40 matches found
DRUPAL-CONTRIB-2026-095
This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...
PT-2026-76589
Name of the Vulnerable Software and Affected Versions Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the...
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...
EUVD-2012-2064
Malware in sbrugna...
EUVD-2004-1206
Malware in sbrugna...
EUVD-2012-5677
Malware in sbrugna...
EUVD-2012-5678
Malware in sbrugna...
CVE-2012-5798
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5797
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5798
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
Code injection
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5797
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5798
The CVE-2012-5798 entry concerns the PayPal Pro PayFlow EC module in osCommerce failing to verify that the server hostname matches a domain name in the certificate’s CN or SubjectAltName. This omission enables MITM attackers to spoof SSL servers using arbitrary valid certificates. Connected docum...
CVE-2012-5797
The CVE-2012-5797 entry concerns the PayPal Pro PayFlow module in osCommerce, where SSL hostname verification against the certificate’s CN/subjectAltName is not performed. This allows MITM-style spoofing of SSL servers using arbitrary valid certificates, with the reported impact described as part...
CVE-2012-5798: Improper Input Validation
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5797: Improper Input Validation
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-2058
The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...
Code injection
The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...
CVE-2012-2058
The CVE-2012-2058 issue affects the Ubercart Payflow module for Drupal, which does not use a secure token, allowing remote attackers to forge payments via unspecified vectors. No fixes were created for this vulnerability in the referenced advisory, so consider disabling the affected module or rep...