Monero: Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution...

Monero: View-only offline transaction creation bypasses the long-payment-ID privacy block

A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone...

Monero: HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display...

Monero: monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode

A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The...

EUVD-2020-19471

Malware in sbrugna...

CVE-2020-26947

monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH with a preference ahead of /usr/lib, which allows local users to gain privileges via a Trojan horse library in the current working directory...

CVE-2020-26947

The CVE-2020-26947 entry concerns monero-wallet-gui in the Monero GUI prior to 0.17.1.0. The root cause is an embedded RPATH that includes the current directory (.) with precedence over /usr/lib, enabling a local attacker to gain privileges via a Trojan horse library placed in the current working...

PT-2020-16564

Name of the Vulnerable Software and Affected Versions Monero GUI versions prior to 0.17.1.0 Description The issue allows local users to gain privileges via a Trojan horse library in the current working directory, due to the inclusion of the . directory in an embedded RPATH with a preference ahead...