Insufficient Session Expiration

Cosmos-server is vulnerable to Insufficient Session Expiration. The vulnerability is due to the authorization header Jwttoken used for user login remaining valid and not expiring after log out. This allows an attacker to use the token to gain unauthorized access to the application/system even aft...

CVE-2023-49091

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

Authorization

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

CVE-2023-49091 Jwttoken in Cosmos server never expires after password changed and logging out

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

CVE-2023-49091

CVE-2023-49091 affects Cosmos-server. The vulnerability arises because the authorization header token used for user login remains valid after logout, allowing an attacker to access the application/system even after the user has logged out. Impact is described as high/critical in multiple sources,...

CVE-2023-49091 Jwttoken in Cosmos server never expires after password changed and logging out

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

CVE-2023-49091 Jwttoken in Cosmos server never expires after password changed and logging out

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

PT-2023-31050 · Unknown · Cosmos-Server

Name of the Vulnerable Software and Affected Versions: Cosmos-server versions prior to 0.13.1 Description: The issue arises from the authorization header used for user login remaining valid and not expiring after log out, allowing an attacker to use the token to gain unauthorized access to the...

Cosmos Code Issue Vulnerability

Cosmos is a self-hosted home server from the individual developer Yann Stepienik. Designed to address the growing concern of vulnerable self-hosted applications and personal servers. A code issue vulnerability exists in Cosmos versions prior to 0.13.0, which stems from a token in the Authorizatio...

DEEP WEB VS DARK WEB

Let's Plunge Further: Steering through the Twists and Turns of the Invisible Web and Shadow Web Think of the internet as an unbounded digital cosmos; our daily interaction only grazes the surface. Dwelling beneath tiers of commonly visited websites is a complex maze of data, christened the...

Chain Halt

github.com/cosmos/packet-forward-middleware is vulnerable to a Chain Halt. The vulnerability exists because it does not properly validate IBC packets in the incoming router, allowing an attacker to cause a chain halt...

Cosmos packet-forward-middleware vulnerable to chain-halt

The Cosmos SDK is used for Inter-Blockchain Communication Protocol IBC applications and middleware. The packet-forward-middleware module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destinatio...

GHSA-W6RP-VXJ2-FJHR Cosmos packet-forward-middleware vulnerable to chain-halt

The Cosmos SDK is used for Inter-Blockchain Communication Protocol IBC applications and middleware. The packet-forward-middleware module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destinatio...

Cosmos-SDK Cosmovisor component may be vulnerable to denial of service

Component: Cosmovisor Criticality: Medium Affected Versions: Cosmovisor v1.0.0 distributed with Cosmos-SDK 0.46 Affected Users: Validators and Node operators utilizing unsupported versions of Cosmovisor Impact: DOS, potential RCE on node depending on configuration An issue has been identified on...

GHSA-23PX-MW2P-46QM Cosmos-SDK Cosmovisor component may be vulnerable to denial of service

Component: Cosmovisor Criticality: Medium Affected Versions: Cosmovisor v1.0.0 distributed with Cosmos-SDK 0.46 Affected Users: Validators and Node operators utilizing unsupported versions of Cosmovisor Impact: DOS, potential RCE on node depending on configuration An issue has been identified on...

Cosmos: Circuit Breaker Authorization Issue

Vulnerability description not provided...

Cosmos: RCE and DoS in Cosmovisor

Vulnerability description not provided...

X/crisis Does Not Charge ConstantFee

github.com/cosmos/cosmos-sdk is vulnerable to inconstant Fee. If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the x/crisis module are affected on all versions of the Cosmos SDK...

Privilege Escalation

github.com/cosmos/cosmos-sdk is vulnerable to Privilege Escalation. Attackers are able to setup a victim's account as a malicious vesting account, which allows depositing funds but prohibiting withdrawals, thanks to the PeriodicVestingAccount function defined in x/auth. As a result, you cannot...

GHSA-J2CR-JC39-WPX5 Barberry Security Advisory - regarding x/auth periodic vesting accounts

Impact In PeriodicVestingAccount, defined in x/auth, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able t...