174 matches found
Drupal Ubercart Module < 5.x-1.10 / 6.x-2.4 Multiple Vulnerabilities
Binary data 5634.prm...
SA-CONTRIB-2010-083 - Ubercart sub-modules - Multiple Vulnerabilities
The Ubercart module for Drupal provides e-commerce features. Several modules within Ubercart were vulnerable to various security issues. 1. The 2Checkout gateway module did not properly verify the payment notification information. A malicious user could use a specially crafted HTTP request to...
SA-CONTRIB-2010-077 - Sage Pay (former Protx) Direct Payment Gateway for Ubercart - Information Disclosure
The Sage Pay Direct Payment Gateway for Ubercart ucprotxvspdirect processes credit card transactions in Ubercart stores using the Sage Pay Direct service. The module may show remote 3-D Secure pages to the user in an iframe when their bank supports the Verified by Visa or MasterCard SecureCode...
SA-CONTRIB-2010-071 - MultiSafepay Integration - Cross Site Request Forgery
The MultiSafepay Integration module provides integration between the Ubercart e-commerce solution and the MultiSafepay payment system. The module is vulnerable to Cross Site Request Forgeries CSRF which would allow a malicious user to alter the status of orders or to trick other users into alteri...
SA-CONTRIB-2010-064 - Ubercart MIGS Payment Gateway - Web Parameter Tampering
The Ubercart MIGS Payment Gateway module provides support for the MIGS 3rd-party payment gateway used by ANZ, Commonwealth Bank, Bendigo Bank, and various other banks worldwide for payment processing. This module was susceptible to web parameter tampering which allowed users to bypass paying the...
SA-CONTRIB-2010-062 - Ogone | Ubercart payment - Access Bypass
Ogone | Ubercart payment is a payment module for Ubercart that integrates Ogone PSP gateway as a checkout method for Ubercart. The module does not always correctly verify the order status returned by the Ogone gateway, potentially allowing unpaid orders to be processed. Versions affected Ogone |...
CVE-2009-4772
Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors...
CVE-2009-4773
Cross-site request forgery CSRF vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2009-4771
The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors...
Code injection
The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
Code injection
Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors...
CVE-2009-4772
The CVE-2009-4772 entry concerns a vulnerability in Drupal’s Ubercart PayPal Website Payments Standard integration. Affected are Ubercart 5.x (before 5.x-1.9) and 6.x (before 6.x-2.1) when a custom checkout completion message is enabled. The flaw is described as an unspecified vulnerability that ...
CVE-2009-4773
Cross-site request forgery CSRF vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2009-4771
The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors...
CVE-2009-4772
Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors...
CVE-2009-4773
CVE-2009-4773 describes a Cross-site request forgery (CSRF) vulnerability in the Drupal Ubercart module’s order-management functionality. Affected software: Ubercart for Drupal 5.x (before 5.x-1.9) and 6.x (before 6.x-2.1). The description notes that remote attackers can hijack the authentication...
CVE-2009-4771
The CVE-2009-4771 issue affects the Drupal Ubercart PayPal Website Payments Standard integration. Specifically, Ubercart 5.x prior to 5.x-1.9 and 6.x prior to 6.x-2.1 do not properly validate orders, which can allow remote attackers to trigger unspecified “duplicate actions” via unknown vectors. ...
SA-CONTRIB-2009-107 - Ubercart - Access bypass, Cross site request forgery
Ubercart's PayPal Website Payments Standard integration exposes a path for completed orders without properly checking that the order is valid for the current user. In the event that the order has already been processed for checkout, this can result in duplicate actions taking place inadvertently...
Cross site scripting
Cross-site scripting XSS vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features, a different vector than CVE-2008-1428...