CVE-2020-12119

HIGH Year: 2020
CVSS v3 Score
8.1
High
CVSS v2 Score
5.8
Medium
Weakness Type
CWE-345
View all →

Vulnerability Description

Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result, users are exposed to basic double spending attacks, amplified double spending attacks, and DoS attacks without user consent.

Related Vulnerabilities

CVE-2016-2346

HIGH
CVSS:8.1(High)

Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-...

CWE-3452016

CVE-2017-11103

HIGH
CVSS:8.1(High)

Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. I...

CWE-3452017

CVE-2017-11130

HIGH
CVSS:8.1(High)

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In t...

CWE-3452017

CVE-2017-17023

HIGH
CVSS:8.1(High)

The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11.04 is a rebranded version of NCP "Secure ...

CWE-3452017

CVE-2017-2667

HIGH
CVSS:8.1(High)

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not che...

CWE-3452017

CVE-2018-12333

HIGH
CVSS:8.1(High)

Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate security relevant configurations and execute malicious code.

CWE-3452018