CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4482
https://notcve.org/view.php?id=CVE-2012-4482
The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors. El módulo Ubercart SecureTrading Payment Method v6.x para Drupal no verifica correctamente la información de la notificación de pago, lo que permite a atacantes remotos comprar un artículo sin pagar a través de vectores no especificados. • http://drupal.org/node/1679820 http://www.openwall.com/lists/oss-security/2012/10/04/6 http://www.openwall.com/lists/oss-security/2012/10/07/1 • CWE-20: Improper Input Validation •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1978
https://notcve.org/view.php?id=CVE-2008-1978
Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features, a different vector than CVE-2008-1428. Vulnerabilidad de secuencias de órdenes en sitios cruzados (XSS) en el módulo Ubercart 5.x anteriores a 5.x-1.0 rc3 de Drupal permite a usuarios remotos autenticados inyectar 'script' web o HTML de su elección mediante títulos de nodos relacionados con características del producto no especificadas, un vector distinto de CVE-2008-1428. • http://drupal.org/node/250343 http://secunia.com/advisories/29950 http://www.securityfocus.com/bid/28914 http://www.vupen.com/english/advisories/2008/1351/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41975 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1916
https://notcve.org/view.php?id=CVE-2008-1916
Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-rc1 module for Drupal allow remote attackers to inject arbitrary web script or HTML via text fields intended for the (1) address and (2) order information, which are later displayed on the order view page and unspecified other administrative pages, a different vulnerability than CVE-2008-1428. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS), vulnerabilidades en Ubercart 5.x anteteriores a 5.x-1.0-rc1, módulo para drupal que permite a los atacantes remotos inyectar código web o HTML a través de los campos deseados (1) dirección y (2) pedir información, los cuales son mostrados mas tarde en la página que hemos pedido y en otras páginas administrativas no especificadas, es una vulnerabilidad distinta a CVE-2008-1428. • http://drupal.org/node/241944 http://www.vupen.com/english/advisories/2008/1083/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41624 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1428
https://notcve.org/view.php?id=CVE-2008-1428
Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inject arbitrary web script or HTML via a text attribute value for a product. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el módulo Ubercart versiones 5.x anteriores a 5.x-1.0-beta7 para Drupal permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección utilizando un valor de atributo de texto para un producto. • http://drupal.org/node/233492 http://www.vupen.com/english/advisories/2008/0867/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41184 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 14EXPL: 0CVE-2007-5621
https://notcve.org/view.php?id=CVE-2007-5621
Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el módulo Toke versiones anteriores a 4.7.x-1.5, y 5.x versiones anteriores a 5.x-1.9, para Drupal; tal y como se usa en los módulos ASIN Field, e-Commerce, campo Fullname para CCK, Invite, Node Relativity, Pathauto, PayPal Node, y Ubercart; permiten a atacantes remotos autenticados con privilegios de enviar comentarios, inyectar scripts web o HTML de su elección mediante vectores no especificados relativos a (1) comments, (2) vocabulary names, (3) term names, y (4) usernames. • http://drupal.org/node/184336 http://osvdb.org/38073 http://secunia.com/advisories/27291 https://exchange.xforce.ibmcloud.com/vulnerabilities/37275 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •