (versions 0.0.0 through 1.10.0 ) is vulnerable to an observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration. The root cause is that the module fails to correctly verify the integrity of data returned by the payment provide...

CVE-2026-81159: Observable Timing Discrepancy

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

DRUPAL-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

PT-2026-82363

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...

Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

clean-cybersource-rest-client-python (>=0.0.19, <=0.0.22), ozon-api-client (0.1.10) +2 more potentially affected by CVE-2026-59890 via setuptools (21.0.0)

setuptools PYPI version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - clean-cybersource-rest-client-python =0.0.19, =3.8.0, =3.9.0 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

EUVD-2012-5684

Malware in sbrugna...

clean-cybersource-rest-client-python (>=0.0.19, <=0.0.21), cloudmesh-client (4.2.6) +4 more potentially affected by CVE-2025-50181 via urllib3 (1.15.1)

urllib3 PYPI version 1.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - clean-cybersource-rest-client-python =0.0.19, =1.1.14, =1.1.15 Source cves: CVE-2025-50181 Source advisory: OSV:GHSA-PQ67-6M6Q-MJ2V...

clean-cybersource-rest-client-python (>=0.0.19, <=0.0.22), ozon-api-client (0.1.10) +2 more potentially affected by CVE-2025-47273 via setuptools (21.0.0)

setuptools PYPI version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - clean-cybersource-rest-client-python =0.0.19, =3.8.0, =3.9.0 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

com.cybersource:authenticationsdk (>=0.0.1, <=0.0.5), com.cybersource:cybersource-rest-client-java (>=0.0.1, <=0.0.12) +74 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (4.22)

com.nimbusds:nimbus-jose-jwt MAVEN version 4.22 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.cybersource:authenticationsdk =0.0.1, =0.0.1, =0.0.12 - com.github.javadev:authenticationsdk 0.0.5 -...

com.amazon.aes.webservices.client:ec2-java-client (20080327), com.cybersource:cybersource-sdk-java (>=6.2.0, <=6.2.1) +83 more potentially affected by CVE-2015-0227 via wss4j:wss4j (>=1.5.0, <=1.5.1)

wss4j:wss4j MAVEN version =1.5.0, =6.2.0, =1.0.12, =9.00.2110.07.220316, =0.0.9, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.3.0 - com.github.rapidark:rapid-ark-pretty 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo-keeper 0.3.0 -...

com.amazon.aes.webservices.client:ec2-java-client (20080327), com.cybersource:cybersource-sdk-java (>=6.2.0, <=6.2.1) +83 more potentially affected by CVE-2015-0227 via wss4j:wss4j (>=1.5.0, <=1.5.1)

wss4j:wss4j MAVEN version =1.5.0, =6.2.0, =1.0.12, =9.00.2110.07.220316, =0.0.9, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.3.0 - com.github.rapidark:rapid-ark-pretty 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo-keeper 0.3.0 -...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=12.1.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +991 more potentially affected by CVE-2021-40690 via org.apache.santuario:xmlsec (>=2.0.0-beta, <=2.1.6)

org.apache.santuario:xmlsec MAVEN version =2.0.0-beta, =1.0.0.ee-20260424025040, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.4.0.0, =0.7.0.1, =1.0.0, =3.0.0, =6.0.1, =5.0.0, =1.31.0, =1.31.0, =1.31.0, =1.37.1 and more Source cves: CVE-2021-40690 Source advisory:...

CVE-2012-5804

The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Code injection

The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5804

The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...