37 matches found
PT-2026-125878
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets,...
PT-2026-125877
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets,...
PT-2026-125875
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets,...
PT-2026-125876
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets,...
EUVD-2024-54991
Malicious code in bioql PyPI...
EUVD-2024-54990
Malicious code in bioql PyPI...
CVE-2024-49364
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...
CVE-2024-49365
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. Buffer.isBuffer check can b...
Private Key Extraction
tiny-secp256k1 is vulnerable to private key extraction. The vulnerability is due to the ability to bypass Buffer.isBuffer checks when the global Buffer is overridden by the NPM buffer package, which allows an attacker to reuse the nonce k across different messages and extract the private key by...
Improper Input Validation
tiny-secp256k1 is vulnerable to improper input validation. The vulnerability is due to the ability to pass a malicious JSON-stringifiable object to the verify function when the global Buffer is overridden by the NPM buffer package, which allows an attacker to perform a type confusion attack and...
CVE-2024-49365
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. Buffer.isBuffer check can b...
CVE-2024-49364
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...
CVE-2024-49364 tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...
@akhmetovdev/ledger-connector (>=1.1.0, <=1.3.4), @ardenthq/sdk-btc (>=1.0.0, <=1.3.1) +193 more potentially affected by CVE-2024-49364 via tiny-secp256k1 (>=0.0.4, <=1.1.6)
tiny-secp256k1 NPM version =0.0.4, =1.1.0, =1.0.0, =0.0.0-CP-8940-20240801175729, =0.20.0-alpha.10, =0.0.0-CP-8940-20240801175729, =2.8.0-canary.a436aaa.0, =2.8.0-canary.a436aaa.0, =2.8.0-canary.a436aaa.0, =0.0.0-CP-8940-20240801175729, =0.0.0-CP-9420-20250129154656, =0.0.0-CP-9420-20250129154656...
CVE-2024-49364
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...
CVE-2024-49364 tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...
CVE-2024-49364
CVE-2024-49364 affects tiny-secp256k1 (NPM wrapper). Prior to 1.1.7, if global Buffer comes from the NPM buffer package, the Buffer.isBuffer check can be bypassed, enabling private key extraction by signing a malicious JSON-stringifiable object via key reuse across messages. The issue is fixed in...
CVE-2024-49364 tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. The...
CVE-2024-49365
The CVE-2024-49365 issue affects tiny-secp256k1 prior to 1.1.7, where in environments using the Node buffer package, Buffer.isBuffer can be bypassed and a crafted JSON-stringifiable object could be accepted by verify(), potentially causing false-positive True values. The root cause is a vulnerabi...
CVE-2024-49365 tiny-secp256k1 allows for verify() bypass when running in bundled environment
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify, when global Buffer is the buffer package. This affects only environments where require'buffer' is the NPM buffer package. Buffer.isBuffer check can b...