Ethereum Classic (ETC) Hit by Double-Spend Attack Worth $1.1 Million

Popular cryptocurrency exchange Coinbase has suspended all transactions of Ethereum Classic ETC—the original unforked version of the Ethereum network—on their trading platforms, other products and services after detecting a potential attack on the cryptocurrency network that let someone spend the...

Coinbase - Buy Bitcoin & more. Secure Wallet. - WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Coinbase - Buy Bitcoin & more. Secure Wallet. published at the 'play' market has multiple vulnerabilities...

Coinbase: ETH contract handling errors

A business logic error in the ETH contract handling code allowed for a nested revert call in contract execution to improperly credit a user account though funds had not been transferred. In addition, the code did not appropriately handle delegatecall within a contract. Sample contract for the fir...

Coinbase: User provided values trusted in sensitive actions

In the Coinbase zencart open source library, a researcher observed two issues related to making calls based on user provided values. The reporter observed that these issues could allow a malicious user to perform an open redirect and a CRLF injection in any PHP version =5.4.1. Unfortunately,...

Coinbase: Prepopulation of email address and name leaks information provided to other merchants

Users of the commerce widget that have entered their name and email into the widget and moved to the currency selection step were vulnerable to a clickjacking attack that revealed name and email to an attacker due to pre-population of the widget's fields. After a user filled out the name / email...

Coinbase: Stored CSS Injection

When creating a product, users can upload a logo. The logourl was not escaped properly, allowing an attacker to inject malicious characters into a style tag. This vulnerability did not allow for XSS due to our CSP, however, it did allow for CSS injection...

Coinbase: Double Payout via PayPal

An issue with the handling of the PayPal transaction states resulted in a user being able to both withdraw money from PayPal, but not have the funds deducted from their account...

Website Glitch Let Me Overstock My Coinbase

Coinbase and Overstock.com just fixed a serious glitch that allowed Overstock customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled Overstock orders...

coinbase.com.dnstree.com XSS vulnerability

On the 29.12.2017 security researcher reported a XSS vulnerability affecting the coinbase.com.dnstree.com website via the Open Bug Bounty coordinated vulnerability disclosure program. Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability submitted via Open Bug Bounty| 29...

Coinbase: Ethereum account balance manipulation

The researchers noticed an issue with our ETH receiving code when receiving from a contract. This allowed sending of ETH to Coinbase to be credited even if the underlying contract execution failed. The issue was fixed by changing the contract handling logic. Analysis of the issue indicated only...

Coinbase: User provided values passed to PHP unset() function

In the Coinbase wpe commerce open source library, a researcher observed a call to the PHP unset function that relied on user controlled input. The reporter observed that this could allow a malicious user to destroy arbitrary variables in the environment where this library is deployed...

Coinbase: New Device Confirmation Bug

Device auto-confirmation appeared to be an issue, but was intended functionality...

Feds Seize BTC-E exchange website – CoinBase suffers DDoS attacks

By Waqas A couple of days ago it was reported that the 38-year-old Russian This is a post from HackRead.com Read the original post: Feds Seize BTC-E exchange website CoinBase suffers DDoS attacks...

Coinbase: Device confirmation Flaw

Devices being auto-confirmed in an unexpected way looked like a security bug but was intended functionality...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

Coinbase: X-Frame-Options

Report noted that status.coinbase.com is embed-able due to its current X-Frame-Options. As there was not a demonstrated link susceptible to clickjacking, this was not a security issue, but notification of the lack of this header was considered Informative. Note: per our policy, reports for...

Coinbase: Open redirect on sign in

Sir I make a video for clear understand. Watch that video. Thanks Best Regards Anirban Singha...

Coinbase: CSRF bug on password change

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, researchers are more likely to earn a larger bounty by explaining how a vulnerability can be exploited to cause harm to Coinbase or its users. Summary: Attacker can change...

Coinbase: [buy.coinbase.com]Content Injection

Hello Coinbase Details I'm not sure if this issue will count, i just want to make sure that is why i submit it. The parameter code is Vulnerable in Content Injection allowing me to inject any Text. Proof Of Concept Here is my PoC: F173393 and this which the text overlaps on the modal. F173394 PoC...

Coinbase: Requestor Email Disclosure via Email Notification

When a Coinbase user requests money from another coinbase user, the user that receives the request sees an email that says, in part: John Smith [email protected] sent you a request to pay 1 BTC using Coinbase. Where John Smith is the sending account's display name meaning you can make it whatever you...