Code injection

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

PayPal Bug Bounty #26 - Persistent Web Vulnerabilities

Document Title: =============== PayPal Bug Bounty 26 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=703 PayPal UID: wam19c8kxn Release Date: ============= 2013-01-25 Vulnerability Laboratory ID VL-ID:...

Paypal Bug Bounty #10 - Persistent Web Vulnerability

Document Title: =============== Paypal Bug Bounty 10 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=647 PayPal UID: ixb165sfi Release Date: ============= 2013-01-23 Vulnerability Laboratory ID VL-ID:...

Paypal Bug Bounty #21 - Persistent Encoding Vulnerability

Document Title: =============== Paypal Bug Bounty 21 - Persistent Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=684 Release Date: ============= 2012-11-24 Vulnerability Laboratory ID VL-ID: ==================================== 68...

Code injection

The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to...

Code injection

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

CVE-2012-5789

PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate,...

CVE-2012-5789

The CVE-2012-5789 entry affects the PayPal Payments Standard PHP Library prior to 20120427. The root cause is failure to verify that the server hostname matches the domain name in the certificate’s CN or subjectAltName, enabling MITM-style spoofing via an arbitrary valid certificate due to a disa...

CVE-2012-5790

The CVE-2012-5790 entry concerns PayPal Payments Standard PHP Library 20120427, where the library fails to verify that the server hostname matches a domain name in the certificate’s CN or SubjectAltName. This misvalidation enables man-in-the-middle attackers to spoof SSL servers using an arbitrar...

CVE-2012-5782

Amazon Flexible Payments Service FPS PHP Library does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, relat...

CVE-2012-5806

The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to...

CVE-2012-5782

The CVE-2012-5782 entry concerns the Amazon Flexible Payments Service (FPS) PHP Library, which does not verify that the server hostname matches a domain name in the X.509 certificate’s CN or subjectAltName. This allows MITM-style spoofing of SSL servers via an arbitrary valid certificate, related...

CVE-2012-5783

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

Verizon DBIR Analysis: Opportunistic Attacks Crushing Certain Industries

Regardless of the market or industry, the majority of attacks are financially motivated. Even in data-rich environments such as health care, attackers are still after profits and exploit the same weaknesses and transaction processing systems that are vulnerable in other industries such as hotels...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

CVE-2012-2058

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

Code injection

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

CVE-2012-2058

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

Half Million Chinese Android Devices got infected with SMSZombie

The amount of malware crafted and aimed at Android devices is ever-increasing. With Android being the most popular platform for smartphones and tablets around the world, Android users have become the low-hanging fruit when it comes to writing malware by the nefarious users. A new Android threat h...

SMSZombie Malware Infecting Android Devices, Stealing Money

A nasty new piece of malware that has the ability to steal money from users’ via fraudulent SMS payments has shown up in a Chinese Android market and researchers say it’s infected more than 500,000 victims. The SMSZombie malware is being hidden inside apps on the app market and once it’s on a...