Search
Find a vulnerability
Search criteria
2 vulnerabilities found for paypal by ebay
CVE-2010-4211 (GCVE-0-2010-4211)
Vulnerability from nvd – Published: 2010-11-08 23:00 – Updated: 2024-08-07 03:34
VLAI
EPSS
VEX
Summary
The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://viaforensics.com/press-releases/viaforensi… | x_refsource_MISC |
| http://www.vupen.com/english/advisories/2010/2887 | vdb-entryx_refsource_VUPEN |
| http://news.cnet.com/8301-27080_3-20021730-245.html | x_refsource_MISC |
| http://www.securityfocus.com/bid/44657 | vdb-entryx_refsource_BID |
| http://online.wsj.com/article/SB10001424052748703… | x_refsource_MISC |
| http://itunes.apple.com/us/app/paypal/id283646709 | x_refsource_MISC |
| http://viaforensics.com/security/viaforensics-unc… | x_refsource_MISC |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2010-11-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:34:37.803Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html"
},
{
"name": "ADV-2010-2887",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2887"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://news.cnet.com/8301-27080_3-20021730-245.html"
},
{
"name": "44657",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/44657"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://itunes.apple.com/us/app/paypal/id283646709"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html"
},
{
"name": "paypal-certificate-info-disclosure(63002)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63002"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html"
},
{
"name": "ADV-2010-2887",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2887"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://news.cnet.com/8301-27080_3-20021730-245.html"
},
{
"name": "44657",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/44657"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://itunes.apple.com/us/app/paypal/id283646709"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html"
},
{
"name": "paypal-certificate-info-disclosure(63002)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63002"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4211",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html",
"refsource": "MISC",
"url": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html"
},
{
"name": "ADV-2010-2887",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2887"
},
{
"name": "http://news.cnet.com/8301-27080_3-20021730-245.html",
"refsource": "MISC",
"url": "http://news.cnet.com/8301-27080_3-20021730-245.html"
},
{
"name": "44657",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/44657"
},
{
"name": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html",
"refsource": "MISC",
"url": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html"
},
{
"name": "http://itunes.apple.com/us/app/paypal/id283646709",
"refsource": "MISC",
"url": "http://itunes.apple.com/us/app/paypal/id283646709"
},
{
"name": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html",
"refsource": "MISC",
"url": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html"
},
{
"name": "paypal-certificate-info-disclosure(63002)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63002"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4211",
"datePublished": "2010-11-08T23:00:00.000Z",
"dateReserved": "2010-11-08T00:00:00.000Z",
"dateUpdated": "2024-08-07T03:34:37.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-4211 (GCVE-0-2010-4211)
Vulnerability from cvelistv5 – Published: 2010-11-08 23:00 – Updated: 2024-08-07 03:34
VLAI
EPSS
VEX
Summary
The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://viaforensics.com/press-releases/viaforensi… | x_refsource_MISC |
| http://www.vupen.com/english/advisories/2010/2887 | vdb-entryx_refsource_VUPEN |
| http://news.cnet.com/8301-27080_3-20021730-245.html | x_refsource_MISC |
| http://www.securityfocus.com/bid/44657 | vdb-entryx_refsource_BID |
| http://online.wsj.com/article/SB10001424052748703… | x_refsource_MISC |
| http://itunes.apple.com/us/app/paypal/id283646709 | x_refsource_MISC |
| http://viaforensics.com/security/viaforensics-unc… | x_refsource_MISC |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2010-11-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:34:37.803Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html"
},
{
"name": "ADV-2010-2887",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2887"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://news.cnet.com/8301-27080_3-20021730-245.html"
},
{
"name": "44657",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/44657"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://itunes.apple.com/us/app/paypal/id283646709"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html"
},
{
"name": "paypal-certificate-info-disclosure(63002)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63002"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html"
},
{
"name": "ADV-2010-2887",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2887"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://news.cnet.com/8301-27080_3-20021730-245.html"
},
{
"name": "44657",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/44657"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://itunes.apple.com/us/app/paypal/id283646709"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html"
},
{
"name": "paypal-certificate-info-disclosure(63002)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63002"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4211",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html",
"refsource": "MISC",
"url": "http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html"
},
{
"name": "ADV-2010-2887",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2887"
},
{
"name": "http://news.cnet.com/8301-27080_3-20021730-245.html",
"refsource": "MISC",
"url": "http://news.cnet.com/8301-27080_3-20021730-245.html"
},
{
"name": "44657",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/44657"
},
{
"name": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html",
"refsource": "MISC",
"url": "http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html"
},
{
"name": "http://itunes.apple.com/us/app/paypal/id283646709",
"refsource": "MISC",
"url": "http://itunes.apple.com/us/app/paypal/id283646709"
},
{
"name": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html",
"refsource": "MISC",
"url": "http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html"
},
{
"name": "paypal-certificate-info-disclosure(63002)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63002"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4211",
"datePublished": "2010-11-08T23:00:00.000Z",
"dateReserved": "2010-11-08T00:00:00.000Z",
"dateUpdated": "2024-08-07T03:34:37.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}