6 results · Feed
-
Medium 4.3
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurre…
-
High 8.4
Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local proce…
-
High 7.5
Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an…
-
Unscored —
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within Q…
-
Unscored —
Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vuln…
-
Unscored —
The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (…