CVE-2012-5806

The vulnerability CVE-2012-5806 affects the Zen Cart PayPal Payments Pro module. The issue is that the module does not verify that the server hostname matches a domain in the certificate’s CN or subjectAltName, enabling MITM-style spoofing with arbitrary valid certificates. The root cause is tied...

CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

CVE-2012-5787

The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5787

Technical details about CVE-2012-5787 are not publicly available in the provided connected documents; the CVE description notes a hostname verification flaw in the PayPal merchant SDK. Monitor for updates.

CVE-2012-5802

The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5788

The PayPal IPN utility is vulnerable because it does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling MITM spoofing with any valid certificate via the PHP fsockopen-based connection. Affected component: PayPal IPN utility; underlying issue: miss...

CVE-2012-5806

The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to...

ImageShack Server and Symantec Database hacked and Dumped

Hackers hack into ImageShack server and expose all the files online, moreover Antivirus Company Symantec's portal also hacked by them and complete database of all 1000's of researchers dumped in a pastebin File. One of the hacker behind this hack avilable on twitter at @Doxbin. Hacker expose...

CVE-2012-4934

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

Design/Logic Flaw

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

CVE-2012-4934

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

CVE-2012-4934

TomatoCart 1.1.7 (and possibly other versions) with the PayPal Express Checkout module in sandbox mode contains a design/logic flaw that may allow an attacker who is authenticated to bypass payment requirements by manipulating the PayPal redirect URL from PayPal back to TomatoCart. The result can...

TomatoCart with PayPal Express Checkout design flaw vulnerability

Overview TomatoCart 1.1.7 with PayPal Express Checkout, and possibly other versions, contains a design flaw that may allow an attacker to purchase items for free or less than advertised. Description It has been reported that TomatoCart 1.1.7 using the PayPal Express Checkout module in sandbox mod...

Fake PayPal Emails Distributing Malware

Cybercriminals are mimicking the online payment processor PayPal in a malicious spam campaign that attempts to dupe customers into downloading malware from links in seemingly authentic emails, according to a Webroot report written by Dancho Danchev. The piece of malware in use here is a backdoor...

Paypal BugBounty 5 Cross Site Scripting

Title: ====== Paypal BugBounty 5 - Persistent Web Vulnerability Date: ===== 2012-10-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=639 VL-ID: ===== 639 Common Vulnerability Scoring System: ==================================== 3.3 Introduction: ============= PayPal i...

PayPal Cross Site Scripting

Title: ====== Paypal BugBounty 9 - Persistent Web Vulnerabilities Date: ===== 2012-10-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=646 VL-ID: ===== 646 Common Vulnerability Scoring System: ==================================== 7.2 Introduction: ============= PayPal...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

CVE-2012-2991

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

Code injection

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...