2772 matches found
16Shop Phishing Gang Goes After PayPal Users
A prolific phishing gang known as 16Shop has added PayPal customers to its target set. According to researchers at the ZeroFOX Alpha Team, the latest version of the group’s phishing kit is designed with a number of features that are aimed to steal as much personally identifiable information PII a...
Amazon Takes a Swipe at PayPal's $4 Billion Acquisition
The retail giant warned holiday shoppers that Honey, a popular browser extension, was a “security risk.” Honey denies the claim...
PayPal: Reflected XSS at https://www.paypal.com/ppcreditapply/da/us
Researchers identified endpoints that were vulnerable to reflected XSS, due to insufficient input sanitization. This could allow malicious client-side content to be rendered by the app, which could affect a user's session, browser, or the contents of the page itself. The issue was resolved by...
Magecart Group Switches Up Tactics with MiTM, Phishing
A fresh splinter group under the Magecart umbrella has been discovered ramping up activity starting in August-September of 2019. It’s using a unique codebase and different tactics to carry out its attacks, according to researchers. Magecart is an umbrella term encompassing several different threa...
PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password
A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The...
CVE-2016-11008
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...
CVE-2019-5992
Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5992
Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5992
The CVE-2019-5992 entry concerns the WordPress plugin WordPress Ultra Simple Paypal Shopping Cart (versions 4.4 and earlier). The vulnerability is Cross-Site Request Forgery (CSRF) that can allow an attacker to hijack an administrator’s authenticated actions via unspecified vectors. Documented im...
CVE-2019-5992
Cross-site request forgery CSRF vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-14979
cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...
CVE-2019-14979
cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...
Code injection
DISPUTED cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true tha...
CVE-2019-14979
cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...
CVE-2019-14979
The CVE-2019-14979 entry concerns the WooCommerce PayPal Checkout Payment Gateway plugin for WordPress (version 1.6.17). The vulnerability is described as parameter tampering in the PayPal flow via the cgi-bin/webscr?cmd=_cart endpoint, where the amount parameter (e.g., amount_1) can be manipulat...
CVE-2019-14979
cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...
WordPress WooCommerce PayPal Checkout Payment Gateway Plugin Input Validation Error Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WooCommerce PayPal Checkout Payment Gateway is a PayPal payment gateway plugin that is used in... WordPress WooCommerce PayPal Checkout...
PT-2019-13909 · Woocommerce · Woocommerce Paypal Checkout Payment Gateway
Name of the Vulnerable Software and Affected Versions: WooCommerce PayPal Checkout Payment Gateway plugin version 1.6.17 Description: The issue allows for parameter tampering in the amount parameter, such as amount 1, in the cgi-bin/webscr?cmd= cart endpoint. This can be exploited to purchase an...