122 matches found
EPoD: Ethereum Packet of Death (CVE-2018-12018)
PeckShield has so far discovered quite a few critical smart contract vulnerabilities. Besides smart contracts, the Ethereum ecosystem also includes other various components that are equally exposed to possible exploitation. Obviously, one such component is the core of Ethereum, i.e., the underlyi...
June 21, 2018—KB4284842 ( Preview of Monthly Rollup)
None None...
Design/Logic Flaw
An exploitable overly permissive cross-domain CORS whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability...
CVE-2017-14460
An exploitable overly permissive cross-domain CORS whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability...
CVE-2017-14460
An exploitable overly permissive cross-domain CORS whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability...
CVE-2017-14460
An exploitable overly permissive cross-domain CORS whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability...
CVE-2017-14460
The CVE-2017-14460 issue affects Parity Ethereum client’s JSON-RPC interface, where the default overly permissive cross-domain (CORS) whitelist (often *) can allow a malicious website to fetch or modify data through the JSON-RPC API if certain endpoints are enabled. TALOS details show an example ...
CVE-2017-18016
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine reusing the current website's token, which is not bound to an origin...
CVE-2017-18016
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine reusing the current website's token, which is not bound to an origin...
Design/Logic Flaw
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine reusing the current website's token, which is not bound to an origin...
CVE-2017-18016
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine reusing the current website's token, which is not bound to an origin...
CVE-2017-18016
Parity Browser 1.6.10 and earlier is vulnerable to a Same Origin Policy bypass via its web proxy engine, which reuses the current site’s token not bound to an origin. An attacker could remotely obtain sensitive information by requesting other sites through the proxy. Affected component: Parity Br...
Paritytech Parity Bypass Homology Policy Vulnerability
Parity Browser is a lightweight and fast Ethereum programming language client. A security vulnerability exists in Parity Browser version 1.6.10 and earlier. A remote attacker can exploit this vulnerability to obtain sensitive information by requesting other websites with the help of a parity bit...
Parity Browser < 1.6.10 - Bypass Same Origin Policy Vulnerability
Exploit for multiple platform in category local exploits VuNote ====== Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 Version: 0.3 Date: Jun 16th, 2017 Tag: parity same origin policy bypass webproxy token reuse Overview -------- Name: parity Vendor: paritytech...
Parity Browser 1.6.10 - Bypass Same Origin Policy
Parity Browser 1.6.10 - Bypass Same Origin Policy VuNote ====== Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 Version: 0.3 Date: Jun 16th, 2017 Tag: parity same origin policy bypass webproxy token reuse Overview -------- Name: parity Vendor: paritytech References:...
Parity Browser < 1.6.10 - Bypass Same Origin Policy
VuNote ====== Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 Version: 0.3 Date: Jun 16th, 2017 Tag: parity same origin policy bypass webproxy token reuse Overview -------- Name: parity Vendor: paritytech References: https://parity.io/ 1 Version: 1.6.8 Latest Version...
Parity Ethereum client JSON-RPC misconfiguration vulnerability
Parity Ethereum client is a client for Ethereum the application runtime platform.JSON-RPC is one of the remote invocation services using JSON as the protocol. A misconfiguration vulnerability exists in JSON-RPC in Parity Ethereum client version 1.7.8. An attacker can use this vulnerability to sen...
Vulnerability Spotlight: Multiple Vulnerabilities in the CPP and Parity Ethereum Client
Vulnerabilities discovered by Marcin Noga of Cisco Talos. Overview Talos is disclosing the presence of multiple vulnerabilities in the CPP and the Parity Ethereum clients. TALOS-2017-0503 / CVE-2017-14457 describes a denial of service vulnerability and potential memory leak in libevm. The functio...
Parity Ethereum Client Overly Permissive Cross-domain Whitelist JSON-RPC vulnerability
Summary An exploitable overly permissive cross-domain CORS whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit malicious website to trigger this...
Hundreds of Millions in Digital Currency Remains Frozen
Between $150 million and $300 million in digital currency called ether remains inaccessible today after a user said he “accidentally” triggered a vulnerability that froze the funds in the popular Parity wallet. Parity Technologies issued an advisory warning users about the flaw in the Parity Wall...