CVE-2020-15131

In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.

• CWE-697
• CWE-697

• https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65cPatch, Third Party Advisory
• https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3hThird Party Advisory
• https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65cPatch, Third Party Advisory
• https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3hThird Party Advisory

Published

Jul 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15126In parser-server from version 3.5.0 and before 4.3.0, an aut…6.5
• CVE-2020-15127In Contour ( Ingress controller for Kubernetes) before versi…7.5
• CVE-2020-15128In OctoberCMS before version 1.0.468, encrypted cookie value…6.3
• CVE-2020-15129In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, the…4.7
• CVE-2020-1513An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15130In SLPJS (npm package slpjs) before version 0.27.4, there is…7.5
• CVE-2020-15132In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the …5.3
• CVE-2020-15133In faye-websocket before version 0.11.0, there is a lack of …8.7
• CVE-2020-15134Faye before version 1.4.0, there is a lack of certification …8.7
• CVE-2020-15135save-server (npm package) before version 1.05 is affected by…7.6
• CVE-2020-15136In ectd before versions 3.4.10 and 3.3.23, gateway TLS authe…6.5
• CVE-2020-15137All versions of HoRNDIS are affected by an integer overflow …5.9