Monero: Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution...

Monero: HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display...

EUVD-2020-19471

Malware in sbrugna...

CVE-2020-26947

monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH with a preference ahead of /usr/lib, which allows local users to gain privileges via a Trojan horse library in the current working directory...

CVE-2020-26947

The CVE-2020-26947 entry concerns monero-wallet-gui in the Monero GUI prior to 0.17.1.0. The root cause is an embedded RPATH that includes the current directory (.) with precedence over /usr/lib, enabling a local attacker to gain privileges via a Trojan horse library placed in the current working...