CVE-2019-18672

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing...

CVE-2019-18671

CVE-2019-18671 affects the ShapeShift KeepKey hardware wallet. Insufficient checks in USB packet handling allow out-of-bounds writes in the .bss segment on firmware up to 6.2.1, with potential code execution or other impact. The issue can be triggered by unauthenticated users and is reachable via...

PT-2019-15571 · Shapeshift · Keepkey

Name of the Vulnerable Software and Affected Versions: ShapeShift KeepKey hardware wallet versions prior to 6.2.2 Description: The issue is related to insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet. This allows a partial reset of cryptographic secrets to...

Malicious 󠅮󠅰󠅭Package

Overview All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Official Monero Site Hacked to Distribute Cryptocurrency Stealing Malware

What an irony — someone hacked the official website of the Monero cryptocurrency project and quietly replaced legitimate Linux and Windows binaries available for download with malicious versions designed to steal funds from users' wallets. The latest supply-chain cyberattack was revealed on Monda...

Official Monero Site Hacked to Distribute Cryptocurrency Stealing Malware

What an irony — someone hacked the official website of the Monero cryptocurrency project and quietly replaced legitimate Linux and Windows binaries available for download with malicious versions designed to steal funds from users' wallets. The latest supply-chain cyberattack was revealed on Monda...

CVE-2019-6120

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...

CVE-2019-6120

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...

Archos Safe-T Information Disclosure Vulnerability

Archos Safe-T is a hardware-based cryptocurrency wallet device. An information disclosure vulnerability exists in Archos Safe-T, which arises from errors such as configuration during operation of a networked system or product, and can be exploited by an unauthorized attacker to gain access to...

Malicious Package

Overview Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised. References GitHub Advisory...

Malicious Package

Overview Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised. References GitHub Advisory...

Malicious Package

Overview Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised. References GitHub Advisory...

Malicious Package

Overview Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised. References GitHub Advisory...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money

ARCHIVED STORY McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money By John Fokker · October 14, 2019 Episode 3: Follow the Money This is the third installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandCrab, the mos...

OPENSUSE-SU-2019:2107-1 Recommended update for opera

This update for opera fixes the following issues: Opera was updated to version 63.0.3368.66: - CHR-7525 Update chromium on desktop-stable-76-3368 to 76.0.3809.132 - DNA-74031 Download indicator doesn’t match progress - DNA-77042 Something went wrong message in crypto wallet in private window -...

BC Vault Information Disclosure Vulnerability

BC Vault is an e-wallet device for storing cryptocurrencies. An information disclosure vulnerability exists in BC Vault. The vulnerability stems from errors such as configuration during operation of a networked system or product. An unauthorized attacker could exploit the vulnerability to obtain...

ShapeShift KeepKey Information Disclosure Vulnerability

ShapeShift KeepKey is an e-wallet device for cryptocurrency storage. An information disclosure vulnerability exists in ShapeShift KeepKey, which can be exploited by unauthorized attackers to obtain sensitive information about affected components...

PT-2019-14488

Name of the Vulnerable Software and Affected Versions Bitcoin Core version 0.18.0 Description The issue concerns the storage of wallet.dat data in memory by bitcoin-qt. When the program crashes, it may create a core file that contains unencrypted wallet data. If this core file is not handled...

Unspecified Vulnerability in Apple iOS and watchOS Wallet

Apple iOS and Apple watchOS are both products of Apple Inc. Apple iOS is an operating system for mobile devices. apple watchOS is an operating system for smartwatches. wallet is a wallet application. A security vulnerability exists in the Wallet component of Apple iOS before 12.4 and watchOS befo...

TronLink Wallet Trust Management Issues Vulnerability

TronLink Wallet is a cryptocurrency wallet application. A trust management issue vulnerability exists in TronLink Wallet version 2.2.0, which can be exploited to read and use a user's keystore to gain unauthorized access with /data/data/com.tronlink.wallet/sharedprefs/.xml...