@audius/sdk (>=0.0.3-beta.1, <=3.0.8-beta.12), @audius/stems (>=1.5.2-beta.1, <=1.5.4) +14 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.37.0, <=1.37.2)

@solana/web3.js NPM version =1.37.0, =0.0.3-beta.1, =1.5.2-beta.1, =0.0.3, =0.0.1, =0.2.0, =1.5.1, =0.3.3, =3.2.8, =3.3.0 - @winter-love/wallet 1.0.25-alpha.14 - kyzr-marketplace-sdk 0.0.1 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@3s-wallet-core/provider (>=0.0.2, <=1.0.3), @3s-wallet-core/wallet (>=0.0.4, <=1.0.2) +23 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.89.0, <=1.89.1)

@solana/web3.js NPM version =1.89.0, =0.0.2, =0.0.4, =0.4.0-beta.25, =0.4.0-beta.30, =0.4.0-beta.30, =0.4.0-beta.30, =0.0.1, =0.0.2-beta.15, =2.34.0-rc.1, =0.0.1, =0.0.1, =0.0.1-beta, =0.4.0-beta.2, =0.4.0-beta.0, =0.1.8-beta.8, =0.4.6 and more Source cves: CVE-2024-30253 Source advisory:...

@aloe2/account-lib (2.20.20228282226), @aloe2/bitgo (14.2.20228282226) +11 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.56.0, <=1.56.2)

@solana/web3.js NPM version =1.56.0, =2.20.0, =14.2.0, =1.0.1, =2.0.0-rc.18, =8.0.1, =3.0.0-alpha.12, =3.1.2-beta.0, =2.2.33, =2.0.1-alpha.412, =7.0.0, =8.0.2 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@brave/wallet-standard-brave (>=0.0.8, <=0.0.12), @oraichain/owallet-wallet-standard (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.58.0)

@solana/web3.js NPM version 1.58.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @brave/wallet-standard-brave =0.0.8, =0.1.0, =0.1.6, =0.1.10 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@civic/civic-link (>=0.0.5, <=0.0.8-beta.1) potentially affected by CVE-2024-30253 via @solana/web3.js (1.65.0)

@solana/web3.js NPM version 1.65.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @civic/civic-link =0.0.5, =0.0.8-beta.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@dynamic-labs/blocto-evm (>=0.19.0-alpha.21, <=2.1.0-alpha.0), @dynamic-labs/ethereum (>=0.17.0-RC.9, <=2.1.0-alpha.0) +18 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.70.1, <=1.70.3)

@solana/web3.js NPM version =1.70.1, =0.19.0-alpha.21, =0.17.0-RC.9, =2.0.0-alpha.31, =0.18.100-viem.1, =0.15.1-minimal.0, =2.0.0-alpha.4, =0.17.0-RC.7, =0.17.0-RC.7, =0.17.0-RC.10, =0.19.3, =0.19.0-alpha.13, =2.1.0, =0.1.18, =0.0.23, =0.0.21, =0.0.32 and more Source cves: CVE-2024-30253 Source...

@audius/fetch-nft (>=0.1.8-beta.1, <=0.2.6), @audius/sdk (>=3.0.8-beta.13, <=4.2.0) +52 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.78.0, <=1.78.7)

@solana/web3.js NPM version =1.78.0, =0.1.8-beta.1, =3.0.8-beta.13, =0.0.10, =2.20.1-beta.306, =14.2.1-beta.306, =2.2.3-alpha.61, =1.0.1-rc.0, =2.21.0-hotfix.0, =2.6.0, =0.0.5-beta.0, =1.1.0-alpha.1, =1.1.11 - @ctrl-tech/chains-controller 2.0.5 - @ctrl-tech/chains-solana 2.0.18 and more Source...

@3s-wallet-core/provider (>=0.0.2, <=0.0.3), @3s-wallet-core/wallet (0.0.4) +17 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.87.2, <=1.87.6)

@solana/web3.js NPM version =1.87.2, =0.0.2, =0.0.6, =0.1.9, =2.0.3, =0.0.1-alpha.1, =0.0.2, =2.0.0-alpha.15, =0.1.3-rc.1, =3.0.4-1, =0.2.2, =1.11.3-nobnb, =1.0.0, =1.1.0 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...

CVE-2022-47151

CVE-2022-47151 affects WordPress JS Help Desk – Best Help Desk & Support Plugin up to version 2.7.1. The vulnerability is an unauthenticated SQL Injection due to improper neutralization of SQL elements in the plugin, enabling potentially dangerous SQL execution without authentication. Impact is h...

CVE-2024-30253: Improper Restriction of Operations within the Bounds of a Memory Buffer

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...

CVE-2022-47151: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in solana/web3.js that stems from allowing an attacker to cause an out-of-memory OOM using specific input...

PT-2024-23300 · Solana · @Solana/Web3.Js

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions prior to 1.0.1 @solana/web3.js versions prior to 1.10.2 @solana/web3.js versions prior to 1.11.1 @solana/web3.js versions prior to 1.12.1 @solana/web3.js versions prior to 1.1.2 @solana/web3.js versions prior to 1.13....

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service and remote attack due to node.js jose module and jsonata-js JSONata (CVE-2024-28176, CVE-2024-27307)

Summary The Discovery Connector nodes in IBM App Connect Enterprise are vulnerable to a denial of service due to node.js jose module and jsonata-js JSONata. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-28176 DESCRIPTION: Node.js jos...

Shortcodes and extra features for Phlox theme <= 2.15.5 - Contributor+ Stored XSS via Custom JS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the custom JS parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will...

CVE-2023-51672

creationtimestamp| type| source ---|---|--- 2024-04-13 01:26:35+00:00| seen| https://t.me/arpsyndicate/4622...

JS Help Desk – Best Help Desk & Support Plugin < 2.8.4 - Missing Authorization

Description The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to perform an unauthorized action...

The vulnerability in the HTTP/1.1 client of the Node.js software platform arises from insufficient protection of service data due to improper cleaning of Proxy-Authentication headers. This allows attackers to enhance their privileges.

The vulnerability of the HTTP/1.1 Undici software platform for Node.js is related to insufficient protection of service data due to improper cleaning of Proxy-Authentication headers. Exploiting this vulnerability can allow a remote attacker to increase their privileges...