Jonathan Sacksick

**Name of the Vulnerable Software and Affected Versions** Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 **Description** An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment. **Recommendations** Update Commerce PayPal versions 0.0.0 through 1.12.0 to a version newer than 1.12.0. Update Commerce PayPal versions 2.0.0 through 2.1.3 to a version newer than 2.1.3.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce Core versions 3.3.0 through 3.3.6 **Description** Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The module fails to sufficiently sanitize customer comments within the order receipt email template. This issue specifically affects installations where the `commerce checkout` module is enabled and the `customer comments` checkout pane is explicitly used, as this pane is disabled by default. **Recommendations** Update Drupal Commerce Core to a version later than 3.3.6. As a temporary mitigation, disable the `customer comments` checkout pane.