CVE-2022-35917

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

Design/Logic Flaw

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917

CVE-2022-35917 affects Solana Pay’s transfer validation logic (validateTransfer) used when locating a transaction via a reference key. The edge case could cause the validation to approve multiple transfers instead of a single intended transfer. The issue is mitigated by upgrading to version 0.2.1...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

CVE-2022-35917 Weakness in Transfer Validation Logic in @solana/pay

Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient...

PT-2022-23023 · Solana · Solana Pay

Name of the Vulnerable Software and Affected Versions: Solana Pay versions prior to 0.2.1 Description: Solana Pay is a protocol that enables developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be...

Solana Pay 安全漏洞

Solana Pay is a standard protocol and a set of reference implementations from the Solana Foundation in Switzerland. It enables developers to integrate decentralized payments into their applications and services. A security vulnerability exists in Solana Pay versions prior to 0.2.1 that stems from...

Malicious Package

Overview docs-component-pay is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

ATO Attacks Targeting Financial Services Increased 58 Percent in May. Who Else Needs to Worry?

Account takeover ATO is a form of identity theft that cyber criminals use to get unauthorized access to the accounts of legitimate users through some kind of brute force method such as Credential Stuffing. In 2022, account takeover attacks are on the rise. In June for example, Imperva’s Threat...

Malicious code in react-pay-with-diem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f53447b20e0237917499ff19993524554fe480c1fb5026388216f5beadaa2116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3626 Malicious code in hide-pay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a3a3328e941452cee1af7de1eb20fd3dcb4950ca894c00008909073fe57e96a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hide-pay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a3a3328e941452cee1af7de1eb20fd3dcb4950ca894c00008909073fe57e96a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5233 Malicious code in pay-with-amazon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718041a581a21642d57a5b1ef1ec6ebdb5d047dc19030a9941d60ad0ea3a08f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pay-with-amazon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718041a581a21642d57a5b1ef1ec6ebdb5d047dc19030a9941d60ad0ea3a08f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dazaar-pay-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 064e6c236b32a0d0a08c8715b287ff3065b39848d0de40735e2cc8df7505c1fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2357 Malicious code in dazaar-pay-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 064e6c236b32a0d0a08c8715b287ff3065b39848d0de40735e2cc8df7505c1fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pay-with-bitpay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6ebb5b5e2e2c9c966ed6bc7d57b453bf509a83fba50883992e0cd8b8773deb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5234 Malicious code in pay-with-bitpay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6ebb5b5e2e2c9c966ed6bc7d57b453bf509a83fba50883992e0cd8b8773deb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in remote-pay-cloud-starter-example-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d542ce933de681b375aa1f4029845a353ad0f26d147dc9f4b3b01627cfa8d84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...