CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 1CVE-2012-5804
https://notcve.org/view.php?id=CVE-2012-5804
The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. El módulo CyberSource en Zen Cart no comprueba si el nombre del servidor coincide con un nombre de dominio en el Common Name (CN) del asunto o el campo subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado válido de su elección. • http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/79947 • CWE-20: Improper Input Validation •
CVSS: 2.1EPSS: 0%CPEs: 35EXPL: 2CVE-2012-2299
https://notcve.org/view.php?id=CVE-2012-2299
The Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal stores passwords for new customers in plaintext during checkout, which allows local users to obtain sensitive information by reading from the database. El módulo Ubercart v6.x-2.x antes de v6.x-2.8 y v7.x-v3.x antes de v7.x-3.1 para Drupal almacena las contraseñas para los nuevos clientes en el texto plano durante el pago, lo que permite a usuarios locales obtener información sensible mediante la lectura de la base de datos. • http://drupal.org/node/1547506 http://drupal.org/node/1547508 http://drupal.org/node/1547674 http://drupalcode.org/project/ubercart.git/commitdiff/035d2cb http://drupalcode.org/project/ubercart.git/commitdiff/8c61e84 http://secunia.com/advisories/48935 http://www.openwall.com/lists/oss-security/2012/05/03/1 http://www.openwall.com/lists/oss-security/2012/05/03/2 http://www.securityfocus.com/bid/53251 • CWE-255: Credentials Management Errors •
CVSS: 2.1EPSS: 0%CPEs: 35EXPL: 2CVE-2012-2300
https://notcve.org/view.php?id=CVE-2012-2300
Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal allow remote authenticated users with the administer product classes permission to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en el módulo Ubercart v6.x-2.x antes de v6.x-2.8 y v7.x v3.x antes de v7.x-3.1 para Drupal permite inyectar secuencias de comandos web o HTML a usuarios remotos autenticados con permisos de administración de clases de productos a través de vectores no especificados. • http://drupal.org/node/1547506 http://drupal.org/node/1547508 http://drupal.org/node/1547674 http://drupalcode.org/project/ubercart.git/commitdiff/3e7c0b8 http://drupalcode.org/project/ubercart.git/commitdiff/dfd8658 http://secunia.com/advisories/48935 http://www.openwall.com/lists/oss-security/2012/05/03/1 http://www.openwall.com/lists/oss-security/2012/05/03/2 http://www.securityfocus.com/bid/53251 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2009-4772
https://notcve.org/view.php?id=CVE-2009-4772
Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors. Vulnerabilidad sin especificar en la funcionalidad de "PayPal Website Payments Standard" (estándar de pago del sitio PayPal) del módulo Ubercart v5.x anteriores a la v5.x-1.9 y v6.x anteriores a la v6.x-2.1 de Drupal. Cuando se habilita un mensaje modificado de fin de la confirmación, permite a los atacantes obtener información confidencial a través de vectores de ataque sin especificar. • http://drupal.org/node/636576 http://osvdb.org/60291 http://secunia.com/advisories/37440 http://www.securityfocus.com/bid/37058 https://exchange.xforce.ibmcloud.com/vulnerabilities/54345 •
CVSS: 5.0EPSS: 0%CPEs: 52EXPL: 0CVE-2009-4771
https://notcve.org/view.php?id=CVE-2009-4771
The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors. la funcionalidad de "PayPal Website Payments Standard" (estándar de pago del sitio PayPal) del módulo Ubercart v5.x anteriores a la v5.x-1.9 y v6.x anteriores a la v6.x-2.1 de Drupal no valida apropiadamente los pedidos, lo que permite a atacantes remotos ejecutar "acciones duplicadas" sin especificar a través de vectores de ataque desconocidos. • http://drupal.org/node/636576 http://osvdb.org/60290 http://secunia.com/advisories/37440 http://www.securityfocus.com/bid/37058 https://exchange.xforce.ibmcloud.com/vulnerabilities/54346 • CWE-20: Improper Input Validation •