VulnCheck KEV: CVE-2013-0322

Cross-site scripting XSS vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field...

CVE-2015-5504

CVE-2015-5504 describes an SQL injection in the Novalnet Payment Module Ubercart for Drupal. The vulnerability stems from failing to sanitize a database query via user-controlled input, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected products: Novalne...

Drupal Novalnet Payment - Ubercart Module SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP.Novalnet Payment is a payment module. A SQL injection vulnerability exists in the Drupal Novalnet Payment - Ubercart module due to the program failing to adequately filter user-supplied input. The vulnerability allows...

CVE-2013-7302

CVE-2013-7302 affects the Ubercart module for Drupal (versions 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6). The root cause is a session fixation flaw when the “Log in new customers after checkout” option is enabled, allowing an attacker to hijack a user’s session by leveraging knowledge o...

CVE-2013-7302

Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID...

CVE-2013-0322

Cross-site scripting XSS vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field...

CVE-2012-2300

Multiple cross-site scripting XSS vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal allow remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via unspecified vectors...

SA-CONTRIB-2010-108 - Who Bought What|Ubercart - Multiple Vulnerabilities

The Who Bought What-module collects and displays relevant information about purchases, including purchaser name, quantity, payment status, and all attributes. The module does not properly sanitize arguments passed via the URL when used in SQL queries, leading to a SQL Injection vulnerability...

CVE-2009-4772

Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors...

CVE-2009-4773

Cross-site request forgery CSRF vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Code injection

The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors...

CVE-2008-1428

Multiple cross-site scripting XSS vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inject arbitrary web script or HTML via a text attribute value for a product...