New multiOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-10706)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow, proxyOverflow, transferFlaw, ownerAnyone. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to steal tokens from...

New burnOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-11239)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to...

New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)

This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...

The block chain smart contracts vulnerability, wanted to say your not easy-bug warning-the black bar safety net

In recent days, the block chain platform EOS smart contract vulnerability event once again put on the block chain safe to push on the cusp. An attacker can release contains malicious code“smart contract”, after a series of after the operation, the control block chain, all nodes in the network, an...

Amazon Comes Under Fire for Facial Recognition Platform

Facial-recognition technology has long been touted as a useful tool for law enforcement, but the ability of systems like Amazon’s Rekognition platform to identify large numbers of people at once in a single video or still frame has raised the hackles of privacy advocates. The American Civil...

Aurora IIDXM Design Vulnerability

Aurora IDEX Membership IDXM is a decentralized trading system for Ether ECR-20 tokens. A security vulnerability exists in the implementation of Owned smart contracts in Aurora IIDXM. An attacker could exploit the vulnerability to gain ownership of the contract and change the variables...

New proxyOverflow Bug in Multiple ERC20 Smart Contracts (CVE-2018-10376)

On 4/24/2018, 01:17:50 p.m. UTC, PeckShield again detected an unusual MESH token transaction shown in Figure 1. In this particular transaction, someone transferred a large amount of MESH token — 0x8fff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff,ffff 63 f’s to herself...

Security Vulnerabilities in Smart Contracts

Interesting research: "Finding The Greedy, Prodigal, and Suicidal Contracts at Scale": Abstract: Smart contracts -- stateful executable objects hosted on blockchains like Ethereum -- carry billions of dollars worth of coins and cannot be updated once deployed. We present a new systematic...

Blockchain technology: not just for cryptocurrency

Imagine a place where you can safely store all your personal information and only you decide who has access to it. You can choose which parts of that information you want to share, and you can just as easily revoke that access. If this place ever comes into existence, I am willing to bet it will ...

Harassment scandals, Sheldon Cooper, Black Mirror and blockchain

Lots of good jokes in a popular TV show The Big Bang Theory are related to Sheldon Cooper's bureaucracy in interpersonal relationships: all these "roommate agreement", "relationship agreement", etc. However, because of these endless harassment scandals in media, now it seems like a best practice ...

Explained: blockchain technology

Last week, we talked about what cryptocurrency is and why cybercriminals love it. We mentioned that cryptocurrency was founded on a technology called blockchain, which is a tight system that, when applied correctly, is more secure than most other financial transactions. In this post, we'll explai...

Cisco Smart Net Total Care Contracts Details Page SQL Injection Vulnerability

A vulnerability in the web-based management interface of the Cisco Smart Net Total Care SNTC Contracts Details Page could allow an authenticated, remote attacker to perform a read-only, blind SQL injection attack, which could allow the attacker to compromise the confidentiality of the system...

Stick Squad - Sniper Contracts - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Stick Squad - Sniper Contracts published at the 'play' market has multiple vulnerabilities...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Project Contracts Printing Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. An unspecified security vulnerability exists in the Oracle Project Contracts Printing component of Oracle E-Business Suite, which could be exploited by a remote attacker to submit a special request to modify data...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Service Contracts Renewals Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. An unspecified security vulnerability exists in the Oracle Service Contracts Renewals component of Oracle E-Business Suite, which could be exploited by a remote attacker to submit a special request to modify data...

CVE-2016-0558

Unspecified vulnerability in the Oracle Service Contracts component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Renewals...

CVE-2016-0534

Unspecified vulnerability in the Oracle Project Contracts component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Printing...

CVE-2016-0534

Unspecified vulnerability in the Oracle Project Contracts component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Printing...

CVE-2016-0558

CVE-2016-0558 affects Oracle E-Business Suite via the Oracle Service Contracts component (Renewals). A vulnerability in this component is described as unspecified, impacting integrity and enabling remote attackers to influence data through unknown vectors in versions 11.5.10.2, 12.1.1, 12.1.2, an...

PT-2016-4309

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 11.5.10.2, 12.1.1, 12.1.2, 12.1.3 Description The issue affects the integrity of the system, allowing remote attackers to exploit it via unknown vectors related to Renewals in the Oracle Service Contracts...