Tangem 安全漏洞

Tangem is a native Kotlin library for the Android and JVM platforms open sourced by Tangem. A security vulnerability exists in Tangem versions prior to 5.18.3, which stems from a flawed logic in offline wallet authentication that could result in the results being ignored...

CVE-2025-27839: Comparison Using Wrong Factors

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation genuineness check that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible...

CVE-2025-27839

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation genuineness check that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible...

CVE-2025-27839

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation genuineness check that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible...

PT-2025-10132

Name of the Vulnerable Software and Affected Versions Tangem SDK versions prior to 5.18.3 Description The issue is related to a logic flow in offline wallet attestation, specifically in the genuineness check, which causes verification results to be disregarded during the first scan of a card. Thi...

CVE-2025-27839

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation genuineness check that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible...

CVE-2025-27839

The CVE affects Tangem SDK for Android (before 5.18.3) in AttestationTask.kt, where offline wallet genuineness check logic can cause verification results to be disregarded on the first card scan. The issue is limited to the first scan flow and exploitation may not have been possible; upgrading to...

CVE-2024-13724

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their...

CVE-2024-13682

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in...

Malicious code in provider-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ad24f6e17c740bf18547fc420e4f9a54a4fa4c950b1f6ed8ff64a7a243e2bfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2122 Malicious code in provider-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ad24f6e17c740bf18547fc420e4f9a54a4fa4c950b1f6ed8ff64a7a243e2bfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ton-wallet/create (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d32db786acddb2de3383780a06c377b94cbe49ae5c8ddb811d5f9175bc0c9dbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2083 Malicious code in @ton-wallet/create (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d32db786acddb2de3383780a06c377b94cbe49ae5c8ddb811d5f9175bc0c9dbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2128 Malicious code in serum-anchor-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c43199561186f5ce43ff0fd760c87d56375a9c388bbd6f058d1dfe4d4c0f4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in serum-anchor-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c43199561186f5ce43ff0fd760c87d56375a9c388bbd6f058d1dfe4d4c0f4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13724

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their...

CVE-2024-13724

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their...

CVE-2024-13682

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in...

CVE-2024-13682

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in...

CVE-2024-13724 Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their...