Paypal - vulnerabilities (CVEs)

26 CVEs in 23 products, 0 in the last 30 days, newest from 2024-12-09.

Products

Paypal - 3 CVEs
Braintree/sanitize-url - 2 CVEs
Payments Pro - 2 CVEs
Payments Standard - 2 CVEs
Php Toolkit - 2 CVEs
Adaptive Payments Sdk - 1 CVEs
Instant Payment Notification - 1 CVEs
Invoicing - 1 CVEs
Ipn - 1 CVEs
Mass Pay - 1 CVEs
Merchant-sdk-php - 1 CVEs
Merchant Sdk - 1 CVEs
Nemo-appium - 1 CVEs
Payflow Pro Express Checkout - 1 CVEs
Paypal Brasil Para Woocommerce - 1 CVEs
Paypal Pro - 1 CVEs
Php Invoice Sdk - 1 CVEs
Php Permissions Sdk - 1 CVEs
Transactional Information Soap - 1 CVEs
Ubercart Payflow - 1 CVEs
Website Payments Standard Module - 1 CVEs
Wps Toolkit - 1 CVEs
Php Adaptive Payments Sdk - 0 CVEs

Newest CVEs of Paypal

CVE-2023-25026 - CVSS 4.3 (medium), 2024-12-09: Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This…
CVE-2022-48345 - CVSS 6.1 (medium), 2023-02-24: sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
CVE-2022-21129 - CVSS 9.8 (critical), 2023-01-31: Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup'…
CVE-2021-23648 - CVSS 6.1 (medium), 2022-03-16: The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
CVE-2017-6217 - CVSS 6.1 (medium), 2019-07-10: paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution
CVE-2017-6215 - CVSS 5.4 (medium), 2018-08-02: paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.
CVE-2017-6213 - CVSS 5.4 (medium), 2018-08-02: paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.
CVE-2013-7201 - CVSS 7.4 (high), 2018-04-27: WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive…
CVE-2013-7202 - CVSS 8.1 (high), 2018-04-27: The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.
CVE-2017-6099 - CVSS 6.1 (medium), 2017-02-24: Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject…
CVE-2011-5237 - CVSS 5.8 (medium), 2012-11-06: PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
CVE-2012-5806 - CVSS 5.8 (medium), 2012-11-04: The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName…
CVE-2012-5802 - CVSS 5.8 (medium), 2012-11-04: The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the…
CVE-2012-5805 - CVSS 5.8 (medium), 2012-11-04: The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName…
CVE-2012-5784 - CVSS 5.8 (medium), 2012-11-04: Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation…
CVE-2012-5789 - CVSS 5.8 (medium), 2012-11-04: PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or…
CVE-2012-5796 - CVSS 5.8 (medium), 2012-11-04: The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field…
CVE-2012-5788 - CVSS 5.8 (medium), 2012-11-04: The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
CVE-2012-5787 - CVSS 5.8 (medium), 2012-11-04: The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
CVE-2012-5791 - CVSS 5.8 (medium), 2012-11-04: PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
CVE-2012-5798 - CVSS 5.8 (medium), 2012-11-04: The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or…
CVE-2012-5790 - CVSS 5.8 (medium), 2012-11-04: PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or…
CVE-2012-2991 - CVSS 5 (medium), 2012-09-19: The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment…
CVE-2012-2058 - CVSS 5 (medium), 2012-09-17: The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors.
CVE-2006-0202 - CVSS 3.6 (low), 2006-01-13: Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for…
CVE-2006-0201 - CVSS 5 (medium), 2006-01-13: Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment…