CVE-2012-5788

The PayPal IPN utility is vulnerable because it does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling MITM spoofing with any valid certificate via the PHP fsockopen-based connection. Affected component: PayPal IPN utility; underlying issue: miss...

CVE-2012-5806

The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to...

CVE-2012-5802

The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5787

Technical details about CVE-2012-5787 are not publicly available in the provided connected documents; the CVE description notes a hostname verification flaw in the PayPal merchant SDK. Monitor for updates.

ImageShack Server and Symantec Database hacked and Dumped

Hackers hack into ImageShack server and expose all the files online, moreover Antivirus Company Symantec's portal also hacked by them and complete database of all 1000's of researchers dumped in a pastebin File. One of the hacker behind this hack avilable on twitter at @Doxbin. Hacker expose...

CVE-2012-4934

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

Design/Logic Flaw

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

CVE-2012-4934

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

CVE-2012-4934

TomatoCart 1.1.7 (and possibly other versions) with the PayPal Express Checkout module in sandbox mode contains a design/logic flaw that may allow an attacker who is authenticated to bypass payment requirements by manipulating the PayPal redirect URL from PayPal back to TomatoCart. The result can...

TomatoCart with PayPal Express Checkout design flaw vulnerability

Overview TomatoCart 1.1.7 with PayPal Express Checkout, and possibly other versions, contains a design flaw that may allow an attacker to purchase items for free or less than advertised. Description It has been reported that TomatoCart 1.1.7 using the PayPal Express Checkout module in sandbox mod...

Fake PayPal Emails Distributing Malware

Cybercriminals are mimicking the online payment processor PayPal in a malicious spam campaign that attempts to dupe customers into downloading malware from links in seemingly authentic emails, according to a Webroot report written by Dancho Danchev. The piece of malware in use here is a backdoor...

Paypal BugBounty 5 Cross Site Scripting

Title: ====== Paypal BugBounty 5 - Persistent Web Vulnerability Date: ===== 2012-10-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=639 VL-ID: ===== 639 Common Vulnerability Scoring System: ==================================== 3.3 Introduction: ============= PayPal i...

PayPal Cross Site Scripting

Title: ====== Paypal BugBounty 9 - Persistent Web Vulnerabilities Date: ===== 2012-10-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=646 VL-ID: ===== 646 Common Vulnerability Scoring System: ==================================== 7.2 Introduction: ============= PayPal...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

CVE-2012-2991

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

Code injection

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2012-2991

OSS Commerce PayPal Standard module vulnerability CVE-2012-2991: in osCommerce Online Merchant, the PayPal (MODULE_PAYMENT_PAYPAL_STANDARD) integration prior to v1.1 in the PayPal module for pre-2.3.4 supports altering the merchant email address on the client side, allowing remote attackers to se...

CVE-2012-2991

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

osCommerce v2.3.1 with PayPal website payments standard module v1.0 design vulnerability

Overview osCommerce 2.3.1 and possibly other versions with the PayPal website payments standard module is susceptible to a client-side attack that results in an attacker purchasing items without having to pay for them. Description It has been reported that osCommerce 2.3.1 using the PayPal websit...