Security Bulletin: Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections is affected by GSKit and GSKit-Crypto vulnerabilities

Summary Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections has addressed multiple GSKit and GSKit-Crypto vulnerabilities. Details of the vulnerabilities is mentioned below. Vulnerability Details...

[SECURITY] Fedora 28 Update: botan2-2.7.0-1.fc28

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

[SECURITY] Fedora 27 Update: botan2-2.7.0-1.fc27

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

Weak Algorithm Vulnerability in Multiple Huawei Products

Huawei eSpace U1981 and so on are products of Huawei China. eSpace U1981 is a voice gateway product. VP9660 is a multimedia switching platform. A weak cryptographic algorithm vulnerability exists in multiple Huawei products. Exploiting the vulnerability, an unauthenticated remote attacker needs t...

In cryptoland, trust can be costly

While the legal status of cryptocurrencies and laws to regulate them continue to be hammered out, scammers are busy exploiting the digital gold rush. Besides hacking cryptocurrency exchanges, exploiting smart-contract vulnerabilities, and deploying malicious miners, cybercriminals are also...

CVE-2018-13488

The mintToken function of a smart contract implementation for Crypto Alley Shares CAST, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

Integer overflow

The mintToken function of a smart contract implementation for Providence Crypto Casino PVE Contract Name: ProvidenceCasinoToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13488

The mintToken function of a smart contract implementation for Crypto Alley Shares CAST, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13547

The mintToken function of a smart contract implementation for Providence Crypto Casino PVE Contract Name: ProvidenceCasinoToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13488

The CVE-2018-13488 issue affects the Crypto Alley Shares (CAST) Ethereum token. The mintToken function in CAST’s smart contract contains an integer overflow that allows the contract owner to set any user’s balance to an arbitrary value. This is the underlying cause and it implies potential unauth...

CVE-2018-13547

The CVE-2018-13547 entry concerns Providence Casino Token (ProvidenceCasinoToken) on Ethereum, where the mintToken function contains an integer overflow that allows the contract owner to set any user’s balance to an arbitrary value. Public sources in connected documents (CNVD/CNVD-2020-22842 and ...

New ceoAnyone Bug Identified in Multiple Crypto Game Smart Contracts (CVE-2018-11329)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5, burnOverflow6. These vulnerabilities typically affect various tokens that may be publicly traded in...

CVE-2018-13210

The sell function of a smart contract implementation for Providence Crypto Casino PVE Contract Name: ProvidenceCasinoToken, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13210

The vulnerability CVE-2018-13210 affects ProvidenceCasinoToken, an Ethereum ERC20 token. The sell function has an integer overflow where amount * sellPrice can become zero, reducing a seller’s assets. This is described in the NVD entry and corroborated by CNVD/PRION/CVELIST records; no public rem...

CVE-2018-13210

The sell function of a smart contract implementation for Providence Crypto Casino PVE Contract Name: ProvidenceCasinoToken, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CoinHive URL Shortener Abused to Secretly Mine Cryptocurrency Using Hacked Sites

Security researchers have been warning about a new malicious campaign that leverages an alternative scheme to mine cryptocurrencies without directly injecting the infamous CoinHive JavaScript into thousands of hacked websites. Coinhive is a popular browser-based service that offers website owners...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products

Summary Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak...

Security Bulletin: FileNet Capture is affected by GSKit and GSKit-Crypto vulnerabilities

Summary FileNet Capture has addressed multiple GSKit and GSKit-Crypto vulnerabilities. Vulnerability Details CVEID: CVE-2017-3732 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagating bug in the x8664 Montgomery squaring procedure. An...

Several Security Defects in the Bouncy Castle Crypto APIs

The Legion of the Bouncy Castle reports: Release 1.60 is now available for download. CVE-2018-1000180: issue around primality tests for RSA key pair generation if done using only the low-level API. CVE-2018-1000613: lack of class checking in deserialization of XMSS/XMSS^MT private keys with BDS...

EulerOS 2.0 SP3 : python-crypto (EulerOS-SA-2018-1168)

According to the version of the python-crypto package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Heap-based buffer overflow in the ALGnew function in blocktemplace.c in Python Cryptography Toolkit aka pycrypto allows remote attackers to...