CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30636 – Limited directory traversal vulnerability on Windows in golang.org/x/crypto
https://notcve.org/view.php?id=CVE-2022-30636
httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\..\asd becomes ..\..\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. • https://go.dev/cl/408694 https://go.dev/issue/53082 https://pkg.go.dev/vuln/GO-2024-2961 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29930 – WordPress Crypto Converter Widget plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-29930
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.4. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('cross-site Scripting') en CurrencyRate. Hoy en día, el widget Crypto Converter permite almacenar XSS. Este problema afecta al widget Crypto Converter: desde n/a hasta 1.8.4. The Crypto Converter ⚡ Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. • https://patchstack.com/database/vulnerability/crypto-converter-widget/wordpress-crypto-converter-widget-plugin-1-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46233 – crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
https://notcve.org/view.php?id=CVE-2023-46233
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. • https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html https://access.redhat.com/security/cve/CVE-2023-46233 https://bugzilla.redhat.com/show_bug.cgi?id=2246369 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-328: Use of Weak Hash CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 2CVE-2020-36732
https://notcve.org/view.php?id=CVE-2020-36732
The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary. • https://github.com/miguelc49/CVE-2020-36732-2 https://github.com/miguelc49/CVE-2020-36732-1 https://github.com/brix/crypto-js/compare/3.2.0...3.2.1 https://github.com/brix/crypto-js/issues/254 https://github.com/brix/crypto-js/issues/256 https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b https://security.netapp.com/advisory/ntap-20230706-0003 https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472 • CWE-330: Use of Insufficiently Random Values •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 1CVE-2022-35936 – Ethermint DoS through Unintended Contract Selfdestruct
https://notcve.org/view.php?id=CVE-2022-35936
Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. • https://github.com/evmos/ethermint/blob/c9d42d667b753147977a725e98ed116c933c76cb/x/evm/keeper/statedb.go#L199-L203 https://github.com/evmos/ethermint/commit/144741832007a26dbe950512acbda4ed95b2a451 https://github.com/evmos/ethermint/security/advisories/GHSA-f92v-grc2-w2fg • CWE-668: Exposure of Resource to Wrong Sphere •