CVE-2012-5802

The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-4482

The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors...

Information disclosure

The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors...

CVE-2012-4482

The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors...

CVE-2012-4482

CVE-2012-4482 affects the Ubercart SecureTrading Payment Method module 6.x for Drupal. The root cause is that payment notification information is not properly verified, enabling remote attackers to complete a purchase without payment via unspecified vectors. The connected sources (including NVD a...

CVE-2012-2058

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

CVE-2012-2057

Cross-site request forgery CSRF vulnerability in the Ubercart Bulk Stock Updater module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors related to formAPI...

Code injection

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Ubercart Bulk Stock Updater module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors related to formAPI...

CVE-2012-2058

The CVE-2012-2058 issue affects the Ubercart Payflow module for Drupal, which does not use a secure token, allowing remote attackers to forge payments via unspecified vectors. No fixes were created for this vulnerability in the referenced advisory, so consider disabling the affected module or rep...

CVE-2012-2057

CVE-2012-2057 affects the Ubercart Bulk Stock Updater module for Drupal 6.x (Ubercart 2.x). The vulnerability arises because the module does not properly use the Drupal Form API, enabling a CSRF attack that could allow remote attackers to hijack the authentication of unspecified victims via unkno...

CVE-2012-2058

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

CVE-2012-2057

Cross-site request forgery CSRF vulnerability in the Ubercart Bulk Stock Updater module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors related to formAPI...

CVE-2012-2074

Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...

Design/Logic Flaw

Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...

CVE-2012-2074

Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...

CVE-2012-2074

The CVE-2012-2074 entry concerns Ubercart Views for Drupal 6.x before 6.x-3.2, where default views contain a critical information-disclosure weakness. The Drupal SA-CONTRIB advisory confirms affected versions and provides remediation: upgrade to Ubercart Views 6.x-3.2 and, after upgrading, ensure...

CVE-2012-2299

The Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal stores passwords for new customers in plaintext during checkout, which allows local users to obtain sensitive information by reading from the database...

CVE-2012-2300

Multiple cross-site scripting XSS vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal allow remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal allow remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via unspecified vectors...