Reddit Breach Highlights Limits of SMS-Based Authentication

Reddit.com today disclosed that a data breach exposed some internal data, as well as email addresses and passwords for some Reddit users. As Web site breaches go, this one doesn't seem too severe. What's interesting about the incident is that it showcases once again why relying on mobile text...

T-Swap-Token Numeric Error Vulnerability

T-Swap-Token T-S-T is an Ether-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in T-S-T's smart contract implementation. An attacker could use this vulnerability to set the balance of any user to an arbitrary value...

Integer overflow

The mintToken function of a smart contract implementation for T-Swap-Token T-S-T, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13463

The CVE-2018-13463 entry concerns T-Swap-Token (T-S-T). The mintToken function in the token’s smart contract has an integer overflow that enables the contract owner to set any user’s balance to an arbitrary value. Reported across NVD/CNVD entries; no public details on exploit status or remediatio...

CVE-2018-13196

The sell function of a smart contract implementation for T-Swap-Token T-S-T, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

Integer overflow

The sell function of a smart contract implementation for T-Swap-Token T-S-T, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

CVE-2018-13196

CVE-2018-13196 affects the T-Swap-Token (T-S-T) smart contract on Ethereum. The sell function contains an integer overflow where amount * sellPrice can evaluate to zero, leading to a reduction of a seller’s assets. The connected sources (NVD entry and related records) describe the vulnerability c...

CVE-2018-13196

The sell function of a smart contract implementation for T-Swap-Token T-S-T, an Ethereum token, has an integer overflow in which "amount sellPrice" can be zero, consequently reducing a seller's assets...

SUSE-SU-2018:1832-1 Security update for unixODBC

This update for unixODBC to version 2.3.6 fixes the following issues: - CVE-2018-7409: Buffer overflow in unicodetoansicopy was fixed in 2.3.5 bsc1082290 - CVE-2018-7485: Swapped arguments in SQLWriteFileDSN in odbcinst/SQLWriteFileDSN.c bsc1082484 Other fixes: - Enabled --enable-fastvalidate...

Man-in-the-Middle (MitM)

grunt-ccompiler is vulnerable to man-in-the-middle MitM attack. This is possible because it does not prevent downloading of executables via HTTP if the attacker is on the network or positioned in between the user and the remote server. Consequently, it may potentially cause remote code execution...

CVE-2016-10615

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

CVE-2016-10622

nodeschnaps is a NodeJS compatibility layer for Java Rhino. nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker i...

CVE-2016-10596

imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested tarball with an attacker controlled tarball if t...

CVE-2016-10565

operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attack...

The vulnerability of the Qualcomm Secure App Handler component in the Android operating system allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Qualcomm Secure App Handler component in the Android operating system arises from the swapping of the zero pointer. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the information protected by the...

Dnsmorph - Domain Name Permutation Engine Written In Go

DNSMORPH is a domain name permutation engine, inspired by dnstwist. It is written in Go making for a compact and very fast tool. It robustly handles any domain or subdomain supplied and provides a number of configuration options to tune permutation runs. DNSMORPH includes the following domain...

T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account

T-Mobile is investigating a retail store employee who allegedly made unauthorized changes to a subscriber's account in an elaborate scheme to steal the customer's three-letter Instagram username. The modifications, which could have let the rogue employee empty bank accounts associated with the...

UBUNTU-CVE-2018-10112

An issue was discovered in GEGL through 0.3.32. The gegltilebackendswapconstructed function in buffer/gegl-tile-backend-swap.c allows remote attackers to cause a denial of service write access violation or possibly have unspecified other impact via a malformed PNG file that is mishandled during a...

GEGL Denial of Service Vulnerability (CNVD-2018-08258)

GEGL is a data stream based image processing framework. The framework provides floating point processing and lossless image processing for projects such as the GNU Image Manipulation Program. A security vulnerability exists in the 'gegltilebackendswapconstructed' function in the...

Denial of service vulnerability in GNU binutils 'swap_std_reloc_in' function

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utilities developed by the GNU Project to work with object files in a variety of formats, with connectors, assemblers, and other tools for object files and archives.The Binary File Descriptor BFD library a.k.a...