Inadequate Encryption Strength

Overview trustwallet/wallet-core is a mobile-focused library implementing low-level cryptographic wallet functionality for a high number of blockchains Affected versions of this package are vulnerable to Inadequate Encryption Strength in its mt19937 seed generation, which has only 32 bits of...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

Design/Logic Flaw

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

Trust Wallet Core 安全特征问题漏洞

Trust Wallet Core is an open source, cross-platform, mobile-centric library from Trust Wallet, Inc. A security vulnerability exists in Trust Wallet Core versions prior to 3.1.1, Trust Wallet browser extension prior to 0.0.183, which stems from mt19937 Mersenne Twister uses a single 32-bit value a...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

VulnCheck KEV: CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

CVE-2023-31290

CVE-2023-31290 affects Trust Wallet Core prior to 3.1.1 used in the Trust Wallet browser extension prior to 0.0.183. The root cause is insufficient entropy: mt19937 seed uses a single 32-bit value, yielding only 4 billion possible mnemonics. Affected browser-extension versions are 0.0.172–0.0.182...

PT-2023-23277

Name of the Vulnerable Software and Affected Versions Trust Wallet Core versions prior to 3.1.1 Trust Wallet browser extension versions 0.0.172 through 0.0.182 Description The issue allows theft of funds due to insufficient entropy, which is 32 bits. This is because the mt19937 Mersenne Twister...

@aprilsacil/wallet (>=0.1.36, <=0.1.51), @chainfuse/react (>=0.0.46, <=0.1.0-dev.96) +15 more potentially affected by CVE-2023-30543 via @web3-react/coinbase-wallet (>=8.0.31-beta.0, <=8.0.34-beta.0)

@web3-react/coinbase-wallet NPM version =8.0.31-beta.0, =0.1.36, =0.0.46, =0.0.70, =0.0.6-alpha.0, =0.1.0, =0.0.1, =0.1.0, =0.13.29, =0.1.20, =0.0.1, =0.0.2, =0.0.11, =0.1.31 and more Source cves: CVE-2023-30543 Source advisory: OSV:GHSA-8PF3-6FGR-3G3G...

@aprilsacil/wallet (>=0.1.36, <=0.1.51), @bosonprotocol/react-kit (>=0.1.0-alpha.0, <=0.1.0-alpha.2) +44 more potentially affected by CVE-2023-30543 via @web3-react/metamask (>=8.0.6-beta.0, <=8.0.28-beta.0)

@web3-react/metamask NPM version =8.0.6-beta.0, =0.1.36, =0.1.0-alpha.0, =0.0.46, =0.0.70, =1.0.0, =1.0.0, =0.0.1, =1.1.0, =1.0.2, =0.0.3, =1.0.0, =1.0.0, =0.0.6-alpha.0, =0.0.12 and more Source cves: CVE-2023-30543 Source advisory: OSV:GHSA-8PF3-6FGR-3G3G...

@aprilsacil/wallet (>=0.1.36, <=0.1.51), @chainfuse/react (>=0.0.46, <=0.1.0-dev.96) +40 more potentially affected by CVE-2023-30543 via @web3-react/walletconnect (>=8.0.23-beta.0, <=8.0.36-beta.0)

@web3-react/walletconnect NPM version =8.0.23-beta.0, =0.1.36, =0.0.46, =0.0.70, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =1.1.0, =0.0.3, =1.0.0, =0.0.6-alpha.0, =0.0.12 - @huma-finance/widgets 0.0.6-alpha.0 - @huma-shan/shared 0.0.1 and more Source cves: CVE-2023-30543 Source advisory:...

Cryptocurrency Stealer Malware Distributed via 13 NuGet Packages

Cybersecurity researchers have detailed the inner workings of the cryptocurrency stealer malware that was distributed via 13 malicious NuGet packages as part of a supply chain attack targeting .NET developers. The sophisticated typosquatting campaign, which was uncovered by JFrog late last month,...

Malicious Package

Overview mobilecoin-wallet is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in mobilecoin-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4739ef2ec2f66acd195041b4cc6c271f5158fb855ec4319ae141dc9e86b95d31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-607 Malicious code in mobilecoin-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4739ef2ec2f66acd195041b4cc6c271f5158fb855ec4319ae141dc9e86b95d31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Crypto ATM Manufacturer General Bytes Suffers $1.5m Bitcoin Theft

By Habiba Rashid The company has disclosed the wallet addresses and three IP addresses used by the attacker in the hack. This is a post from HackRead.com Read the original post: Crypto ATM Manufacturer General Bytes Suffers $1.5m Bitcoin Theft...

Users can lose funds due to stuck NFT's

Lines of code Vulnerability details Impact If msg.sender is a contract could also be smart contract wallet that does not implement the onERC721Received method, in the current implementation of fuse Namespace.sol && mint Bio.sol, the tx will still be successful, and the token will be minted. In th...

Cryptojacking Group TeamTNT Suspected of Using Decoy Miner to Conceal Data Exfiltration

The cryptojacking group known as TeamTNT is suspected to be behind a previously undiscovered strain of malware used to mine Monero cryptocurrency on compromised systems. That's according to Cado Security, which found the sample after Sysdig detailed a sophisticated attack known as SCARLETEEL aime...