Security Advisory
CVE-2010-4211
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.