CVE-2010-4211

LowCVSS 2.9/10Last modified Jun 16, 2026

Description

The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.

Metrics

CVSS 2.0 2.9/10AV:A/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Nov 9, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-42121.9The USAA application 3.0 for Android stores a mirror image of each visited web page, which might allow physically proximate attackers to obt CVE-2010-42134.3The Bank of America application 2.12 for Android stores a security question's answer in cleartext, which might allow physically proximate at CVE-2010-42144.3The Wells Fargo Mobile application 1.1 for Android stores a username and password, along with account balances, in cleartext, which might al CVE-2010-42156.5UI/Manage.pm in Foswiki 1.1.0 and 1.1.1 allows remote authenticated users to gain privileges by modifying the GROUP and ALLOWTOPICCHANGE pre CVE-2010-42165.0IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 does not properly handle invalid buffer references in LDAP BER requ CVE-2010-42175.0Use-after-free vulnerability in the proxy server in IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 and 6.1.x befor CVE-2010-421810.0Unspecified vulnerability in Web Services in IBM ENOVIA 6 has unknown impact and attack vectors, related to a system that becomes "exposed t CVE-2010-42194.3Cross-site scripting (XSS) vulnerability in SemanticTagService.js in IBM WebSphere Portal 6.1.0.1 allows remote attackers to inject arbitrar CVE-2010-42204.3Cross-site scripting (XSS) vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Applica CVE-2010-422110.0Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to exe CVE-2010-42255.0Unspecified vulnerability in the mod_mono module for XSP in Mono 2.8.x before 2.8.2 allows remote attackers to obtain the source code for .a CVE-2010-42267.2cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symli