CVE-2022-40363

CVE-2022-40363 concerns a buffer overflow in the Flipper Zero firmware, specifically in the nfc_device_load_mifare_ul_data component. Affected versions are Flipper Zero prior to v0.65.2. The issue can allow a crafted NFC file to cause a Denial of Service. The root cause is a buffer overflow withi...

CVE-2022-40363

A buffer overflow in the component nfcdeviceloadmifareuldata of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service DoS via a crafted NFC file...

CVE-2022-40363

A buffer overflow in the component nfcdeviceloadmifareuldata of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service DoS via a crafted NFC file...

CVE-2022-40363

A buffer overflow in the component nfcdeviceloadmifareuldata of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service DoS via a crafted NFC file...

PT-2022-25363 · Unknown · Flipper Zero

Name of the Vulnerable Software and Affected Versions: Flipper Zero versions prior to 0.65.2 Description: A buffer overflow in the nfc device load mifare ul data component allows attackers to cause a Denial of Service DoS via a crafted NFC file. Recommendations: For versions prior to 0.65.2, upda...

CVE-2022-40363: Out-of-bounds Write

A buffer overflow in the component nfcdeviceloadmifareuldata of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service DoS via a crafted NFC file...

pyFlipper - Unoffical Flipper Zero Cli Wrapper Written In Python

Unoffical Flipper Zero cli wrapper written in Python Functions and characteristics: Flipper serial CLI wrapper Websocket client interface Setup instructions: $ git clone https://github.com/wh00hw/pyFlipper.git $ cd pyFlipper $ python3 -m venv venv $ source venv/bin/activate $ pip install -r...

Malicious code in flipper-plugin-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d0ce77de29c719770f78a2ed8c4c02eef1838754428ba47fa797d900c8fe2a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3075 Malicious code in flipper-plugin-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d0ce77de29c719770f78a2ed8c4c02eef1838754428ba47fa797d900c8fe2a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

flipper-frontend-core (>=0.1.0, <=0.212.0), flipper-plugin (>=0.171.0, <=0.212.0) +4 more potentially affected by unknown CVE via flipper-plugin-core (>=0.0.0, <=0.212.0)

flipper-plugin-core NPM version =0.0.0, =0.1.0, =0.171.0, =0.171.1, =0.171.0, =0.171.1, =0.212.0 Source cves: unknown CVE Source advisory: OSV:MAL-2022-3075...

flipper-server (>=0.171.1, <=0.212.0), flipper-server-core (>=0.171.1, <=0.212.0) potentially affected by unknown CVE via flipper-server-companion (>=0.171.1, <=0.212.0)

flipper-server-companion NPM version =0.171.1, =0.171.1, =0.171.1, =0.212.0 Source cves: unknown CVE Source advisory: OSV:MAL-2022-3077...

Malicious Package

Overview flipper-server-companion is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview flipper-frontend-core is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

MAL-2022-2815 Malicious code in eslint-plugin-flipper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c835c9d5ebe0d48d1da9eb4ea4e3576a5a9185f2cde5c14902164dc7f17d0b8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-flipper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c835c9d5ebe0d48d1da9eb4ea4e3576a5a9185f2cde5c14902164dc7f17d0b8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3076 Malicious code in flipper-plugin-ribtree (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed63a783a7e3eed5c4b44fc8a0fac498737e83e6e741d75c8290a18d1b0f4741 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flipper-plugin-ribtree (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed63a783a7e3eed5c4b44fc8a0fac498737e83e6e741d75c8290a18d1b0f4741 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flipper-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 745d70c1af1c5bc8882038e6eac687fd4ce85fa2d6b667c7c5ccef39ce54b877 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

flipper-server (>=0.171.1, <=0.212.0), flipper-server-companion (>=0.171.0, <=0.212.0) +1 more potentially affected by unknown CVE via flipper-frontend-core (>=0.171.0, <=0.212.0)

flipper-frontend-core NPM version =0.171.0, =0.171.1, =0.171.0, =0.171.1, =0.212.0 Source cves: unknown CVE Source advisory: OSV:MAL-2022-3074...

BlockDev Sp. Z o.o: Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`

Summary: The flip contract allows for the MCD system to auction collateral in exchange for DAI. A lack of validation in the method flip.kick allows an attacker to create an auction with a fake bid value. Since the end contract trusts that value, it can be exploited to issue any amount of free DAI...