HexBrain
Sign in

Browse / Monero

Monero

82disclosed reports

See its reports on the map

What gets reported to Monero

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node ParalysisUncontrolled Resource Consumption · critical
    97 votes
  2. low-level p2p ping + tcp flooding leads to a remote crash in monerodUncontrolled Resource Consumption · critical
    97 votes
  3. [Monero wallet RPC] File precreation to file ownership and credentials leakImproper Access Control - Generic
    75 votes
  4. Wallet RPC Restricted-Mode Policy BypassImproper Authentication - Generic · high
    54 votes
  5. Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashesImproper Access Control - Generic · low
    52 votes
  6. RPC service DOSUncontrolled Resource Consumption · medium
    47 votes
  7. Dynamic fee algorithm doesn't check for zero feeUncontrolled Resource Consumption · low
    46 votes
  8. Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient fieldViolation of Secure Design Principles · medium
    44 votes
  9. wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)NULL Pointer Dereference · high
    44 votes
  10. forum.getmonero.org Shell uploadCode Injection · high
    43 votes
  11. `check_reserve_proof` counts duplicate entries: one output can inflate `total`Business Logic Errors · medium
    42 votes
  12. Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code executionImproper Access Control - Generic · high
    40 votes
  13. Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin ActionsImproper Authentication - Generic · high
    40 votes
  14. Connection Count Bug in Monero Node Enables Outbound Peer Reset AttackPrivacy Violation
    39 votes
  15. `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitmentMissing Required Cryptographic Step · medium
    37 votes
  16. sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txsetUncontrolled Resource Consumption · high
    35 votes
  17. View-only offline transaction creation bypasses the long-payment-ID privacy blockInformation Disclosure · medium
    32 votes
  18. Authenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer changeBusiness Logic Errors · high
    32 votes
  19. HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund TransferCode Injection · medium
    30 votes
  20. ZMQ RPC Log Injection and Untrusted Payload PersistenceCRLF Injection · medium
    30 votes
  21. CryptoNote: remote node DoSUncontrolled Resource Consumption · high
    30 votes
  22. Monero Website & Kovri on your policy are returning 404 not found.Business Logic Errors
    29 votes
  23. SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hashMissing Required Cryptographic Step · medium
    28 votes
  24. RPC call crashes nodeUncontrolled Resource Consumption · high
    28 votes
  25. Hardware Wallets Do Not Check Unlock TImeMan-in-the-Middle · medium
    27 votes
  26. Restricted ZMQ RPC bypasses HTTP restricted-mode resource checksImproper Access Control - Generic · medium
    26 votes
  27. Reported RPC OverflowInteger Overflow
    25 votes
  28. Remote memory exhaustion in Epee RPC stack under zero Receive WindowUncontrolled Resource Consumption · high
    24 votes
  29. Remote node DOSUncontrolled Resource Consumption · medium
    24 votes
  30. Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOMUncontrolled Resource Consumption · high
    23 votes
  31. Reported Denial of ServiceUncontrolled Resource Consumption
    23 votes
  32. A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.
    23 votes
  33. Transactions in invalid blocks are kept in tx-pool without undergoing certain checks.
    23 votes
  34. ZMQ get_output_distribution duplicate amount DoSUncontrolled Resource Consumption · medium
    22 votes
  35. Spamming highly nested JSON RPC requests cause node to disconnect from p2p networkUncontrolled Resource Consumption
    22 votes
  36. `monero-wallet-rpc::rescan_spent` accepts daemon-supplied spent-status from an untrusted daemon, enabling ring-intersection attack on transactionsInformation Disclosure · medium
    21 votes
  37. monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction modeBusiness Logic Errors · medium
    21 votes
  38. `relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`Improper Access Control - Generic · low
    20 votes
  39. Unix time unlock_time values have dangerous validation rules enabling a number of exploitsBusiness Logic Errors · high
    20 votes
  40. wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring memberArray Index Underflow · medium
    19 votes
  41. Inverted ternary in peerlist_manager::filter() allows unlimited whitelist entries per host via different portsBusiness Logic Errors
    18 votes
  42. Attcker can trick monero wallet into reporting it recived twice as much with alternative tx_keypubsBusiness Logic Errors · high
    17 votes
  43. Array Index Underflow--http rpcArray Index Underflow · high
    16 votes
  44. Exploiting Network and Timing Side-Channels to Break Monero Receiver Anonymitymedium
    16 votes
  45. Reentrancy attack in eth-monero atomic swapImproper Access Control - Generic
    15 votes
  46. Kovri: potential buffer over-read in garlic clove handling + I2NP message creationInformation Disclosure · high
    14 votes
  47. Buffer out of bound read in miniupnpc xml parser Buffer Over-read · low
    13 votes
  48. Corrupt RPC responses from remote daemon nodes can lead to transaction tracingPrivacy Violation · medium
    13 votes
  49. Loss of multisig funds through single malicious participant's deliberate deceptionBusiness Logic Errors · medium
    12 votes
  50. Malicious get_random_rct_outs.bin rpc can cause a near-infinite loopUncontrolled Resource Consumption · high
    12 votes
  51. TabNabbing issue (due to taget=_blank)Violation of Secure Design Principles
    11 votes
  52. Monero Wallet Gui for Windows (Arbitrary Code Execution)Code Injection · high
    10 votes
  53. Unauthorized access of Monero wallet by an unprivileged processImproper Access Control - Generic · high
    10 votes
  54. Stack Overflow in JSON RPC ServerStack Overflow
    10 votes
  55. Excessive Resource UsageUncontrolled Resource Consumption
    9 votes
  56. Potential use-after-free due to struct array_entry_t lacking an explicit copy constructorUse After Free · low
    9 votes
  57. RingCT malformed tx prevents target from being able to sweep balanceBusiness Logic Errors · medium
    9 votes
  58. Zero-amount miner TX + RingCT allows monero wallet to receive arbitrary amount of moneroResource Injection · critical
    9 votes
  59. DoS for remote nodes using Slow Loris attackUncontrolled Resource Consumption · medium
    9 votes
  60. Monero GUI not linked with /DYNAMICBASE or hardening on windows, no ASLR
    9 votes
  61. remote access to localhost daemon, can issue jsonrpc commandsCross-Site Request Forgery (CSRF) · low
    9 votes
  62. Monero wallet password change is confirmed when not matchingUnverified Password Change · low
    7 votes
  63. Computing hash of crafted block leads to crash in tree_hash()Uncontrolled Resource Consumption · high
    7 votes
  64. `set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITMImproper Certificate Validation · high
    6 votes
  65. Remote P2P DoSUncontrolled Resource Consumption · critical
    6 votes
  66. Constant-time comparison is not always implemented; critical areas are vulnerable to key-timing attacksMissing Required Cryptographic Step · critical
    6 votes
  67. Trusted daemon check fails when proxied through torsocks or proxychainsPrivacy Violation · low
    6 votes
  68. Out-of-bounds read when importing corrupt blockchain with monero-blockchain-importOut-of-bounds Read · low
    6 votes
  69. monerod JSON RPC server remote DoSUncontrolled Resource Consumption · medium
    5 votes
  70. Misconfiguration in build environment allows DLL preloading attackMisconfiguration · low
    5 votes
  71. Monero can leak unitialized memoryInformation Disclosure · medium
    5 votes
  72. Locked_Transfer functional burninghigh
    5 votes
  73. A bug in the Monero wallet balance can enable theft from exchangesBusiness Logic Errors · critical
    5 votes
  74. Remote Daemon RPC Attackmedium
    4 votes
  75. Misreporting of received amount by show_transfersBusiness Logic Errors · high
    4 votes
  76. monerod can be disabled by a well-timed TCP reset packetUncontrolled Resource Consumption · medium
    4 votes
  77. epee will accept an arbitrary amount of leading line-breaks in an http requestUncontrolled Resource Consumption · low
    4 votes
  78. Potential linkage of public/private (anonymous) node addressesInformation Disclosure · low
    3 votes
  79. CVE-2019-13132 - libzmq 4.1 series is vulnerableViolation of Secure Design Principles · medium
    2 votes
  80. (remote) exabyte allocation via load_from_binary() (DoS)Uncontrolled Resource Consumption · high
    2 votes
  81. Background sync cache retains outgoing additional transaction secret keysInformation Disclosure · low
    1 votes
  82. DLL hijacking in Monero GUI for Windows 0.17.3.0 would allow an attacker to perform remote command executionInformativeCode Injection · medium