bittensor-wallet

Problem

Software composition analysis has identified a component with one or more known severe vulnerabilities. Available threat intelligence telemetry has confirmed that the reported high or critical severity vulnerabilities are actively being exploited by malicious actors.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as critical severity.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Problem

On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). Without any protection, both are writable at runtime and thus leave the executable vulnerable to pointer hijacking - an attack where the function address is overwritten with an address of a malicious function. Pointer hijacking can be mitigated by using full read-only relocations, which instruct the compiler to unify global offset tables into a single read-only table. This requires that all external function symbols are resolved at load-time instead of during execution, and may increase loading time for large programs.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as low severity.

Problem

Common compilers often embed source code information into executables for debugging purposes, usually by mapping symbols to source filenames or paths. While this is typically desirable in open-source software and standard tools, that information can be used to determine security weaknesses, code repository layout, trade secrets and similar sensitive information. Such symbols make it easier to reverse-engineer a closed source application.

Problem

Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.