CVE-2022-25335

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.

• CWE-863

• https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8Product, Third Party Advisory
• https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1fThird Party Advisory
• https://raw.globalsecuritydatabase.org/GSD-2022-1000077Exploit, Third Party Advisory
• https://twitter.com/RigoBlock/status/1494351180713050116Exploit, Issue Tracking, Third Party Advisory
• https://twitter.com/danielvf/status/1494317265835147272Exploit, Issue Tracking, Third Party Advisory
• https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8Product, Third Party Advisory
• https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1fThird Party Advisory
• https://raw.globalsecuritydatabase.org/GSD-2022-1000077Exploit, Third Party Advisory
• https://twitter.com/RigoBlock/status/1494351180713050116Exploit, Issue Tracking, Third Party Advisory
• https://twitter.com/danielvf/status/1494317265835147272Exploit, Issue Tracking, Third Party Advisory

Published

Feb 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2533An issue has been discovered in GitLab affecting all version…7.4
• CVE-2022-25330Integer overflow conditions that exist in Trend Micro Server…9.8
• CVE-2022-25331Uncaught exceptions that can be generated in Trend Micro Ser…7.5
• CVE-2022-25332The AES implementation in the Texas Instruments OMAP L138 (s…4.1
• CVE-2022-25333The Texas Instruments OMAP L138 (secure variants) trusted ex…8.8
• CVE-2022-25334The Texas Instruments OMAP L138 (secure variants) trusted ex…8.8
• CVE-2022-25336Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and…5.3
• CVE-2022-25337Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and…9.8
• CVE-2022-25338ownCloud owncloud/android before 2.20 has Incorrect Access C…6.8
• CVE-2022-25339ownCloud owncloud/android 2.20 has Incorrect Access Control …5.5
• CVE-2022-2534An issue has been discovered in GitLab CE/EE affecting all v…5.3
• CVE-2022-25342An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.…8.1