398 matches found
@3s-wallet-core/provider (>=0.0.2 <=1.0.3), @3s-wallet-core/wallet (>=0.0.4 <=1.0.2) +22 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.89.0 <=1.89.1)
@solana/web3.js NPM version =1.89.0, =0.0.2, =0.0.4, =0.4.0-beta.25, =0.4.0-beta.30, =0.4.0-beta.30, =0.4.0-beta.30, =0.0.1, =0.0.2, =2.34.0, =0.0.1, =0.0.1, =0.0.1-beta, =0.4.0, =0.4.0, =0.1.8-beta.8, =0.4.6 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...
@hot-labs/kit (>=1.0.33 <=1.6.4), @hot-labs/omni-sdk (>=2.18.0 <=2.25.5) +9 more potentially affected by CVE-2024-30253 via @solana/web3.js (=1.68.0)
@solana/web3.js NPM version =1.68.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @hot-labs/kit =1.0.33, =2.18.0, =0.2.3, =0.9.0, =0.9.0, =0.21.4-beta, =1.0.1, =1.0.0, =1.0.0, =0.1.1, =1.0.0, =1.0.4 Source cves:...
@0xunreal/dynamic-amm-sdk (>=0.4.22 <=0.4.23), @0xunreal/vault-sdk (=0.5.3) +57 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.66.0 <=1.66.2)
@solana/web3.js NPM version =1.66.0, =0.4.22, =2.0.0-alpha.1, =2.0.0-alpha.5, =2.0.0-alpha.1, =2.11.0, =0.1.0, =0.2.0-master.41, =1.9.0, =0.0.2, =4.0.0-beta.5, =4.0.0-beta.5, =0.7.0, =0.7.1 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...
CVE-2024-30253
@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...
CVE-2024-30253
The CVE concerns @solana/web3.js (Solana JavaScript SDK). Certain inputs can trigger memory exhaustion (OOM), causing an application or service to crash and potentially lose availability. Affected releases are numerous; remediation is to upgrade to the fixed versions listed in the advisory (examp...
CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service
@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...
CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service
@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...
CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service
@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...
web3.js 安全漏洞
Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in solana/web3.js that stems from allowing an attacker to cause an out-of-memory OOM using specific input...
PT-2024-23300 · Solana · @Solana/Web3.Js
Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions prior to 1.0.1 @solana/web3.js versions prior to 1.10.2 @solana/web3.js versions prior to 1.11.1 @solana/web3.js versions prior to 1.12.1 @solana/web3.js versions prior to 1.1.2 @solana/web3.js versions prior to 1.13....
Permanent DOS in liquidity_lockbox for under $10
Lines of code Vulnerability details Impact The liquiditylockbox contract in the lockbox-solana project is vulnerable to permanent DOS due to its storage limitations. The contract uses a Program Derived Address PDA as a data account, which is created with a maximum size limit of 10 KB. Every time...
Griefing attack on liquidity_lockbox withdrawals due to lack of minimum deposit
Lines of code Vulnerability details Impact The liquiditylockbox contract does not enforce a minimum deposit limit. This allows a user to open many positions with minimum liquidity, forcing other users to close these positions one by one in order to withdraw. This could lead to a griefing attack...
Attacker can cause deposits to be locked in the Solana lockbox
Lines of code Vulnerability details Impact An attacker can cause deposits to be locked in the lockbox Proof of Concept In withdraw, if the position has 0 liquidity the execution is reverted function withdrawuint64 amount external address positionAddress =...
Wrong invocation of Whirpools's updateFeesAndRewards will cause it to always revert
Lines of code Vulnerability details Impact Deposits will be unwithdrawable from the lockbox Proof of Concept If the entire liquidity of a position has been removed, the withdraw function calls the updateFeesAndRewards function on the Orca pool before attempting to close the position. function...
0xppl-solana-portfolio (=1.0.0), 0xuath-sdk-react (>=0.0.2 <=0.0.23) +6453 more potentially affected by CVE-2025-3194 via bigint-buffer (=1.1.5)
bigint-buffer NPM version =1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on bigint-buffer and may be impacted: - 0xppl-solana-portfolio =1.0.0 - 0xuath-sdk-react =0.0.2, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =0.0.77, =0.2.0, =0.1.1,...
Malicious code in solanaa (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6c44bcad38775a44e19722c2d14d3a91f383cdb697f449654a2671de100d3921 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...
MAL-2023-2279 Malicious code in solanaa (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6c44bcad38775a44e19722c2d14d3a91f383cdb697f449654a2671de100d3921 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...
Trust Wallet Launches Browser Extension Wallet for Desktop
By Deeba Ahmed The extension will support all EVM chains and Solana. This is a post from HackRead.com Read the original post: Trust Wallet Launches Browser Extension Wallet for Desktop...
Privacy Protocol Elusiv Raises $3.5 Million in Seed Funding
By Deeba Ahmed Elusiv protocol offers privacy with compliance to protect Solana users with accessible and compliant privacy. This is a post from HackRead.com Read the original post: Privacy Protocol Elusiv Raises $3.5 Million in Seed Funding...
