CVE-2022-36870

Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

PT-2022-23675 · Samsung · Samsung Pay

Name of the Vulnerable Software and Affected Versions: Samsung Pay versions prior to 5.0.63 for KR and 5.1.47 for Global Description: The issue allows attackers to access files without permission via implicit Intent, exploiting a Pending Intent hijacking vulnerability in NotiCenterUtils...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung. A security vulnerability exists in SAMSUNG Mobile devices version 5.1.47 for international and 5.0.63 for Korea, which stems from MTransferNotificationManager ...

PT-2022-23674 · Samsung · Samsung Pay

Name of the Vulnerable Software and Affected Versions: Samsung Pay versions prior to 5.0.63 for KR and 5.1.47 for Global Description: The issue allows attackers to access files without permission via implicit Intent, exploiting a Pending Intent hijacking vulnerability in...

PT-2022-23676 · Samsung · Samsung Pay

Name of the Vulnerable Software and Affected Versions: Samsung Pay versions prior to 5.0.63 for KR and 5.1.47 for Global Description: The issue allows attackers to access files without permission via implicit Intent, exploiting a Pending Intent hijacking vulnerability in SpayNotification...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung. A security vulnerability exists in SAMSUNG Mobile devices version 5.1.47 for international and version 5.0.63 for Korea, which stems from NotiCenterUtils in...

Xiaomi Phone Bug Allowed Payment Forgery

Smartphone maker Xiaomi, the world’s number three phone maker behind Apple and Samsung, reported it has patched a high-severity flaw in its “trusted environment” used to store payment data that opened some of its handsets to attack. Researchers at Check Point Research revealed last week in a repo...

solana-base-app (0.1.5), solanapaydemo-cookies (>=1.0.0, <=1.2.0) potentially affected by CVE-2022-35917 via @solana/pay (0.1.3)

@solana/pay NPM version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/pay and may be impacted: - solana-base-app 0.1.5 - solanapaydemo-cookies =1.0.0, =1.2.0 Source cves: CVE-2022-35917 Source advisory: OSV:GHSA-J47C-J42C-MWQQ...

Solana Pay Vulnerable to Weakness in Transfer Validation Logic

Description When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied validateTransfer function. An edge case regarding this mechanism could cause the validation logic to validate multiple...

GHSA-J47C-J42C-MWQQ Solana Pay Vulnerable to Weakness in Transfer Validation Logic

Description When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied validateTransfer function. An edge case regarding this mechanism could cause the validation logic to validate multiple...

Weak Transfer Logic

@solana/pay adopts a weak transfer logic. It doesn't properly check if a transaction is valid Solana Pay transfer, ending up validating multiple transfers...

CVE-2022-35917

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

Design/Logic Flaw

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917

CVE-2022-35917 affects Solana Pay’s transfer validation logic (validateTransfer) used when locating a transaction via a reference key. The edge case could cause the validation to approve multiple transfers instead of a single intended transfer. The issue is mitigated by upgrading to version 0.2.1...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

PT-2022-23023 · Solana · Solana Pay

Name of the Vulnerable Software and Affected Versions: Solana Pay versions prior to 0.2.1 Description: Solana Pay is a protocol that enables developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be...

Solana Pay 安全漏洞

Solana Pay is a standard protocol and a set of reference implementations from the Solana Foundation in Switzerland. It enables developers to integrate decentralized payments into their applications and services. A security vulnerability exists in Solana Pay versions prior to 0.2.1 that stems from...

Malicious Package

Overview docs-component-pay is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...