CVE-2010-4211

LowCVSS 2.9/10Last modified Jun 16, 2026

Description

The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.

Metrics

CVSS 2.0 2.9/10AV:A/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 9, 2010
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2010

CVE-2010-42121.9The USAA application 3.0 for Android stores a mirror image of each visited web page, which might allow physically proximate attackers to obtCVE-2010-42134.3The Bank of America application 2.12 for Android stores a security question's answer in cleartext, which might allow physically proximate atCVE-2010-42144.3The Wells Fargo Mobile application 1.1 for Android stores a username and password, along with account balances, in cleartext, which might alCVE-2010-42156.5UI/Manage.pm in Foswiki 1.1.0 and 1.1.1 allows remote authenticated users to gain privileges by modifying the GROUP and ALLOWTOPICCHANGE preCVE-2010-42165.0IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 does not properly handle invalid buffer references in LDAP BER requCVE-2010-42175.0Use-after-free vulnerability in the proxy server in IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 and 6.1.x beforCVE-2010-421810.0Unspecified vulnerability in Web Services in IBM ENOVIA 6 has unknown impact and attack vectors, related to a system that becomes "exposed tCVE-2010-42194.3Cross-site scripting (XSS) vulnerability in SemanticTagService.js in IBM WebSphere Portal 6.1.0.1 allows remote attackers to inject arbitrarCVE-2010-42204.3Cross-site scripting (XSS) vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere ApplicaCVE-2010-422110.0Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to exeCVE-2010-42255.0Unspecified vulnerability in the mod_mono module for XSP in Mono 2.8.x before 2.8.2 allows remote attackers to obtain the source code for .aCVE-2010-42267.2cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symli