EUVD-2011-5137

Malware in sbrugna...

Code injection

PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2011-5237

PayPal WPS Toolkit is affected by a TLS hostname verification issue: it does not verify that the server hostname matches the certificate’s CN/subjectAltName, enabling MITM with arbitrary valid certificates. Impact is partial confidentiality/integrity exposure as described by NVD; exploitation sta...

CVE-2011-5237

PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...