44 matches found
DRUPAL-CONTRIB-2026-095
This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...
PT-2026-76589
Name of the Vulnerable Software and Affected Versions Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the...
PT-2026-75904
This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...
EUVD-2012-5677
Malware in sbrugna...
EUVD-2012-5678
Malware in sbrugna...
EUVD-2004-1206
Malware in sbrugna...
EUVD-2012-2064
Malware in sbrugna...
CVE-2012-5798
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5798
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5797
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
Code injection
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5797
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5797
The CVE-2012-5797 entry concerns the PayPal Pro PayFlow module in osCommerce, where SSL hostname verification against the certificate’s CN/subjectAltName is not performed. This allows MITM-style spoofing of SSL servers using arbitrary valid certificates, with the reported impact described as part...
CVE-2012-5798
The CVE-2012-5798 entry concerns the PayPal Pro PayFlow EC module in osCommerce failing to verify that the server hostname matches a domain name in the certificate’s CN or SubjectAltName. This omission enables MITM attackers to spoof SSL servers using arbitrary valid certificates. Connected docum...
PT-2012-6110
Name of the Vulnerable Software and Affected Versions osCommerce PayPal Pro PayFlow EC module affected versions not specified Description The issue concerns a failure to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the X.509...
PT-2012-6109
Name of the Vulnerable Software and Affected Versions osCommerce PayPal Pro PayFlow module affected versions not specified Description The issue concerns a failure to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificat...
CVE-2012-5798: Improper Input Validation
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5797: Improper Input Validation
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...