CVE-2012-5790

The CVE-2012-5790 entry concerns PayPal Payments Standard PHP Library 20120427, where the library fails to verify that the server hostname matches a domain name in the certificate’s CN or SubjectAltName. This misvalidation enables man-in-the-middle attackers to spoof SSL servers using an arbitrar...

CVE-2012-5783

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

CVE-2012-5790: Improper Input Validation

PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related ...

CVE-2012-5784: Improper Input Validation

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

CVE-2012-5806: Improper Input Validation

The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to...

CVE-2012-5782: Improper Input Validation

Amazon Flexible Payments Service FPS PHP Library does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, relat...

CVE-2012-5789: Improper Input Validation

PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate,...

CVE-2012-5783: Improper Certificate Validation

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

PT-2012-6118

Name of the Vulnerable Software and Affected Versions Zen Cart affected versions not specified Description The issue concerns the PayPal Payments Pro module in Zen Cart, which fails to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of th...

PT-2012-6101

Name of the Vulnerable Software and Affected Versions PayPal Payments Standard PHP Library versions before 20120427 Description The issue is related to the intentional disabling of certificate-validation checks, allowing man-in-the-middle attackers to spoof SSL servers via an arbitrary valid...

PT-2012-6102

Name of the Vulnerable Software and Affected Versions PayPal Payments Standard PHP Library version 20120427 Description The issue arises from the library's failure to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509...

PT-2012-6094

Name of the Vulnerable Software and Affected Versions Amazon Flexible Payments Service FPS PHP Library affected versions not specified Description The issue is related to the misinterpretation of a certain "true" value, which causes the library to not verify that the server hostname matches a...

Verizon DBIR Analysis: Opportunistic Attacks Crushing Certain Industries

Regardless of the market or industry, the majority of attacks are financially motivated. Even in data-rich environments such as health care, attackers are still after profits and exploit the same weaknesses and transaction processing systems that are vulnerable in other industries such as hotels...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

CVE-2012-2058

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

Code injection

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

CVE-2012-2058

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

CVE-2012-2058: Undefined Security Weakness

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors...

PT-2012-3772

Name of the Vulnerable Software and Affected Versions Ubercart Payflow module for Drupal affected versions not specified Description The issue allows remote attackers to forge payments due to the lack of a secure token in the Ubercart Payflow module for Drupal. Recommendations At the moment, ther...

Half Million Chinese Android Devices got infected with SMSZombie

The amount of malware crafted and aimed at Android devices is ever-increasing. With Android being the most popular platform for smartphones and tablets around the world, Android users have become the low-hanging fruit when it comes to writing malware by the nefarious users. A new Android threat h...