4927 matches found
aflnet
It is an offensive tool for network protocols. The primary CVE ID is not explicitly stated in the provided context, but the tool is mentioned in a research paper that was accepted for publication at the IEEE International Conference on Software Testing, Verification and Validation ICST 2020. The...
CLSA-2021-1634925634 Fixed 9 CVEs in squid34
CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack - CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service - CVE-2020-25097: fix improper input validation allowing HTTP smuggling from trusted client -...
QuickAccManager.sol#send() Potential replay attack
Handle WatchPug Vulnerability details In QuickAccManager.solsend, addressidentity is not included in the txHash, makes it possible to replay the transaction when the same QuickAccount accHash controls multiple Identity. function sendIdentity identity, QuickAccount calldata acc, DualSig calldata...
Signature replay attacks for different identities (nonce on wrong party)
Handle cmichel Vulnerability details A single QuickAccount can serve as the "privilege" for multiple identities, see the comment in QuickAccManager.sol: NOTE: a single accHash can control multiple identities, as long as those identities set it's hash in privilegesaddressthis. this is by design If...
QuickAccManager.sol Potential replay attack
Handle WatchPug Vulnerability details This issue is possibly duplicate with a previous issue named "Potential replay attack" In QuickAccManager.solsendTxns and QuickAccManager.solsendTransfer, addressidentity is not included in the txHash, makes it possible to replay the transaction on another...
GHSA-VJ62-G63V-F8MF Validity check missing in Frontier
Impact In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block...
Validity check missing in Frontier
Impact In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block...
Input validation
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
CVE-2021-41138
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
CVE-2021-41138 Validity check for signed Frontier-specific extrinsic not called in block execution
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
CVE-2021-41138
CVE-2021-41138 concerns Frontier, Substrate’s Ethereum compatibility layer. A signed Frontier-specific extrinsic for pallet-ethereum caused many validation checks to run only during transaction pool validation, not during block execution, allowing malicious validators to include invalid transacti...
Frontier 输入验证错误漏洞
Frontier is an EtherCompatible layer for Substrate. It is used to run unmodified ethereum dapps. Frontier suffers from an input validation error vulnerability, which stems from the fact that a large portion of the transaction validation logic in the recently introduced signed Frontier-specific...
CVE-2021-35067
Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data e.g., an attacker who sniffs a Close message can transmit an acceptable Open message...
CVE-2021-35067
Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data e.g., an attacker who sniffs a Close message can transmit an acceptable Open message...
Design/Logic Flaw
Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data e.g., an attacker who sniffs a Close message can transmit an acceptable Open message...
CVE-2021-35067
Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data e.g., an attacker who sniffs a Close message can transmit an acceptable Open message...
CVE-2021-35067
CVE-2021-35067 affects Meross MSG100 devices (firmware before 3.2.3). The vulnerability allows an attacker to replay the same data or similar data (e.g., sniffed Close messages and transmit an acceptable Open message), enabling unauthorized state changes. Documents from multiple sources corrobora...
CVE-2021-35067
Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data e.g., an attacker who sniffs a Close message can transmit an acceptable Open message...
CVE-2021-25480
A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead to remote denial of service on mobile network connection...