Malicious code in ens-metadata-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2081a78185962d36398bd09a1f7f68d7724d64666f2c33343bf15011892e8a93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9232 Malicious code in ens-metadata-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2081a78185962d36398bd09a1f7f68d7724d64666f2c33343bf15011892e8a93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ens-metadata-service

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in ens.domains-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86e21617540f2c51cdccf6deb871c1f9e76cfaeb06a565c7265a1d7d5674e293 The OpenSSF Package Analysis project identified 'ens.domains-v2' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...

Assessing the Y, and How, of the XZ Utils incident

High-end APT groups perform highly interesting social engineering campaigns in order to penetrate well-protected targets. For example, carefully constructed forum responses on precision targeted accounts and follow-up "out-of-band" interactions regarding underground rail system simulator software...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

Code injection

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

CVE-2024-0310

CVE-2024-0310 affects the ENS Control browser extension (prior to 10.7.0 Update 15). The issue allows a remote attacker to alter the response header parameter to switch the content-security-policy (CSP) into report-only mode, bypassing CSP protections. Affected component: ENS Control extension; v...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

CVE-2024-0310: Improper Neutralization of Input During Web Page Generation

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

PT-2024-15460 · Unknown · Ens Control

Name of the Vulnerable Software and Affected Versions: ENS Control browser extension versions prior to 10.7.0 Update 15 Description: A content-security-policy vulnerability allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-on...

PT-2024-15385

Name of the Vulnerable Software and Affected Versions Trellix Anti-Malware Engine versions prior to January 2024 release Description A symbolic link manipulation issue allows an authenticated local user to potentially gain an escalation of privileges. This is achieved by adding an entry to the...

ENS (ERC20Votes) token transferred to the proxy contract will be lost forever.

Lines of code Vulnerability details Impact ENS ERC20Votes token transferred to the proxy contract will be lost forever. As delegation amount is out of sync with the ERC1155 balance if the ENS token is transferred to the proxy contract. Proof of Concept When the user delegates 100 tokens to A, the...

use higher version of openzeppelin library instead of vulnerible ones.

Lines of code Vulnerability details Impact the Op lib has some dangerous vulnerabilities in lower versions especially when you work with ERC1155 Openzeppelin already says the lower versions are vulnerable. Affected versions = 4.2.0 Tools Used vs code Recommended Mitigation Steps upgrade versions ...

Incorrect Addresses will be returned via retrieveProxyContractAddress() possibly bricking delegations.

Lines of code Vulnerability details The retrieveProxyContractAddress function is used to retrieve the address where it casts a bytes32 to an address type. function retrieveProxyContractAddress ERC20Votes token, address delegate private view returns address bytes memory bytecode = abi.encodePacked...

CVE-2023-3665

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code...

CVE-2023-3665

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code...

Code injection

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code...