Determine Contract Lifecycle Management XML External Entity Injection Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An XML external entity injection vulnerability exists in the definitionuploadattach.jsp file in Determine CLM version 5.4, which can be exploited by an attacker...

PT-2020-10356

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management CLM version 5.4 Description An issue in report edit.jsp allows any authenticated user to execute Groovy code when generating a report. This results in arbitrary code execution on the underlying server...

PT-2020-10354

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management CLM version 5.4 Description An issue was discovered that allows authenticated remote attackers to read arbitrary files, including configuration files containing administrative credentials, due to an XML...

DDQ override vulnerability

DDQ is a cryptocurrency. A security vulnerability in the 'owned' function in DDQ's smart contract implementation stems from the function's failure to check the identity of the caller. An attacker could use the vulnerability to modify the owner of a smart contract...

BOMBBA Override Vulnerability

BOMBBA BOMB is a cryptocurrency. BOMBBA BOMB has an override vulnerability in the 'quaker' function in its smart contract implementation, which stems from the function's failure to check the identity of the caller. An attacker could use the vulnerability to modify the owner of the smart contract...

Business Alliance Financial Circle (BAFC) Overreach Vulnerability

Business Alliance Financial Circle BAFC is a cryptocurrency. The 'UBSexToken' function in BAFC's smart contract implementation is vulnerable to an overreach vulnerability that stems from the fact that the function is publicly available and does not check the identity of the caller. An attacker...

Cryptbond Network Override Vulnerability

Cryptbond Network CBN is a cryptocurrency. An override vulnerability exists in the 'ToOwner' function in the smart contract implementation of Cryptbond Network CBN, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to...

NewIntelTechMedia Overreach Vulnerability

NewIntelTechMedia NETM is a cryptocurrency. An override vulnerability exists in the 'quaker' function in the smart contract implementation of NewIntelTechMedia NETM, which stems from the fact that the function does not check the identity of the caller. An attacker could use the vulnerability to...

CVE-2018-19831

The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19833

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19834

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19830

The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...

CVE-2018-19832

The NETM function of a smart contract implementation for NewIntelTechMedia NETM, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Default credentials

The UBSexToken function of a smart contract implementation for Business Alliance Financial Circle BAFC, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public by default and does not check the caller's identity...

Design/Logic Flaw

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Code injection

The quaker function of a smart contract implementation for BOMBBA BOMB, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Code injection

The ToOwner function of a smart contract implementation for Cryptbond Network CBN, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

Code injection

The NETM function of a smart contract implementation for NewIntelTechMedia NETM, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19833

The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity...

CVE-2018-19833

The CVE-2018-19833 entry concerns the DDQ smart contract (ERC20) where the function that sets/owners can be invoked by anyone because there is no caller identity check. Connected CNVD records (e.g., CNVD-2020-03511 describing DDQ override vulnerability) reiterate that the DDQ implementation’s own...