CVE-2018-13203

The sellBuyerTokens function of a smart contract implementation for SwapToken, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13211

CVE-2018-13211 (MyToken). The sell function of the MyToken Ethereum smart contract contains an integer overflow: the product of amount and sellPrice can evaluate to zero, which can reduce a seller’s assets. The description covers the vulnerability but does not provide specifics on affected versio...

CVE-2018-13222

The sell function of a smart contract implementation for ObjectToken OBJ, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13217

The CVE-2018-13217 entry concerns CoinToken’s Ethereum smart contract, where the sell function suffers an integer overflow: the product of amount and sellPrice can under certain conditions evaluate to zero, thereby reducing a seller’s assets. This is caused by arithmetic overflow in the sell path...

CVE-2018-13228

The sell function of a smart contract implementation for Crowdnext CNX, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13208

The sell function of a smart contract implementation for MoneyTree TREE, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13215

The sell function of a smart contract implementation for Sample Token STK Contract Name: cashBackMintable, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13214

The sell function of a smart contract implementation for GMile, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13197

The sell function of a smart contract implementation for Welfare Token Fund WTF, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13219

The sell function of a smart contract implementation for YourCoin ICO Contract Name: ETH033, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13232

The CVE-2018-13232 entry concerns the EnterCoin Ethereum token (ENTER) and its sell function. The vulnerability is an integer overflow where amount * sellPrice can evaluate to zero, potentially reducing a seller’s assets. Documented in the NVD description, it ties to a smart contract integer over...

EnterToken Integer Overflow Vulnerability

EnterToken is a tradable Ether ERC20 token. An integer overflow vulnerability exists in the sell function of EnterToken's smart contract implementation where "amount sellPrice" can be zero. An attacker could exploit this vulnerability to reduce the seller's assets...

CVE-2018-12078

The mintToken function of a smart contract implementation for PolyAI AI, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

Code injection

The mintToken function of a smart contract implementation for Internet Node Token INT, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

CVE-2018-12080

The mintToken function of a smart contract implementation for Internet Node Token INT, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

CVE-2018-12702

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

GHSA-PR3H-JJHJ-573X Sprockets path traversal leads to information leak

Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Workaround:...

CVE-2018-12025

The CVE-2018-12025 entry concerns FuturXE (FXE) ERC20 token. Connected sources provide concrete details: transferFrom is vulnerable due to a logic error in the allowance check—the condition if (allowed[from][msg.sender] >= value) return false misorders the logic, allowing an underflow on allow...

Further Down the Trello Rabbit Hole

Last month's story about organizations exposing passwords and other sensitive data via collaborative online spaces at Trello.com only scratched the surface of the problem. A deeper dive suggests a large number of government agencies, marketing firms, healthcare organizations and IT support...

Gain Visibility and Continuous Security Across All Your Public Clouds

As organizations increase their use of public cloud platforms, they encounter cloud-specific security and compliance threats, which can be challenging to address without the right tools and processes. Organizations’ cloud security difficulties lie in two main areas: Lack of visibility into their...