Black Hat 2018: Widespread Critical Flaws Found in Smart-City Gear

Smart-city technology continues to roll out in municipalities worldwide – everything from automated alerts about weather hazards and traffic issues to smart lighting and connected trash systems. However, like the rest of the Internet of Things IoT ecosystem, security is always a concern, as...

Attending Black Hat USA 2018? Here’s what to expect from Microsoft.

Black Hat USA 2018 brings together professionals at all career levels, encouraging growth and collaboration among academia, world-class researchers, and leaders in the public and private sectors. This is an exciting time as our Microsoft researchers, partners, and security experts will showcase t...

@absinthe/graphiql-workspace (>=1.1.4, <=1.1.5), @agilys/custom-graphiql (>=2.0.0-beta1, <=2.0.3) +1307 more potentially affected by CVE-2017-16114 via marked (>=0.0.1, <=0.3.7)

marked NPM version =0.0.1, =1.1.4, =2.0.0-beta1, =1.0.1, =0.25.0, =0.0.0-development, =3.3.1, =0.0.1, =0.0.0, =0.0.3 and more Source cves: CVE-2017-16114 Source advisory: OSV:GHSA-X5PG-88WF-QQ4P...

app.js (>=0.0.1, <=0.0.21), attester (>=1.0.2, <=1.2.1) +37 more potentially affected by CVE-2017-16086 via ua-parser (>=0.2.4, <=0.3.5)

ua-parser NPM version =0.2.4, =0.0.1, =1.0.2, =2.2.2, =1.0.0, =0.1.0, =0.0.1, =0.0.5, =0.0.2, =0.2.2, =0.2.16 and more Source cves: CVE-2017-16086 Source advisory: OSV:GHSA-PMG9-P9R2-6Q87...

@folk-org/js-dav (>=1.0.0, <=1.0.3), @lettercms/models (>=0.0.1, <=0.0.12) +187 more potentially affected by CVE-2017-16082 via pg (>=4.0.0, <=4.5.6)

pg NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.15 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

acidjs (>=0.0.2, <=1.0.1), acl-knex (>=0.1.2, <=0.1.3) +41 more potentially affected by CVE-2017-16082 via pg (>=3.0.3, <=3.6.3)

pg NPM version =3.0.3, =0.0.2, =0.1.2, =0.0.1, =0.0.2, =0.1.0, =0.0.4, =0.3.0, =0.0.11, =0.0.12, =0.1.2, =0.0.2, =0.0.1, =0.0.64 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

How Microsoft 365 Security integrates with the broader security ecosystem—part 1

Today's post was coauthored by Debraj Ghosh, Senior Product Marketing Manager, and Diana Kelley, Cybersecurity Field CTO. This week is the annual Microsoft Inspire conference, where Microsoft directly engages with industry partners. Last year at Inspire, we announced Microsoft 365, providing a...

July 10, 2018—KB4338819 (OS Build 17134.165)

None None...

Integer overflow

The mintToken function of a smart contract implementation for Enterprise Token Ecosystem ETE Contract Name: NetkillerToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13773

The mintToken function of a smart contract implementation for Enterprise Token Ecosystem ETE Contract Name: NetkillerToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

EPoD: Ethereum Packet of Death (CVE-2018-12018)

PeckShield has so far discovered quite a few critical smart contract vulnerabilities. Besides smart contracts, the Ethereum ecosystem also includes other various components that are equally exposed to possible exploitation. Obviously, one such component is the core of Ethereum, i.e., the underlyi...

Globalvillage ecosystem evilReflex has an unspecified vulnerability.

Globalvillage ecosystem GVE is a virtual currency system based on blockchain technology. A security vulnerability exists in the 'approveAndCallcode' function in GVE's smart contract implementation, which stems from the program's failure to validate the callcode.An attacker could use this...

CVE-2018-12702

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

Design/Logic Flaw

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

CVE-2018-12702

The CVE-2018-12702 entry concerns Globalvillage ecosystem (GVE) ERC20 contracts where approveAndCallcode allows an attacker to hijack a callback via a non-verified _spender.call(_extraData), enabling token transfers from the vulnerable contract (evilReflex). Connected sources describe the mechani...

CVE-2018-12702

The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem GVE, an Ethereum ERC20 token, allows attackers to steal assets e.g., transfer the contract's balances into their account because the callcode i.e., spender.callextraData is not verified, aka the...

[SECURITY] Fedora 28 Update: matrix-synapse-0.31.2-1.fc28

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

CVE-2017-16126

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. Source IP process.versions process.platform How the module was invoked test, require,...

[SECURITY] Fedora 28 Update: matrix-synapse-0.28.1-1.fc28

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

Riccardo Di Blasio joins Wallarm as an advisor

We are excited to welcome Riccardo Di Blasio to Wallarm advisory team. Riccardo is a well known industry executive who brings his experience running go-to-market operations and managing business worldwide for large internationals like EMC Corp and VMware, including RSA Security. Riccardo’s...