CVE-2012-5796: Improper Input Validation

The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5794: Improper Input Validation

The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5795: Improper Input Validation

The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PT-2012-6109

Name of the Vulnerable Software and Affected Versions osCommerce PayPal Pro PayFlow module affected versions not specified Description The issue concerns a failure to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificat...

CVE-2012-5798: Improper Input Validation

The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5793: Improper Input Validation

The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5792: Improper Input Validation

The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PT-2012-6105

Name of the Vulnerable Software and Affected Versions osCommerce affected versions not specified Description The issue concerns the Authorize.Net module in osCommerce, which fails to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the...

PT-2012-6104

Name of the Vulnerable Software and Affected Versions osCommerce Sage Pay Direct module affected versions not specified Description The issue concerns a lack of verification in the Sage Pay Direct module that the server hostname matches a domain name in the subject's Common Name CN or...

PT-2012-6107

Name of the Vulnerable Software and Affected Versions osCommerce affected versions not specified Description The issue concerns the PayPal Express module in osCommerce, which fails to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the...

CVE-2012-5797: Improper Input Validation

The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PT-2012-6106

Name of the Vulnerable Software and Affected Versions osCommerce MoneyBookers module affected versions not specified Description The issue concerns the MoneyBookers module in osCommerce, which fails to verify the server hostname against the domain name in the subject's Common Name CN or...

PT-2012-6108

Name of the Vulnerable Software and Affected Versions osCommerce affected versions not specified Description The issue concerns the PayPal Pro module in osCommerce, which fails to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the X.5...

CVE-2012-2991

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

Code injection

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2012-2991

OSS Commerce PayPal Standard module vulnerability CVE-2012-2991: in osCommerce Online Merchant, the PayPal (MODULE_PAYMENT_PAYPAL_STANDARD) integration prior to v1.1 in the PayPal module for pre-2.3.4 supports altering the merchant email address on the client side, allowing remote attackers to se...

CVE-2012-2991

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2012-2991: Undefined Security Weakness

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

PT-2012-4418

Name of the Vulnerable Software and Affected Versions osCommerce Online Merchant versions prior to 2.3.4 PayPal aka MODULE PAYMENT PAYPAL STANDARD module version prior to 1.1 Description The issue allows remote attackers to modify the payment recipient by altering the merchant's e-mail address,...

osCommerce v2.3.1 with PayPal website payments standard module v1.0 design vulnerability

Overview osCommerce 2.3.1 and possibly other versions with the PayPal website payments standard module is susceptible to a client-side attack that results in an attacker purchasing items without having to pay for them. Description It has been reported that osCommerce 2.3.1 using the PayPal websit...