Giancarlo Pellegrino

**Name of the Vulnerable Software and Affected Versions** node-bluetooth-serial-port versions all **Description** The issue is related to a Buffer Overflow vulnerability via the `findSerialPortChannel` method due to improper user input length validation. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For all versions, consider disabling the `findSerialPortChannel` method until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** node-bluetooth versions all **Description** The issue arises from improper user input length validation, leading to a Buffer Overflow via the `findSerialPortChannel` method. **Recommendations** For all versions, as a temporary workaround, consider disabling the `findSerialPortChannel` method until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CS-Cart versions prior to 3.0.6 **Description** The issue allows remote attackers to modify the payment recipient when PayPal Standard Payments is configured. This is achieved by altering the merchant's e-mail address, potentially allowing an attacker to redirect payments to themselves. **Recommendations** For versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the PayPal Standard Payments configuration until the update is applied.

**Name of the Vulnerable Software and Affected Versions** TomatoCart version 1.1.7 **Description** The issue allows remote authenticated users to bypass intended payment requirements. This is possible when the PayPal Express Checkout module is enabled in sandbox mode, and a certain redirection URL is modified. **Recommendations** For TomatoCart version 1.1.7, consider disabling the PayPal Express Checkout module in sandbox mode until a patch is available. Restrict access to the module to minimize the risk of exploitation. Avoid using the sandbox mode in the PayPal Express Checkout module until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** osCommerce Online Merchant versions prior to 2.3.4 PayPal (aka MODULE PAYMENT PAYPAL STANDARD) module version prior to 1.1 **Description** The issue allows remote attackers to modify the payment recipient by altering the merchant's e-mail address, potentially redirecting payments to an unauthorized account. **Recommendations** For osCommerce Online Merchant versions prior to 2.3.4, update to version 2.3.4 or later. For PayPal (aka MODULE PAYMENT PAYPAL STANDARD) module version prior to 1.1, update to version 1.1 or later.