CVE-2017-6217

CVE-2017-6217 impacts the Paypal adaptivepayments-sdk-php package in version 3.9.2, with a reflected XSS in SetPaymentOptions.php that can result in code execution. The connected sources corroborate the vulnerability type but do not provide remediation details or confirmed exploitation status. Th...

CVE-2017-6217

paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution...

WordPress CP Contact Form with Paypal plugin <= 1.2.97 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found in WordPress CP Contact Form with Paypal plugin versions = 1.2.97. Solution Update the WordPress CP Contact Form with Paypal plugin to the latest available version at least 1.2.98...

PayPal: DoS on PayPal via web cache poisoning

On https://paypal.com/, you could impact core functionality by using an invalid Transfer-Encoding header to replace JavaScript files from www.paypalobjects.com with the message '501 Not Implemented'. This was patched and awarded a $9,700 bounty. By the time you read this, there should be a full...

ThreatList: Ransomware Trojans Picking Up Steam in 2019

With the number of unique cyberincidents continuing to grow, ransomware-based attacks in particular are on the rise in 2019, researchers said. Ransomware trojan-based infections jutted up from 9 percent in the fourth quarter of 2018 to 24 percent in the first quarter of 2019, said Positive...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

Microsoft Bounty Program Updates: Faster bounty review, faster payments, and higher rewards

In 2018 The Microsoft Bounty Program awarded over $2,000,000 to encourage and reward external security research in key technologies to protect our customers. Building on that success, we are excited to announce a number of improvements in our bounty programs to better serve the security research...

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an ite...

WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering

Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price Date: 27.01.2019 Product Title :Woocommer...

WordPress PayPal Checkout Payment Gateway 1.6.8 Parameter Tampering

Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price Date: 27.01.2019 Product Title :Woocommer...

WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Vulnerability

Exploit for php platform in category web applications WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter...

WordPress WooCommerce PayPal Checkout Payment Gateway plugin input validation error vulnerability (CNVD-2019-31166)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An input validation error vulnerability exists in the WordPress WooCommerce PayPal Checkout Payment Gateway...

CVE-2019-7441

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amou...

CVE-2019-7441

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amou...

Code injection

DISPUTED cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that...

CVE-2019-7441

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amou...

CVE-2019-7441

CVE-2019-7441 affects the WordPress plugin WooCommerce PayPal Checkout Payment Gateway version 1.6.8. The vulnerability is Parameter Tampering in the /cgi-bin/webscr?cmd=_cart endpoint, where an attacker can manipulate the amount (e.g., amount_1) to pay less than the intended price. The public de...

PT-2019-18614 · Woocommerce · Woocommerce Paypal Checkout Payment Gateway

Name of the Vulnerable Software and Affected Versions: WooCommerce PayPal Checkout Payment Gateway plugin version 1.6.8 Description: The issue allows Parameter Tampering in an amount parameter, such as amount 1, in the /cgi-bin/webscr?cmd= cart endpoint. This can be exploited by purchasing an ite...

PayPal: Bypass for #488147 enables stored XSS on https://paypal.com/signin again

Due to a configuration in frontend, caching servers, it was possible for a researcher to use request smuggling to convert a page request into a cached redirect. If the cached redirect were accessed by a legitimate user, an attacker's content would be rendered instead of the requested page. While...

Cscms Cross-Site Scripting Vulnerability (CNVD-2019-07948)

CScms is a content management system CMS developed on a CI framework. A cross-site scripting vulnerability exists in the admin.php/pay page in Cscms version 4.1.0. A remote attacker can exploit the vulnerability to change the paypal account...