BlockDev Sp. Z o.o: Earn free DAI interest (inflation) through instant CDP+DSR in one tx

Summary: The MCD contracts contain different mechanisms for accumulating rates in different contracts, namely pot and jug corresponding to the cost of a loan and interest earned on savings. Because these rates are not synchronised, and depend on the call to the drip method to be calculated, it's...

The vulnerability of the Renewals sub-component of the Oracle Service Contracts component in the Oracle E-Business Suite system allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Renewals sub-component of the Oracle Service Contracts component in the Oracle E-Business Suite system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data...

CVE-2019-2622

Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite subcomponent: Renewals. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-2622

Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite subcomponent: Renewals. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

Code injection

Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite subcomponent: Renewals. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-2622

CVE-2019-2622 concerns the Oracle E-Business Suite Service Contracts (Renewals) component. Affected versions are listed as 12.1.1, 12.1.2, 12.1.3, 12.2.3–12.2.8. The vulnerability is exploitable by an unauthenticated attacker over HTTP with network access, and successful exploitation requires hum...

CVE-2019-2622

Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite subcomponent: Renewals. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

Oracle E-Business Suite Service Contracts Access Control Error Vulnerability

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management and other functions. service Contracts is one of the...

Cynet is offering unhappy competitors' customers a refund for the time remaining on existing contracts

Cynet goes head-to-head with CrowdStrike, DarkTrace, Cylance, Carbon Black & Symantec, offering their unhappy customers a refund for the time remaining on their existing contracts. Cynet, the automated threat discovery and mitigation platform was built to address the advanced threats that AV and...

Py-EVM is vulnerable to arbitrary bytecode injection

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...

CVE-2018-18920

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...

Design/Logic Flaw

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...

CVE-2018-18920

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...

PYSEC-2018-96

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...

CVE-2018-18920

CVE-2018-18920 concerns Py-EVM v0.2.0-alpha.33, where a crafted vm.execute_bytecode call can manipulate computation._stack.values (e.g., "stack": [100, 100, 0]) in a way that expects a certain byte (b'\x') and results in an invalid opcode, causing execution failure. The description ties this to a...

CVE-2018-18920

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...

Dynamic Binary Analysis Tool: Manticore

Manticore is a prototyping tool for dynamic binary analysis, with support for symbolic execution, taint analysis, and binary instrumentation. Manticore comes with an easy-to-use command line tool that quickly generates new program “test cases” or sample inputs with symbolic execution. Each test...

Ethernet place the JSON-RPC Interface to a variety of stolen currency technique big secret-vulnerability warning-the black bar safety net

In 2010, Laszlo the use of 10,000 bitcoin to buy a $ 25 pizza is considered bitcoin in the real world in the first transaction. In 2017, the block chain technology as the digital currency's price soared and standing on the air above. Who could have imagined that in 2010 that two pieces of pizza,...

Incident Response: Do Your Vendor Contracts Have Claws (for Liability)?

In previous blogs, weve discussed some of the struggles organizations have when responding to cyber incidents. For many, it is the recovery aspect, and specifically vendor liability for the data or privacy breach, that poses many questions. In trying to assign liability, the obvious place to star...

EPoD: Ethereum Packet of Death (CVE-2018-12018)

PeckShield has so far discovered quite a few critical smart contract vulnerabilities. Besides smart contracts, the Ethereum ecosystem also includes other various components that are equally exposed to possible exploitation. Obviously, one such component is the core of Ethereum, i.e., the underlyi...