Oracle Financial Services Applications 输入验证错误漏洞

Oracle Financial Services Applications is a suite of financial services software from Oracle USA. The products include core banking, online banking, and estate management.FLEXCUBE Universal Banking is one of the Internet and mobile banking solution components. A security vulnerability exists in...

Deep Panda deploys new rootkit “Fire Chili” by exploiting Log4shell in VMware horizon

THREAT LEVEL: Red For a detailed advisory, download the pdf file here Deep Panda, a Chinese APT group, took advantage of the well-known Log4Shell vulnerability in VMware Horizon servers to deploy a backdoor, rootkit, and steal sensitive data. This threat actor is primarily targeting firms in the...

North Korean Hackers Distributing Trojanized DeFi Wallet Apps to Steal Victims' Crypto

The North Korean state-backed hacking crew, otherwise known as the Lazarus Group, has been attributed to yet another financially motivated campaign that leverages a trojanized decentralized finance DeFi wallet app to distribute a fully-featured backdoor onto compromised Windows systems. The app,...

Borrower can stop lenders from withdrawing interest payments

Lines of code line Vulnerability details Impact A borrower can prevent lenders from being able to withdraw any interest payments. For example, a malicious borrower could create a credit line proposal with a long duration and a promise of regular interest payments to entice lenders to deposit into...

North Korean state-sponsored threat actor Lazarus Group exploiting Chrome Zero-day vulnerability

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here For more than a month before a fix was available, North Korean state hackers known as Lazarus group exploited a zero-day, remote code execution vulnerability CVE-2022-0609 in Google Chromes web browser. The attack mainly targe...

Himalaya Exchange Creates a New Digital Financial System

The Himalaya Exchange offers a new cryptocurrency that is designed to be resistant to extreme price volatility. A key aim for the company is to provide a revolutionary financial solution for the new digital age. Akamai is delighted that this hugely innovative company has chosen us to deliver a...

money-market-contracts::overseer: Market ltv is not capped

Lines of code Vulnerability details Impact There is no check to ensure that maxltv is less than 100% Decimal::One. It is therefore possible to set a collateral factor of 1, allowing anyone to borrow more than the collateral value ie. enabling under-collateralized loans. While the likelihood of...

IRS: Selfies Now Optional, Biometric Data to Be Deleted

The U.S. Internal Revenue Service IRS said Monday that taxpayers are no longer required to provide facial scans to create an account online at irs.gov. In lieu of providing biometric data, taxpayers can now opt for a live video interview with ID.me, the privately-held Virginia company that runs t...

test.formation.finances.gouv.sn Cross Site Scripting vulnerability OBB-2356779

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

They Were ‘Calling to Help.’ Then They Stole Thousands

When my mom fell victim to a phone scam, we learned a painful truth: The explosion of personal finance apps makes it all too easy to target vulnerable people...

LP pricing formula is vulnerable to flashloan manipulation

Handle shw Vulnerability details Impact The LP pricing formula used in the burnAsset function of LimboDAO is vulnerable to flashloan manipulation. By swapping a large number of EYE into the underlying pool, an attacker can intentionally inflate the value of the LP tokens to get more fate than he ...

Duo of Android dropper and payload target certain countries and app users

After making its first in-the-wild appearance in March 2021, Vultur—an information-stealing RAT that runs on Android—is back. And its dropper is equally nasty. Vultur Romanian for "vulture" is known to target banks, cryptocurrency wallets, social media Facebook, TikTok, and messaging services...

Scary Fraud Ensues When ID Theft & Usury Collide

Whats worse than finding out that identity thieves took out a 546 percent interest payday loan in your name? How about a 900 percent interest loan? Or how about not learning of the fraudulent loan until it gets handed off to collection agents? One readers nightmare experience spotlights what can...

Unauthorized Access Vulnerability in CloudVision Management Platform

Ltd. focuses on serving users in the government, public prosecutors and law enforcement, education, finance, medical care, enterprise and other industries, "cloud, end, AI, development platform," a four-in-one cloud video solution. There is an unauthorized access vulnerability in the cloud video...

$10m of funds goes missing in what appears to be a cryptocurrency rug-pull

There’s a lot of concern in the cryptocurrency realm at the moment. A yield farming platform "utilizing arbitrage to gain optimal yield with low risk" has gone AWOL. Site down, Twitter account deleted, no word from the team behind it explaining what happened. Worst of all, some $10 million worth ...

Grim Finance hacked – $30 million worth of tokens stolen

By Waqas According to Grim Finance, it was an "advanced attack" in which hackers exploited a flaw in the vault contract. This is a post from HackRead.com Read the original post: Grim Finance hacked - $30 million worth of tokens stolen...

All Vulnerabilities for propertytax.chattanooga.gov Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| propertytax.chattanooga.gov ---|--- Ope...

Possible price manipulation while adding liquidity to uniV3

Handle 0x421f Vulnerability details Right now if we see the code there are no checks before liq being added to check if pool is manipulated. Hence there rises possibility of sandwich attack vector here, more so with concentrated liq imo Could be done with flash loan or with own tokens Attack woul...

firefly-iii Cross-Site Request Forgery Vulnerability

firefly-iii is a free open source personal finance manager. A cross-site request forgery vulnerability exists in firefly-ii, which can be exploited by attackers to launch cross-site request forgery CSRF attacks...

Hackers Steal $200 Million Worth of Cryptocurrency Tokens from BitMart Exchange

Cryptocurrency trading platform BitMart has disclosed a "large-scale security breach" that it blamed on a stolen private key, resulting in the theft of more than $150 million in various cryptocurrencies. The breach is said to have impacted two of its hot wallets on the Ethereum ETH blockchain and...