SSNDOB stolen data marketplace shut down by global law enforcement operation

The United States Department of Justice has announced a major takedown of a criminal marketplace that traded Personally Identifiable Information PII. Not just any old marketplace; this was a major, years-long operation with several failsafes to prevent permanent takedown. It took quite the...

Rotten apples banned from the App store

Apple’s App Review process may have received ill wishes from many benevolent developers, but Apple has now revealed how effective it is and why it is so stringent. According to its review of the year 2021, Apple protected customers from nearly $1.5 billion in potentially fraudulent transactions,...

_verifyProof allows empty proofs (allows malleable transactions)

Lines of code Vulnerability details Impact verifyProof allows empty proofs and in that case it expects the leaf to equal the root, because no hashing and iteration is taking place. The purpose of the tree is to hold multiple accepted tokenIds, where the consideration contains one and proving its...

A malicious zone operator can piggyback other transactions, when a caller tries to fulfill the restricted order

Lines of code Vulnerability details If an order has a restricted order type and, if the caller is other than the offerer or zone, then a staticcall to isValidOrder on the zone is made. This call outside the Seaport contract opens up a possible misuse by the zone contract implementation. The zone...

CVE-2022-32000

Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=servicetransactions/manageservicetransaction&id=...

CVE-2022-32000

Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=servicetransactions/manageservicetransaction&id=...

CVE-2022-31998

Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=servicetransactions/viewdetails&id=...

CVE-2022-31998

Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=servicetransactions/viewdetails&id=...

Badminton Center Management System SQL注入漏洞

Badminton Center Management System is a badminton center management system from Carlo Montero's personal developer. It provides an online and automated platform for badminton centers to manage their daily transactions and records. version v1.0 of Badminton Center Management System is vulnerable t...

Badminton Center Management System SQL注入漏洞

Badminton Center Management System is a badminton center management system from Carlo Montero's personal developer. It provides an online and automated platform for badminton centers to manage their daily transactions and records.Badminton Center Management System version v1.0 is vulnerable to SQ...

Latest Mobile Malware Report Suggests On-Device Fraud is on the Rise

An analysis of the mobile threat landscape in 2022 shows that Spain and Turkey are the most targeted countries for malware campaigns, even as a mix of new and existing banking trojans are increasingly targeting Android devices to conduct on-device fraud ODF. Other frequently targeted countries...

Badminton Center Management sql injection vulnerability (CNVD-2022-66682)

Badminton Center Management System is a badminton center management system. It provides an online and automated platform for badminton centers to manage their daily transactions and records. sql injection vulnerability exists in Badminton Center Management 1.0. An attacker can exploit this...

GHSA-XHC3-5PGF-P576 subrion CMS Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability in subrion CMS Version = 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" column on transactions tab...

Microsoft Warns of "Cryware" Info-Stealing Malware Targeting Crypto Wallets

Microsoft is warning of an emerging threat targeting internet-connected cryptocurrency wallets, signaling a departure in the use of digital coins in cyberattacks. The tech giant dubbed the new threat "cryware," with the attacks resulting in the irreversible theft of virtual currencies by means of...

Unchecked call in _withdrawFromYieldPool

Lines of code GeneralVault.solL100-L128 LidoVault.solL122-L149 Vulnerability details Impact In the withdrawFromYieldPool function in LidoVault.sol, the receivedETHAmount value is returned before the sent value for the call function is checked on line 142. When withdrawCollateral is called in...

CVE-2022-30374

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/?page=transactions/managetransaction&id=...

CVE-2022-30374

Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/?page=transactions/managetransaction&id=...

Virtual credit cards coming to Chrome: What you need to know

When youre buying things online, reducing the exposure of payment details during transactions is one way to help reduce the risk of data theft. If you can hide this payment data and switch it out for something else entirely, even better. Google is proposing to do just that for customers in the US...

Batch Transfer will likely fail on ERC777 transfers, either maliciously or accidentally

Lines of code Vulnerability details Impact If users attempt to bridge ERC777s from Cosmos to Ethereum, it is highly likely that the transfers will revert. The issue lies in the combination of using safeTransfer and the idea of batching. safeTransfer will revert for any failed transfer meaning tha...

Attackers can prevent the transfer of the highest-value Cosmos to Ethereum transactions

Lines of code Vulnerability details In order to ensure that profitable batches are eventually created we must avoid locking up the high fee 'good transactions' into obviously bad batches. To add to the difficulty we don't actually know what any token in this process is worth or what ETH gas costs...