56 matches found
Molly White Reviews Blockchain Book
Molly White--of "Web3 is Going Just Great" fame--reviews Chris Dixons blockchain solutions book: Read Write Own: In fact, throughout the entire book, Dixon fails to identify a single blockchain project that has successfully provided a non-speculative service at any kind of scale. The closest he...
helium-editions.fr Cross Site Scripting vulnerability OBB-3299968
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
helium-system.de Cross Site Scripting vulnerability OBB-3239293
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Malicious code in helium-constructor (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c4ad560a74f2195e1657743dd392b64089d14a917d739cac76578f27806cba5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in helium-pgbouncer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a35918caba67fee06e074a8eb6c66a80bc8b1aa2d443215ce191780d50dc453d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in helium-helios (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69e851f09b30092c3b708f31d453943bf56739c9ad4cc3e4fcd231e4d7fccde4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3588 Malicious code in helium-constructor (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c4ad560a74f2195e1657743dd392b64089d14a917d739cac76578f27806cba5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3590 Malicious code in helium-pgbouncer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a35918caba67fee06e074a8eb6c66a80bc8b1aa2d443215ce191780d50dc453d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-QM24-4869-99PJ Opendaylight will authenticate any username and password combination
The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination...
Helium: SSRF By adding a custom integration on console.helium.com
A Server Side Request Forgery vulnerability was found in the Add a custom Integration feature on console.helium.com. By creating a custom HTTP integration, and setting the integration endpoint to http://169.254.169.254/latest/meta-data private meta-data from the AWS EC2 instance running can be...
HeliumNetwork Number Error Vulnerability
HeliumNetwork is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in HeliumNetwork's smart contract implementation. An attacker could use this vulnerability to set the balance of any user to an arbitrary value...
Helium: Race Condition of Transfer data Credits to Organization Leads to Add Extra free Data Credits to the Organization
Description i found an way to add data credits for free by doing race condition of transfering data credits using turbo intruder of burpsuite when created an account with only default 10000 data credits but i managed it to add for free without buying or purchasing POC Steps if Confused refer POC...
Helium: Read-Only user can delete users
hello this endpoint DELETE /api/invitations/0ff7e9f9-877a-40cc-b99f-f6b3b1bea3f8 vulnerable to Insecure Direct Object Reference Steps to reproduce the bug Let's assume that three accounts exist: [email protected] role Administrator [email protected] role Read-Only [email protected] invited user...
Helium: HTTP request Smuggling
When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being awa...
Helium: unpermitted user can change the device name of admin account
Invited user with only the read-only permission can change the device name in admin account 1.create two account 'A 'and 'B ' in console.helium 2.Invited the account 'B' with 'A' by giving the read-only permission 3.In account 'B' trying to delete the organization created by admin account 'A' and...
Helium: Cleartext Transmission of Sensitive Information Leads to administrator access
The weakness of the program is Cleartext Transmission of Sensitive Information through URL Leads to administrator access. This program is having one feature like we can add users like administrator and read-only, these are roles, into organizations. Here I get the administrator role at same...
Helium: Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verify
Description: Hello, team! I found 2 vulnerabilities in your 2FA implementation: 1 There is a possibility to link 2FA to any other account if it wasn't set up before and user ID is known on the request /api/2fa. In order to do this, after performing a request for 2FA linking, substitute the ID to...
Helium: Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpoint
Summary The /api/memberships/membershipID endpoint on console.helium.com is open to anyone, including read-only users in an organization. This means that a read-only member can kick a manager, administrator, or even the owner out of an organization using this vulnerability. Steps to Reproduce: 1...
Helium: Organization Takeover
Hello @helium, The console.helium.com application doesn't correctly manage the /membership/ resources and allows a user to privilege escalate an organization of which he's part of just modifying it's role. Steps to reproduce the bug 1 Let's make two user accounts: - [email protected] A...
OpenDaylight Helium Information Disclosure Vulnerability
Opendaylight, a project of the Linux Foundation, is a community-driven, open-source, software-defined networking framework that includes a collection of modules to perform networking tasks that need to be done quickly.OpenDaylight Helium is a version of it. A security vulnerability exists in the...