CVE-2020-12119

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result, users are exposed to basic double spending attacks, amplified double spending attacks, and DoS attacks without user consent.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-12127.8An elevation of privilege vulnerability exists when an OLE Automation component improperly handles memory.To exploit this vulnerability, an CVE-2020-121207.5The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner CVE-2020-121227.8In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or poss CVE-2020-121238.1CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoi CVE-2020-121249.8A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an atta CVE-2020-121259.8A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker CVE-2020-121269.8Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak CVE-2020-121277.5An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an at CVE-2020-121287.5DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.CVE-2020-121296.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.CVE-2020-12137.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut CVE-2020-121306.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.