https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 23:22:06 +0000 https://cve.radiocsirt.org/vuln/cnvd-2022-20586 cnvd-2022-20586 https://cve.radiocsirt.org/vuln/cnvd-2022-20586 https://cve.radiocsirt.org/vuln/euvd-2026-31558 EUVD-2026-31558 https://cve.radiocsirt.org/vuln/euvd-2026-31558 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41120 <p>sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled &#34;credit card holder&#34; field with the Customer&#39;s first and last name and hence this can lead to personally identifiable information exposure. Additionally, the mentioned form did not require authentication. The problem has been patched in Sylius/PayPalPlugin 1.2.4 and 1.3.1. If users are unable to update they can override a sylius_paypal_plugin_pay_with_paypal_form route and change its URL parameters to (for example) {orderToken}/{paymentId}, then override the Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the @SyliusPayPalPlugin/payWithPaypal.html.twig template, to add contingencies: [&#39;SCA_ALWAYS&#39;] line in hostedFields.submit(...) function call (line 421). It would then have to be handled in the function callback.</p> <p>sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled &#34;credit card holder&#34; field with the Customer&#39;s first and last name and hence this can lead to personally identifiable information exposure. Additionally, the mentioned form did not require authentication. The problem has been patched in Sylius/PayPalPlugin 1.2.4 and 1.3.1. If users are unable to update they can override a sylius_paypal_plugin_pay_with_paypal_form route and change its URL parameters to (for example) {orderToken}/{paymentId}, then override the Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the @SyliusPayPalPlugin/payWithPaypal.html.twig template, to add contingencies: [&#39;SCA_ALWAYS&#39;] line in hostedFields.submit(...) function call (line 421). It would then have to be handled in the function callback.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-41120 https://cve.radiocsirt.org/vuln/ghsa-25fx-mxc2-76g7 <p><strong>Affected:</strong> Packagist: sylius/paypal-plugin</p> <p>### Impact URL to the payment page done after checkout was created with autoincremented payment id (`/pay-with-paypal/{id}`) and therefore it was easy to access for anyone, not even the order&#39;s customer. The problem was, the Credit card form has prefilled &#34;credit card holder&#34; field with the Customer&#39;s first and last name. Additionally, the mentioned form did not require a 3D Secure authentication, as well as did not checked the result of the 3D Secure authentication.</p> <p>### Patches The problem has been patched in Sylius/PayPalPlugin **1.2.4** and **1.3.1**</p> <p>### Workarounds One can override a `sylius_paypal_plugin_pay_with_paypal_form` route and change its URL parameters to (for example) `{orderToken}/{paymentId}`, then override the `Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction` service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the `@SyliusPayPalPlugin/payWithPaypal.html.twig` template, to add `contingencies: [&#39;SCA_ALWAYS&#39;]` line in `hostedFields.submit(...)` function call (line 421). It would then have to be handled in the function callback.</p> <p>### For more information If you have any questions or comments about this advisory: - Open an issue in Sylius/PayPalPlugin issues - Email us at security at sylius dot com</p> <p><strong>Affected:</strong> Packagist: sylius/paypal-plugin</p> <p>### Impact URL to the payment page done after checkout was created with autoincremented payment id (`/pay-with-paypal/{id}`) and therefore it was easy to access for anyone, not even the order&#39;s customer. The problem was, the Credit card form has prefilled &#34;credit card holder&#34; field with the Customer&#39;s first and last name. Additionally, the mentioned form did not require a 3D Secure authentication, as well as did not checked the result of the 3D Secure authentication.</p> <p>### Patches The problem has been patched in Sylius/PayPalPlugin **1.2.4** and **1.3.1**</p> <p>### Workarounds One can override a `sylius_paypal_plugin_pay_with_paypal_form` route and change its URL parameters to (for example) `{orderToken}/{paymentId}`, then override the `Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction` service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the `@SyliusPayPalPlugin/payWithPaypal.html.twig` template, to add `contingencies: [&#39;SCA_ALWAYS&#39;]` line in `hostedFields.submit(...)` function call (line 421). It would then have to be handled in the function callback.</p> <p>### For more information If you have any questions or comments about this advisory: - Open an issue in Sylius/PayPalPlugin issues - Email us at security at sylius dot com</p> https://cve.radiocsirt.org/vuln/ghsa-25fx-mxc2-76g7 https://cve.radiocsirt.org/vuln/gsd-2021-41120 gsd-2021-41120 https://cve.radiocsirt.org/vuln/gsd-2021-41120