CVE-2018-13216

The sell function of a smart contract implementation for GreenMed GRMD, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13225

The sell function of a smart contract implementation for MyYLC, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13214

The sell function of a smart contract implementation for GMile, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

ProvidenceCasino Integer Overflow Vulnerability

ProvidenceCasino PVE is a tradable Ether ERC20 token. An integer overflow vulnerability exists in the sell function of ProvidenceCasino PVE's smart contract implementation where "amount sellPrice" can be zero. An attacker could exploit the vulnerability to reduce the seller's assets...

gosaffron.com XSS vulnerability

Open Bug Bounty ID: OBB-500750 Description| Value ---|--- Affected Website:| gosaffron.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01397)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited via the amount parameter in the index.php?user=additiondeduction request...

CVE-2017-17993

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17993

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17993

Biometric Shift Employee Management System is affected by a cross-site scripting (XSS) vulnerability exposed via the amount parameter in the index.php?user=addition_deduction request. NVD records show XSS with CVSS v2 base score 3.5 (LOW) and a CVSS v3 base score of 5.4 (MEDIUM); attack vector is...

Multiple Vulnerabilities in the EnjoyShop App

Enjoy a purchase app is an online shopping application. There are vulnerabilities in arbitrary user password change, arbitrary account login, arbitrary user payment password reset and payment design of Enjoy a purchase app. An attacker can reset any user, login to any account, reset any payment...

Logic design flaws in Vogelmaster's Android app

Wojia General Manager Android APP is a home control software. There is a logic design vulnerability in Wojia General Management Android APP. An attacker can exploit the vulnerability to modify arbitrary payment amount...

Road to Health Android App Has Logic Design Flaws

Health Road APP is a medical service platform that provides users with services such as registration, consultation, physical examination and accompanying consultation. A logic design vulnerability exists in the Health Road Android APP. The vulnerability is due to the failure of the Alipay payment...

EZZY APP Android version of the deposit function module has a payment design loophole

EZZY APP is a car intelligent sharing platform APP created by Beijing Daimeng Technology Co. The Android version of EZZY APP has a vulnerability in the amount payment design. After logging into the system, an attacker can arbitrarily modify the size of the payment amount by clicking on the paymen...

Payment Design Vulnerabilities in the Top-Up Function Module of EZZY APP Android Version

EZZY APP is a car intelligent sharing platform APP created by Beijing Daimeng Technology Co. There is a payment design vulnerability in the recharge function module of EZZY APP Android version. After logging into the system, an attacker can modify the amount in the payment packet by catching the...

Conti Car Share Android app has a payment logic flaw

Car sharing app is a new energy vehicle time-sharing platform. A payment logic vulnerability exists in Kandi Car Sharing Android app. Attackers can arbitrarily modify the size of the amount by exploiting the vulnerability...

vc movie app has a payment logic design flaw

vc movie app is a movie information software on the phone. The vc movie app has a payment logic design vulnerability. Attackers use the vulnerability to bypass the payment verification mechanism to modify the payment amount...

Zomato: [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member

Hacker was able to find the internal testing Zomato Gold membership. I was able to purchase the PREMIUM GOLD MEMBERSHIP by selecting the amount of our own choice, here it required two conditions first is that you must have a valid premium membership. So, when I looked up the cost of the membershi...

Regular Expression Denial Of Service (ReDoS)

brace-expansion is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string containing a large amount of commas to cause the package to hang...

Project Zero Prize Conclusion

Posted by Natalie Silvanovich, Project Zero On September 13, 2016 we announced the Project Zero Prize. It concluded last week with no prizes awarded. The purpose of this post is to discuss what happened and what we learned about hacking contest design. Throughout the contest, we did not receive a...

Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20170220)

Security Fixes : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. CVE-2017-3731 - A denial of service flaw was found in th...