CVE-2018-12703

The approveAndCallcode function of a smart contract implementation for Block 18 18T, an tradable Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the "evilReflex"...

CVE-2018-12702

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

CVE-2018-12703

The CVE-2018-12703 vulnerability affects the approveAndCallcode flow in Block 18 (18T) ERC20 contracts. The issue is that _spender.call(_extraData) is not verified, enabling an attacker to hijack the callback and trigger arbitrary contract calls from the vulnerable contract. According to the Seeb...

CVE-2018-12454

The addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable which can be read with a getStorageAt call. Therefore, it allows...

Information disclosure

The addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable which can be read with a getStorageAt call. Therefore, it allows...

CVE-2018-12454

The addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable which can be read with a getStorageAt call. Therefore, it allows...

CVE-2018-12454

The CVE-2018-12454 entry concerns the _addguess function of the simplelottery contract in 1000 Guess. The root cause is the use of publicly readable variables (block data) combined with a private variable (readable via getStorageAt) to generate the random value. This allows an attacker to predict...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Affects IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement (CVE-2017-1741)

Summary The IBM Emptoris Sourcing, IBM Emptoris Contract Management, IBM Emptoris Spend Analysis, IBM Emptoris Program Management and IBM Emptoris Service Procurement products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issue...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server affects IBM Emptoris Strategic Supply Management suite of products and IBM Emptoris Services Procurement (CVE-2017-1583, CVE-2011-4343)

Summary The IBM Emptoris Contract Management ,IBM Emptoris Program Management, IBM Emptoris Sourcing, IBM Emptoris Spend Analysis and IBM Emptoris Services Procurement products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issu...

Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Emptoris Contract Management (CVE-2016-5983)

Summary The IBM Emptoris Contract Management product is affected by a vulnerability that exists in the IBM Websphere Application Server. The security bulletin includes issues disclosed as part of the IBM WebSphere Application Server updates. Vulnerability Details CVEID: CVE-2016-5983 DESCRIPTION:...

Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Emptoris Contract Management ,IBM Emptoris Sourcing and IBM Emptoris Spend Analysis (CVE-2017-1194)

Summary The IBM Emptoris Contract Management ,IBM Emptoris Sourcing and IBM Emptoris Spend Analysis products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issues disclosed as part of the IBM WebSphere Application Server updates...

Security Bulletin: Apache PDFBox affects IBM Emptoris Contract Management (CVE-2016-2175)

Summary Apache PDFBox affects IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2016-2175 DESCRIPTION: Apache PDFBox could allow a remote authenticated attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. ...

Security Bulletin: Vulnerability in BeanShell affects IBM Emptoris Strategic Supply Management. (CVE-2016-2510).

Summary A BeanShell vulnerability for handling Java object deserialization was addressed by IBM Emptoris Strategic Supply Management Platform, IBM Contract Management and IBM Program Management products. Vulnerability Details CVEID: CVE-2016-2510 DESCRIPTION: BeanShell could allow a remote attack...

Security Bulletin: JBoss RestEasy vulnerabilities in IBM Emptoris Contract Management (CVE-2014-3490)

Summary JBoss RestEasy shipped with IBM Emptoris Contract Management is vulnerable to information disclosure. Vulnerability Details CVE ID: CVE-2014-3490 DESCRIPTION: RESTEasy could allow a remote attacker to obtain sensitive information, caused by an incomplete fix related to the processing of X...

FuturXE has an unspecified vulnerability

FuturXE FXE is an ethereum-based virtual currency. A security vulnerability exists in the 'transferFrom' function of the smart contract implementation in FXE, which stems from a logic error in the program. An attacker could exploit the vulnerability to make an unauthorized transfer of digital...

Input validation

The transferFrom function of a smart contract implementation for FuturXE FXE, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equa...

CVE-2018-12025

The transferFrom function of a smart contract implementation for FuturXE FXE, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equa...

CVE-2018-12025

The transferFrom function of a smart contract implementation for FuturXE FXE, an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error. The developer messed up with the boolean judgment - if the input value is smaller than or equa...

CVE-2018-12025

The CVE-2018-12025 entry concerns FuturXE (FXE) ERC20 token. Connected sources provide concrete details: transferFrom is vulnerable due to a logic error in the allowance check—the condition if (allowed[from][msg.sender] >= value) return false misorders the logic, allowing an underflow on allow...

New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)

This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...