Paypal vulnerabilities
26 vulnerabilities
Known vulnerabilities in Paypal products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 22 products.
Products
22- Paypal3 vulnerabilities
- Braintree\/Sanitize Url2 vulnerabilities
- Payments Pro2 vulnerabilities
- Payments Standard2 vulnerabilities
- Php Toolkit2 vulnerabilities
- Adaptive Payments Sdk1 vulnerabilities
- Instant Payment Notification1 vulnerabilities
- Invoicing1 vulnerabilities
- Ipn1 vulnerabilities
- Mass Pay1 vulnerabilities
- Merchant Sdk1 vulnerabilities
- Merchant Sdk Php1 vulnerabilities
- Nemo Appium1 vulnerabilities
- Payflow Pro Express Checkout1 vulnerabilities
- Paypal Brasil Para Woocommerce1 vulnerabilities
- Paypal Pro1 vulnerabilities
- Php Invoice Sdk1 vulnerabilities
- Php Permissions Sdk1 vulnerabilities
- Transactional Information Soap1 vulnerabilities
- Ubercart Payflow1 vulnerabilities
- Website Payments Standard Module1 vulnerabilities
- Wps Toolkit1 vulnerabilities
CVE-2013-7202paypalpaypal
EPSS score2.04%
The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.CVE-2013-7201paypalpaypalEPSS score1.75%
WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.CVE-2021-23648debiannode-mermaid+4EPSS score1.43%
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.CVE-2022-21129Npmnemo-appium+1EPSS score2.77%
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.
**Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.CVE-2022-48345debiannode-mermaid+3EPSS score0.56%
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.CVE-2012-2991oscommerceonline_merchant+1EPSS score1.14%
The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.CVE-2012-2058paypalubercart_payflowEPSS score1.33%
The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors.CVE-2012-5788paypalipnEPSS score0.57%
The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.CVE-2012-5805paypalinstant_payment_notification+1EPSS score0.57%
The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, a different vulnerability than CVE-2012-5806.CVE-2012-5802paypalpaypal+1EPSS score0.57%
The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.CVE-2012-5806paypalpayments_pro+1EPSS score0.57%
The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function, a different vulnerability than CVE-2012-5805.CVE-2012-5787paypalmerchant_sdkEPSS score0.91%
The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.CVE-2012-5798oscommerceoscommerce+1EPSS score0.57%
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.CVE-2012-5790paypalpayments_standardEPSS score0.57%
PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to misinterpretation of a certain TRUE value.CVE-2012-5784apacheactivemq+13EPSS score5.72%
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.CVE-2012-5796oscommerceoscommerce+1EPSS score0.57%
The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.CVE-2012-5789paypalpayments_standardEPSS score0.57%
PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to intentional disabling of certificate-validation checks through a "FALSE" value.CVE-2012-5791paypalinvoicingEPSS score0.57%
PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.CVE-2011-5237paypalwps_toolkitEPSS score0.53%
PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.CVE-2017-6099paypalmerchant-sdk-phpEPSS score1.24%
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.