Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2020-15131

False-positive validity for NFT1 genesis transactions in SLP Validate

In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Simpleledger
Products
Slp-validate
CVE-2020-15130

False-positive validity for NFT1 genesis transactions in SLPJS

In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Simpleledger
Products
Slpjs
CVE-2020-11072

False-negative validation results in MINT transactions with invalid baton

In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.

CVSS 3.1 · 8.6 High EPSS 1.0% KEV · Not listed
Vendors
Simpleledger
Products
Slp-validate
CVE-2020-11071

False-negative validation results in MINT transactions with invalid baton

SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Simpleledger
Products
Slpjs
CVE-2020-11014

BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLP

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the ability to issue new tokens or permanently destroy future minting capability. This is fixed version 3.6.2.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Simpleledger
Products
Electron-cash-slp
CVE-2019-16762

Validator parsing discrepancy due to string encoding in NPM slpjs

A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any version >= 0.21.4.

CVSS 3.1 · 5.7 Medium EPSS 1.1% KEV · Not listed
Vendors
Simpleledger
Products
Slpjs
CVE-2019-16761

Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0

A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0.0 have been patched.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Simpleledger
Products
Slp-validate