CVE-2018-13207

The sell function of a smart contract implementation for PornCoin PRNC, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13232

The sell function of a smart contract implementation for ENTER ENTR Contract Name: EnterCoin, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13217

The sell function of a smart contract implementation for CoinToken, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13198

The sell function of a smart contract implementation for STeX Exchange ICO STE, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13211

CVE-2018-13211 (MyToken). The sell function of the MyToken Ethereum smart contract contains an integer overflow: the product of amount and sellPrice can evaluate to zero, which can reduce a seller’s assets. The description covers the vulnerability but does not provide specifics on affected versio...

CVE-2018-13223

The sell function of a smart contract implementation for R Time Token v3 RS Contract Name: RTokenMain, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13228

The sell function of a smart contract implementation for Crowdnext CNX, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13222

The sell function of a smart contract implementation for ObjectToken OBJ, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13206

The sell function of a smart contract implementation for ProvidenceCasino PVE, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13209: Integer Overflow or Wraparound

The sell function of a smart contract implementation for Nectar NCTR, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

PT-2018-11700

Name of the Vulnerable Software and Affected Versions YourCoin ICO Contract Name: ETH033 affected versions not specified Description The issue concerns an integer overflow in the sell function of a smart contract implementation for an Ethereum token. Specifically, when amount sellPrice equals zer...

EnterToken Integer Overflow Vulnerability

EnterToken is a tradable Ether ERC20 token. An integer overflow vulnerability exists in the sell function of EnterToken's smart contract implementation where "amount sellPrice" can be zero. An attacker could exploit this vulnerability to reduce the seller's assets...

PT-2018-11695

Name of the Vulnerable Software and Affected Versions GMile smart contract implementation affected versions not specified Description The issue concerns an integer overflow in the sell function of the GMile smart contract implementation. Specifically, when amount sellPrice equals zero, it can lea...

Code injection

The mintToken function of a smart contract implementation for Internet Node Token INT, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

CVE-2018-12078

The mintToken function of a smart contract implementation for PolyAI AI, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

CVE-2018-12080

The mintToken function of a smart contract implementation for Internet Node Token INT, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

CVE-2018-12702

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

GHSA-PR3H-JJHJ-573X Sprockets path traversal leads to information leak

Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Workaround:...

CVE-2018-12025

The CVE-2018-12025 entry concerns FuturXE (FXE) ERC20 token. Connected sources provide concrete details: transferFrom is vulnerable due to a logic error in the allowance check—the condition if (allowed[from][msg.sender] >= value) return false misorders the logic, allowing an underflow on allow...

Further Down the Trello Rabbit Hole

Last month's story about organizations exposing passwords and other sensitive data via collaborative online spaces at Trello.com only scratched the surface of the problem. A deeper dive suggests a large number of government agencies, marketing firms, healthcare organizations and IT support...