Nonce is not updated after EVM Transaction

Lines of code Vulnerability details Impact It was observed that nonce is not updated while performing the EVM transaction. This could lead to Replay attacks Proof of Concept 1. Observe the CallEVM function func k Keeper CallEVM ctx sdk.Context, from common.Address, to common.Address, amount...

Signature Malleability in case of using EVM built-in ecrecover()

Lines of code Vulnerability details Impact The ecrecover function which is used verify a signature. The built-in EVM precompile ecrecover is susceptible to signature malleability because of non-unique s and v values which could lead to replay attacks. Proof of Concept Tools Used Manual Analysis...

Cross-chain replay attacks are possible with create2()

Lines of code Vulnerability details Impact Mistakes made on one chain can be re-applied to a new chain There is no chain.id in the create2 function data If a user does create2 using the wrong network, an attacker can replay the action on the correct chain, and steal the funds a-la the wintermute...

Add chainId to address creation.

Lines of code Vulnerability details Impact Although it may not be in the plan to deploy multiple zkSync rollups, it makes sense to include chainid in computeCreate2Address from the very start. It would be more EIP-155 compliant, and will prevent future replay attacks, where a tx of first zkSync...

Signature can be reused across forks due to lack of chainid validation

Lines of code Vulnerability details Impact The signature for GraphTokenUpgradeable.permit won't be resilient to chainsplits. In the event of a chain fork, the message will be assumed valid of both chains and this could allow replays attacks across forks. Proof of Concept The chainid for the...

Cached EIP-712 domain separator may lead to replay attacks

Lines of code Vulnerability details Impact The usage of a cached DOMAINSEPARATOR present in the initializer of the GraphTokenUpgradeable contract may lead to replay attacks in the case of an eventual fork of the chain, since the cached domain separator is constructed with an initial chainId that...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

Information disclosure

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

PT-2022-6152 · Sap · Sap Customer Data Cloud

Name of the Vulnerable Software and Affected Versions: SAP Customer Data Cloud Gigya mobile app for Android version 7.4 Description: The issue is related to an insufficiently robust encryption method used by the software, which lacks proper diffusion and does not effectively hide patterns. This c...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

Brazilian Prilex Hackers Resurfaced With Sophisticated Point-of-Sale Malware

A Brazilian threat actor known as Prilex has resurfaced after a year-long operational hiatus with an advanced and complex malware to steal money by means of fraudulent transactions. "The Prilex group has shown a high level of knowledge about credit and debit card transactions, and how software us...

Voting signature malleability of EVM's ecrecover in castVoteBySig

Lines of code Vulnerability details Proof of Concept EVM's ecrecover is susceptible to signature malleability which allows replay attacks, but that is mitigated here by doing receipt.hasVoted = true;. However, if any of the application logic changes, it might make signature malleability a risk fo...

RedGuard - C2 Front Flow Control Tool, Can Avoid Blue Teams, AVs, EDRs Check

0x00 Introduction Tool introduction RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex re...

Malicious callers can replay disputes

Lines of code Vulnerability details Unlike some of the other signature based operations in the Rigor system, dispute signatures do not include a nonce and are vulnerable to replay attacks. This is similar to my finding in 339, but lower severity, since it is more of a spamming/griefing vector...

Malicious callers can replay change orders

Lines of code Vulnerability details Unlike some of the other signature based operations in the Rigor system, change order signatures do not include a nonce and are vulnerable to replay attacks. A number of exploits are possible using replayed change orders, including subcontractors extracting...

Mozilla Thunderbird 数据伪造问题漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols, and HTML mail formats. Mozilla Thunderbird suffers from a data forgery vulnerability that stems from the fact...

CVE-2022-31277

Xiaomi Lamp 1 v2.0.40066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request...

CVE-2022-31277

Xiaomi Lamp 1 v2.0.40066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request...