CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

Design/Logic Flaw

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18285

CVE-2017-18285 affects Gentoo app-backup/burp prior to 2.1.32. The vulnerability stems from incorrect group ownership/permissions of the /etc/burp directory, potentially allowing a local attacker to read/write arbitrary files by modifying burp-server.conf. Documented impact is local privilege esc...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18284

The CVE-2017-18284 entry concerns Gentoo app-backup/burp prior to version 2.1.32, where the PID file directory is owned by the burp user. This may allow a local attacker with access to the burp account to modify the PID file and terminate arbitrary processes before a root script issues a SIGKILL....

New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)

This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...

New allowAnyone Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-11397, CVE-2018-11398)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5, burnOverflow6, ceoAnyone7. Some of them could be used by attackers to generate tokens out of nowhere ...

Ether Cartel Unauthorized Operation Vulnerability

Ether Cartel is a blockchain-based pharmaceutical simulation game. A security vulnerability exists in the 'DrugDealer' function of the smart contract implementation in Ether Cartel. An attacker could use the vulnerability to take control of the contract's ownership and potentially manipulate...

Code injection

The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets including Ether balance and tokens might be manipulated by the attackers, as exploited in the wi...

CVE-2018-11329

The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets including Ether balance and tokens might be manipulated by the attackers, as exploited in the wi...

CVE-2018-11329

CVE-2018-11329 concerns the Ether Cartel smart contract, where the public function named DrugDealer governs ownership (ceoAddress). The vulnerability stems from this function acting as a constructor but incorrectly named, enabling an attacker to seize control of the contract and subsequently mani...

CVE-2018-11329

The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets including Ether balance and tokens might be manipulated by the attackers, as exploited in the wi...

VulnCheck KEV: CVE-2018-11329

The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets including Ether balance and tokens might be manipulated by the attackers, as exploited in...

Aurora DAO Denial of Service Vulnerability

Aurora DAO AURA is a decentralized trading system for Ether ECR-20 tokens. A security vulnerability exists in the Owned smart contract implementation in AURA. An attacker could exploit the vulnerability to gain ownership of the contract, causing a denial of service...

CVE-2018-10705

The Owned smart contract implementation for Aurora DAO AURA, an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner function is declared as public. An attacker can then conduct a lockBalances denial of service attack...

CVE-2018-10705

CVE-2018-10705 affects Aurora DAO (AURA) Ethereum ERC20 token. The Owned contract’s setOwner() is public and unprotected, allowing an attacker to acquire contract ownership. Once ownership is changed, privileged functions like lockBalances() can be called, enabling a Denial-of-Service (DoS) by pr...

Aurora IIDXM Design Vulnerability

Aurora IDEX Membership IDXM is a decentralized trading system for Ether ECR-20 tokens. A security vulnerability exists in the implementation of Owned smart contracts in Aurora IIDXM. An attacker could exploit the vulnerability to gain ownership of the contract and change the variables...