Microsoft to Pay $20 Million Penalty for Illegally Collecting Kids' Data on Xbox

Microsoft has agreed to pay a penalty of $20 million to settle U.S. Federal Trade Commission FTC charges that the company illegally collected and retained the data of children who signed up to use its Xbox video game console without their parents' knowledge or consent. "Our proposed order makes i...

Function _execBuyNftFromMarket() Fails to Check the Actual ETH Balance in the Contract After Executing the Trade

Lines of code Vulnerability details Impact In the function execBuyNftFromMarket, if the user chooses to use WETH, the function deposits ETH and approves the amount of WETH to the marketplace. After executing the trade at the marketplace, the function checks that the balance decrease is correct in...

CISA Warns of Hurricane/Typhoon-Related Scams

CISA urges users to remain on alert for malicious cyber activity following a natural disaster such as a hurricane or typhoon, as attackers target potential disaster victims by leveraging social engineering tactics, techniques, and procedures TTPs. Social engineering TTPs include phishing attacks...

Incorrect setting of sqrtPriceLimitX96 in protocol

Lines of code Vulnerability details Impact The pool.swap function in the swap attempts to execute a swap. As the code below ,The sqrtPriceLimitX96 is set based on the value of projectTokenIsZero. If projectTokenIsZero is true, sqrtPriceLimitX96 is set to TickMath.MAXSQRTRATIO - 1; otherwise, it i...

U.S. Authorities Seize 13 Domains Offering Criminal DDoS-for-Hire Services

U.S. authorities have announced the seizure of 13 internet domains that offered DDoS-for-hire services to other criminal actors. The takedown is part of an ongoing international initiative dubbed Operation PowerOFF that's aimed at dismantling criminal DDoS-for-hire infrastructures worldwide. The...

FBI (and Others) Shut Down Genesis Market

Genesis Market is shut down: Active since 2018, Genesis Markets slogan was, "Our store sells bots with logs, cookies, and their real fingerprints." Customers could search for infected systems with a variety of options, including by Internet address or by specific domain names associated with stol...

tian-trade.ru Cross Site Scripting vulnerability OBB-3238284

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exchange.sol#L87 : openTrade is returning incorrect totalCost value which has accounting issue when open or closing the trade.

Lines of code Vulnerability details Impact It returns the incorrect value. Any operation done based on this function,either at front end of at contract level , could end with incorrect output. Proof of Concept User can interact with Exchangle.sol to trade. He/she will call the openTrade. openTrad...

Lack of token approval reverts the overall trade

Lines of code Vulnerability details Impact Since the user has not approved the params.collateralAmount, calling the safeTransferFrom function will result in a revert due to the lack of token approval. The Exchange contract not receive any collateralAmount. Proof of Concept...

trade4asia.com Cross Site Scripting vulnerability OBB-3193866

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Incorrect Trade Settlement in settleTrade() function

Lines of code Vulnerability details Impact /// Settle a single trade, expected to be used with multicall for efficient mass settlement /// @custom:refresher function settleTradeIERC20 sell external; This function takes in only a single IERC20 token as a parameter, with no other information about...

How much security is enough?

According to a prominent Soviet science fiction writer, beauty is a fine line, a razors edge between two opposites locked in a never-ending battle. Today, we would put it less poetically as an ideal compromise between contradictions. An elegant, or beautiful, design is one that allows reaching th...

tx-lubbock.countybuyselltrade.com Cross Site Scripting vulnerability OBB-3124096

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Error in trade accumulated interest calculation

Lines of code Vulnerability details Impact The trade's accumulated interest may result smaller than expected when long open interest is zero. Proof of Concept function tradesuint id public view returns Trade memory ... int256 pendingFunding; if trade.direction && longOi...... 0 pendingFunding =...

Any user can collect tokens trapped in the aggregator

Lines of code Vulnerability details Impact Any user can execute a trade on the aggregator to collect trapped tokens. Which should be an action only allowed by the owner. The issue is in how returnERC20TokensIfAny gets the amount to send back by checking the balances of the contract. Proof of...

Having nonzero allowance to the exchange will prevent any future trades

Lines of code Vulnerability details Impact A borrower can prevent other lenders to call claimAndRepay, in other words the lenders can not use the revenue streams in the spigotedLine. Proof of Concept Suppose a borrower has a stream of revenue token, and also borrowed some tokens already. Then the...

SpigotedLineLib::trade won’t work with tokens with approval race protection (USDT)

Lines of code Vulnerability details Proof of Concept Some tokens e.g. USDT, KNC do not allow approving an amount M 0 when an existing amount N 0 is already approved. This is to protect from an ERC20 attack vector described here. The problem is the code in trade is the following...

SEMCMS Ant_Zekou.php SQL Injection Vulnerability

SEMCMS is a multilingual foreign trade web content management system CMS.A SQL injection vulnerability exists in SEMCMS SHOP version 1.1, which originates from the lack of validation of externally entered SQL statements in AntZekou.php. An attacker can use this vulnerability to execute illegal SQ...

SEMCMS Ant_Pro.php SQL Injection Vulnerability

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SQL injection vulnerability exists in SEMCMS SHOP version 1.1, which originates from the lack of validation of externally entered SQL statements in AntPro.php. An attacker can use this vulnerability to...

Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole

As I wrote about last week, Ive been diving a lot into apps privacy policies recently. And I was recently made aware of a new type of app I never knew existed -- family trackers. There are countless mobile apps for parents to track their children or other family members based on their location,...