UBUNTU-CVE-2021-46873

WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently...

CVE-2021-46873

CVE-2021-46873 concerns WireGuard (e.g., WireGuard 0.5.3 on Windows) where an attacker could force a victim’s system time forward (e.g., via unauthenticated NTP). The result is that one static private key may become permanently useless. The connected documents confirm the affected component and t...

CVE-2021-46873

WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

CVE-2022-37450

Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...

# an attacker can block stuff from the users from being able to do a buyout or sell fractoins or just main functions ,causing grief of users money and time

Lines of code Vulnerability details details uint256 endTime = startTime + PROPOSALPERIOD; if block.timestamp endTime 1.end time is almost block.timestamp so when an user calls this function 2. an attacker can blockstuff and cause the main functions not to happen maybe causing the...

attacker or user can take advantage of percsion error and effect staking

Lines of code Vulnerability details uint256 unlockAt = block.timestamp + maxTime; unlock uninweeks can have precision issues because no floating point variables in solidity so if unlockat is 10.32 is 10 /week 3 it will 3 3 =9 instead of almost 4 weeks so users can unlock before the time they...

Users can get rewards even if not locking for the full lock duration

Lines of code Vulnerability details Impact Users can get rewards that should only have gone to users that locked for the full duration, effectively stealing from those other users Proof of Concept This is the relevant logic from lock that determines the time at which the funds are unlocked: File:...

CronRAT targets Linux servers with e-commerce attacks

There’s an interesting find over at the Sansec blog, wrapping time and date manipulation up with a very smart RAT attack. The file, named CronRAT, isn’t an e-commerce attack compromising payment terminals in physical stores. Rather, it looks to swipe payment details by going after vulnerable web...

PT-2021-7641

Name of the Vulnerable Software and Affected Versions WireGuard versions 0.5.3 Description The issue is related to the implementation of the NTP protocol in WireGuard on Windows, which does not fully account for the possibility that an adversary might set a victim's system time to a future value,...

CVE-2020-36250

The CVE-2020-36250 entry applies to the ownCloud Android client, affected versions prior to 2.15. The vulnerability arises from a bypass of the lock protection mechanism when the system date/time is moved to the past. The connected sources confirm this behavior but do not provide a published reme...

WordPress < 5.4.1 - Unauthenticated Users View Private Posts

Description This could have allowed unauthenticated users to view private posts by manipulating time and date queries...

Monero: Unix time unlock_time values have dangerous validation rules enabling a number of exploits

Initially found by TheCharlatan, discussed with and expanded on by Isthmus, impacts all releases of monero and monero wallets Description The unlocktime field in monero transaction dictates when a transaction's outputs can be spent again. This rule is enforced by the consensus code in...

Nextcloud: Bypassing Passcode/Device credentials

Assume user have set "App passcode" to "Passcode/Device credentials". So whenever user opens the app, it will prompt to unlock before accessing the app. Unfortunately there is a issue, attacker can able to bypass the lock easily in two ways. Setup 1. Install NextCloud app and Log in. 2. Go to...

Design/Logic Flaw

The SimpleSAMLAuthTimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset...

Design/Logic Flaw

DISPUTED An issue was discovered in SMA Solar Technology products. An attacker can change the plant time even when not authenticated in any way. This changes the system time, possibly affecting lockout policies and random-number generators based on timestamps, and makes timestamps for data analys...

DEBIAN-CVE-2015-5300

The panicgate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds...

CVE-2016-1548

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimat...