CVE-2012-5798

The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5793

The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5798

The CVE-2012-5798 entry concerns the PayPal Pro PayFlow EC module in osCommerce failing to verify that the server hostname matches a domain name in the certificate’s CN or SubjectAltName. This omission enables MITM attackers to spoof SSL servers using arbitrary valid certificates. Connected docum...

CVE-2012-5792

The CVE-2012-5792 entry affects the Sage Pay Direct module in osCommerce. The vulnerability arises because the module does not verify that the server hostname matches a domain name in the certificate’s CN or subjectAltName, enabling MITM attackers to spoof SSL servers using an arbitrary valid cer...

CVE-2012-5797

The CVE-2012-5797 entry concerns the PayPal Pro PayFlow module in osCommerce, where SSL hostname verification against the certificate’s CN/subjectAltName is not performed. This allows MITM-style spoofing of SSL servers using arbitrary valid certificates, with the reported impact described as part...

CVE-2012-5792

The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5794

The vulnerability CVE-2012-5794 affects the MoneyBookers module in osCommerce, where hostname verification for SSL certificates is not performed against the CN or subjectAltName. This enables MITM-style spoofing of SSL servers using an arbitrary valid certificate. The connected documents do not p...

CVE-2012-5793

The CVE-2012-5793 entry concerns the Authorize.Net module in osCommerce. The vulnerability arises because TLS hostname verification is not performed against the server certificate’s CN/subjectAltName, allowing a MITM attacker to spoof SSL servers using an arbitrary valid certificate. Affected com...

CVE-2012-5792: Improper Input Validation

The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5798: Improper Input Validation

The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5796: Improper Input Validation

The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5794: Improper Input Validation

The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5795: Improper Input Validation

The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5797: Improper Input Validation

The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5793: Improper Input Validation

The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-2991

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

Code injection

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2012-2991

OSS Commerce PayPal Standard module vulnerability CVE-2012-2991: in osCommerce Online Merchant, the PayPal (MODULE_PAYMENT_PAYPAL_STANDARD) integration prior to v1.1 in the PayPal module for pre-2.3.4 supports altering the merchant email address on the client side, allowing remote attackers to se...

CVE-2012-2991

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2012-2991: Undefined Security Weakness

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...