CVE-2018-13113

The CVE-2018-13113 entry concerns Easy Trading Token (ETT), an Ethereum token. The connected sources describe an integer overflow in the token’s smart contract, specifically in the transfer and transferFrom functions, attributed to the contract’s arithmetic operations. No explicit risk assessment...

Design/Logic Flaw

Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for the /dashboard/deposit URI, as demonstrated by discovering database credentials...

CVE-2018-12908

CVE-2018-12908 affects Brynamics “Online Trade” system. Connected documents describe an information-disclosure vulnerability where remote attackers can obtain sensitive data by directly requesting several dashboard endpoints, notably /dashboard/deposit (and related paths such as /dashboard/addpla...

New burnOverflow Bug Identified in Multiple ERC20 Smart Contracts (CVE-2018-11239)

Our vulnerability-scanning system at PeckShield has so far discovered several dangerous smart contract vulnerabilities batchOverflow1, proxyOverflow2, transferFlaw3, ownerAnyone4, multiOverflow5. Some of them could be used by attackers to generate tokens out of nowhere while others can be used to...

Aurora IIDXM Design Vulnerability

Aurora IDEX Membership IDXM is a decentralized trading system for Ether ECR-20 tokens. A security vulnerability exists in the implementation of Owned smart contracts in Aurora IIDXM. An attacker could exploit the vulnerability to gain ownership of the contract and change the variables...

New batchOverflow Bug in Multiple ERC20 Smart Contracts (CVE-2018–10299)

Built on our earlier efforts in analyzing EOS tokens, we have developed an automated system to scan and analyze Ethereum-based ERC-20 token transfers. Specifically, our system will automatically send out alerts if any suspicious transactions e.g., involving unreasonably large tokens occur. In...

School Principal Gets 9 Years in Prison for Trading Nude Pictures of Students

By Carolina An ex-Kentucky high school principal Stephen Kyle Goodlett has been This is a post from HackRead.com Read the original post: School Principal Gets 9 Years in Prison for Trading Nude Pictures of Students...

CVE-2018-2393

Under certain conditions SAP Internet Graphics Server IGS 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server IGS to become unavailable. Recent assessments: gwillcox-r7 at October 06, 2020 4:05pm UTC reported: This...

hakusui-trading.co.jp XSS vulnerability

Open Bug Bounty ID: OBB-539644 Description| Value ---|--- Affected Website:| hakusui-trading.co.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Fraud Detection in Pokémon Go

I play Pokémon Go. There, I've admitted it. One of the interesting aspects of the game I've been watching is how the game's publisher, Niantic, deals with cheaters. There are three basic types of cheating in Pokémon Go. The first is botting, where a computer plays the game instead of a person. Th...

A week in security (September 25 – October 01)

Recently, we talked about the hacking incident at Deloitte, one of the 'big four' global accounting firms. It was reported that client email addresses, usernames, and passwords were exposed. This also brought to light weaknesses in their policies and lack of threat intelligence to recover leaked...

waitaki.govt.nz XSS vulnerability

Vulnerable URL: http://www.waitaki.govt.nz/our-council/consultation/easter-sunday-shop-trading/Pages/default.aspx?FollowSite=0=%27-confirm%27OPENBUGBOUNTY%27-%27 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

On the macOS Keychain Attack, Signal’s New Contact Service, the Deloitte Hack, and More

Mike Mimoso and Chris Brook recap the news of the week, including the macOS Keychain attack, Signal’s new private contact discovery service, the Deloitte hack, and a handful of mobile stock trading app vulnerabilities. Download: ThreatpostNewsWrapSeptember292017.mp3 Music by Chris Gonsalves Show...

September 27, 2017 – Morning Cyber Coffee Headlines – “Google” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 27, 2017 - Headlines S.E.C. Hacking Response Provides Road Map for...

Mobile Stock Trading App Providers Unresponsive to Glaring Vulnerabilities

More than 20 of the most popular mobile trading applications used by consumers and day-traders for securities transactions contain glaring vulnerabilities that could allow attackers to sniff personal data or steal money from accounts. Researchers from IOActive today published a report describing...

2016 SEC Hack May Have Benefited Insider Trading

The U.S. Securities and Exchange Commission, the watchdog of Wall Street, said this week that hackers infiltrated one of its systems last year, something that likely facilitated insider trading. The SEC waited nearly nine months to disclose the hack. SEC Chairman Jay Clayton devoted four sentence...

SEC Discloses Hackers Broke Into Edgar Corporate Filing System Last Year

This month has been full of breaches. Now, the Securities and Exchange Commission SEC, the top U.S. markets regulator, has disclosed that hackers managed to hack into its financial document filing system and may have illegally profited from the stolen information. On Wednesday, the SEC announced...

ergotrading.eu XSS vulnerability

Vulnerable URL: https://www.ergotrading.eu/catalogsearch/result/?q=%3E%27%3E%22%3Et%3Ci%3Ep%3Cimg+src%3Dx+onerror%3Dprompt%28%2Fopenbugbounty%2F%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

Threat Outbreak Alert RuleID29289: Email Messages Distributing Malicious Software on May 26, 2017

Medium Alert ID: 53978 First Published: 2017 May 26 13:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29289 may contain the following files: Name | Size...

Modified Zyklon and plugins from India

IntroductionStreams of malicious emails Talos inspects every day usually consist of active spamming campaigns for various ransomware families, phishing campaigns and the common malware family suspects such as banking Trojans and bots.. It is however often more interesting to analyze campaigns...