Design/Logic Flaw

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

CVE-2021-3006

The CVE-2021-3006 entry concerns the Seal Finance (Seal) Ethereum token. The breed function in its smart contract lacks access control, enabling price manipulation. Exploitation occurred in the wild during December 2020 and January 2021. The available documents confirm the root cause (unauthorize...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

Seal Finance Farm Security Breach

Seal Finance Farm is a network protocol used by the Seal Finance community to support decentralized trading.SEAL An experimental protocol that acts as an intermediary between the main DeFi protocol tokens, creating deeper liquidity between the two Seal Finance Farm has a security vulnerability. T...

Two Russians Charged in $17M Cryptocurrency Phishing Spree

U.S. authorities today announced criminal charges and financial sanctions against two Russian men accused of stealing nearly $17 million worth of virtual currencies in a series of phishing attacks throughout 2017 and 2018 that spoofed websites for some of the most popular cryptocurrency exchanges...

Zomato: Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameter

Hi Team I have found an issue in support rider amount calculation at the time of checkout where the amount is tamperable by negative fraction of rupees which makes the total amount decreased by maximum of 1rs. POC - 1-Goto - zomato.com 2 - Add anything to your cart 3- At the checkout page , Add...

EUC Security Breach

EUC is an ethereum-based digital currency. A security vulnerability exists in the fallback function in EUC's smart contract implementation. An attacker could exploit the vulnerability by setting the selling price to a large value to execute arbitrary code on the system...

SwftCoin has a logic flaw vulnerability

SwftCoin SWFTC is an ethereum-based virtual currency. The 'buy' function in SWFTC's smart contract implementation has a security vulnerability that stems from the fact that an attacker can specify the price at which to buy. The vulnerability can be exploited by an attacker to cause financial loss...

CVE-2019-18668

An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This...

CVE-2019-18668

Summary of CVE-2019-18668 : The Currency Switcher addon for WooCommerce (versions prior to 2.11.2) is vulnerable. If a user supplies a currency not configured by the administrator, the plugin may accept it and fall back to the default currency for price calculations. As a result, an attacker coul...

WordPress: Parameter tampering : Price Manipulation of Products

Hello Security Team, I have found that you can buy any products in less amount or even we can say as free by changing the price of the product!! POC : 1 go to https://mercantile.wordpress.org/ 2 choose any product and add to cart 3 Now go to cart add your billing details 4 Intercept request with...

CVE-2018-19319

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges...

CVE-2018-16157

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart&a=save itemtotals parameter to zero, the entire cart is sold for free...

Upserve : OLO Total price manipulation using negative quantities

Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...

Yxcms Logic Flaw Vulnerability

Yxcms building system compatible cell phone is a website creation system. A security vulnerability exists in the protected\apps\member\controller\shopcarController.php file in version 1.4.7 of the Yxcms building system compatible cell phone. The vulnerability can be exploited by an attacker to...

CVE-2018-8761

protected\apps\member\controller\shopcarController.php in Yxcms building system compatible cell phone v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture...

Payplans 3.6.2

Payplans 3.6.2 and previous, price manipulation resolution: update to 3.6.3 update notice: https://stackideas.com/blog/critical-update-for-payplans-363...

Adobe: Parameter tampering can result in product price manipulation

Parameters set during the shopping cart checkout workflow are vulnerable to tampering. By intercepting POST requests and manipulating the XML payload, product prices could be set to arbitrary values. P.O.C Video URL: https://youtu.be/3VMlV7jyzg...

Wirecard Checkout Page 1.0 Price Manipulation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2015-061 Product: Wirecard Checkout Page Manufacturer: Wirecard AG Affected Versions: 1.0 Tested Versions: 1.0 Vulnerability Type: Improper Validation of Integrity Check Value CWE-354 Risk Level: High Solution Status: Fixed...