Citrix Credential Wallet Service and Citrix Peer Resolution Service do not start

On the Citrix storefront services console, the Citrix Peer Resolution Service and the Citrix Credential Wallet services stay in stopped state, wouldn't start even if we start manually...

Coinbase: Transactions visible on Unconfirmed devices

Pusher authentication did not take device confirmation into account. This would allow an attacker with a valid session but an unconfirmed device to snoop on pusher updates like incoming transactions. This issue was in the coinbase event notification Pusher, which allowed me to read notification o...

Enter: No rate limit which leads to "Users information Disclosure" including verfification documents etc.

HOST api.romit.io Endpoint /v0/cash/auth/login Issue When an attacker tries to login at app.romit.io, he is prompted to enter the PIN . There is no rate limit to verify this. Although there is a an authorization header Authorization: Credential=b67b0b10571ac00444de3cffde0b5b05,...

Enter: Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"

Issue It is possible to set negative values for the Buy Fee and Sell Fee, which will cause unexpected transfers etc. as these settings override the settings at the location. PoC 1. Go to the Operator Wallet's Settings. 2. Click on the users tab. 3. Select any user. 4. Go to settings tab of that...

Tails 1.3 Released, Introduces 'Electrum Bitcoin Wallet'

A new Tails 1.3 has been released with support to a secure Bitcoin wallet. Tails, also known as the 'Amnesic Incognito Live System', is a free security-focused Debian-based Linux distribution, specially designed and optimized to preserve users' anonymity and privacy. Tails operating system came t...

itBit Exchange: Leakage of sensitive wallet tokens to third party sites

Hello Itbit team This is Shahmeer and i am reporting a very critical issue in which the wallet tokens such as the one below are being leaked to third party websites https://beta.itbit.com/trading-history/402bd136-be8f-45e2-89ea-46e3283f8118 The above listed URL contains the wallet token that is...

Enter: Frictionless Transferring of Wallet Ownership

In the Robocoin application, users can create their own personal or operator wallets and then share it with other Robocoin users. It was observed that this sharing of wallets with other users is frictionless. In other words, the users with whom the wallet is shared with Let's say B and C are not...

Bitstamp Offline Following Wallet Compromise

Bitstamp, a Bitcoin exchange based in the United Kingdom, remains offline this afternoon following what appears to have been a compromise over the weekend. The company tweeted shortly after 4 a.m. Monday that it had to temporarily halt all withdrawals because it believes one of its wallets was...

Enter: stored xss in transaction

Open wallet settings and remove maxlength="30" from wallet name input 2. Change name to something like this asdf'"alert1 3. Go to "Send bitcoin" and make inbound transfer from one wallet to another with description: descalert'xss in description' 4. Submit form 5. After submit we got xss both in...

Enter: Stored XSS in api key of operator wallet

Make an operation wallet 2. Open wallet settings 3. Press "New key" 4. In source code remove "maxlength=30" of key's name input tag - no length check on server-side 5. Fill name input with "asdf" PoC 6. Press "Generate Key" 7. After that when open wallet settings we got XSS. 8. In case we can...

CVE-2014-6881

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6881

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6881

The CVE-2014-6881 entry concerns the PNC Virtual Wallet Android app (package com.pnc.ecommerce.mobile.vw.android) prior to version 2.2. The vulnerability is a lack of SSL certificate validation, allowing MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Th...

CVE-2014-6881: Undefined Security Weakness

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

[SECURITY] Fedora 20 Update: kwalletmanager-4.14.1-1.fc20

KDE Wallet Manager is a tool to manage the passwords on your KDE system...

Bitcoin Phishing Scam Takes Aim at 400 Organizations

More than 400 organizations were recently targeted by a Bitcoin phishing campaign that intended to con users into disclosing their wallet passwords. According to Proofpoint, a California-based email security firm that recapped the campaign Wednesday, 12,000 messages were recently sent in two wave...

Android new vulnerability exposure: hack may fake and authentic applications-vulnerability warning-the black bar safety net

Ticker 7 on 3 0 September morning news, on Tuesday released a study on the display, the Google Android operating system has a security vulnerability that can allow a hacker to fake a trusted formal application, thereby hijacking the user's smartphone or tablet. The security company Bluebox Securi...

Android "Fake ID" Vulnerability Allows Malware to Impersonate Trusted Apps

Due to the majority in the mobile platform, Google’s Android operating system has been a prior target for cybercriminals and a recently exposed weakness in the way the operating system handles certificate validation, left millions of Android devices open to attack. Researchers at BlueBox security...

Critical Android FakeID Bug Allows Attackers to Impersonate Trusted Apps

There is a critical vulnerability in millions of Android devices that allows a malicious app to impersonate a trusted application in a transparent way, enabling an attacker to take a number of actions, including inserting malicious code into a legitimate app or even take complete control of an...