Continuous Monitoring in the Cloud

I recently spoke at the Cloud Security Alliances Federal Summit on the topic "Continuous Monitoring / Continuous Diagnostics and Mitigation CDM Concepts in the Cloud." As government has moved and will continue to move to the cloud, it is becoming increasingly important to ensure continuous...

SS-2018-012: Uploaded PHP script execution in assets

More info at https://www.silverstripe.org/download/security-releases/ss-2018-012/...

Design/Logic Flaw

DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter...

Ether Cartel Unauthorized Operation Vulnerability

Ether Cartel is a blockchain-based pharmaceutical simulation game. A security vulnerability exists in the 'DrugDealer' function of the smart contract implementation in Ether Cartel. An attacker could use the vulnerability to take control of the contract's ownership and potentially manipulate...

Code injection

The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets including Ether balance and tokens might be manipulated by the attackers, as exploited in the wi...

CVE-2018-11329

CVE-2018-11329 concerns the Ether Cartel smart contract, where the public function named DrugDealer governs ownership (ceoAddress). The vulnerability stems from this function acting as a constructor but incorrectly named, enabling an attacker to seize control of the contract and subsequently mani...

CVE-2018-11329

The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets including Ether balance and tokens might be manipulated by the attackers, as exploited in the wi...

CVE-2018-11239

An integer overflow in the transfer function of a smart contract implementation for Hexagon HXG, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a to argument in conjunction with a large value argument, as exploited in the wild in Ma...

5 Reasons Why AV Can’t Protect Your Data Center

Why are so many organizations lagging behind in performing security assessments of virtual assets in their datacenter? One contributing factor is the impact of virtualization on the datacenter has happened so quickly and organically, that products and processes haven’t kept up. Even now, there is...

Valve: Malformed Skybox .TGA in Half-Life (GoldSRC) leads to Access Violation

A malformed .TGA when loaded as a Skybox on a map in a GoldSRC engine game Half-Life can lead to arbitrary code execution on a remote client. Reproduction Steps Load the attached map + resources on a local Half-Life listen server. The game will crash with an Access Violation as soon as the map wi...

Integer overflow

An integer overflow in the transferMulti function of a smart contract implementation for KoreaShow, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted value parameters...

CVE-2018-10706

An integer overflow in the transferMulti function of a smart contract implementation for Social Chain SCA, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets, aka the "multiOverflow" issue...

Integer overflow

An integer overflow in the transferMulti function of a smart contract implementation for Social Chain SCA, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets, aka the "multiOverflow" issue...

CVE-2018-10973

An integer overflow in the transferMulti function of a smart contract implementation for KoreaShow, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted value parameters...

CVE-2018-10706

Summary: CVE-2018-10706 concerns an integer overflow in the transferMulti function of Social Chain (SCA) ERC20 smart contracts. The overflow allows an attacker to cause an unauthorized increase of tokens. The Seebug writeup describes the vulnerable transferMulti() function, where multiplying valu...

CVE-2018-10706

An integer overflow in the transferMulti function of a smart contract implementation for Social Chain SCA, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets, aka the "multiOverflow" issue...

John Summers Q&A - Evanta Global CIO Executive Summit

Akamai's John Summers, VP & CTO, spoke at the recent Evanta Global CIO Executive Summit, a gathering of 75 major organization CIOs. His session was titled, "Cloud Security - Adopt Zero Trust and Put Asset-Level Safeguards in Place." Here are some of the key questions he addressed. How do you...

Cockpit Cross-Site Request Forgery Vulnerability

Cockpit is an open source CMS Content Management System for managing structured content. A server-side request forgery vulnerability exists in the /assets/lib/fuc.js.php file in Cockpit versions 0.4.4 through 0.5.5. A remote attacker can exploit this vulnerability to read arbitrary files or send...

CVE-2018-10468

The transferFrom function of a smart contract implementation for Useless Ethereum Token UET, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer all victims' balances into their account because certain computations involving value are incorrect, as exploited in the wild...

CVE-2018-10468

CVE-2018-10468 affects the Useless Ethereum Token (UET) ERC20 contract. The transferFrom function mishandles calculations involving _value, enabling an attacker to steal funds (e.g., drain victims’ balances). Exploitation has been observed in the wild since 2017-12. Related tokens (e.g., DimonCoi...