1534 matches found
Redpanda Security Vulnerabilities
Redpanda is a streaming data platform for developers. It is compatible with the Kafka API. Redpanda has a security vulnerability that stems from a lack of authorization checks in the Transactions API. Affected products and versions: Redpanda versions before 23.1.21, 23.2.x versions before 23.2.18...
PT-2023-31716 · Redpanda · Redpanda
Name of the Vulnerable Software and Affected Versions: Redpanda versions prior to 23.1.21 Redpanda versions 23.2.x prior to 23.2.18 Description: The issue is related to missing authorization checks in the "Transactions API". This could potentially allow unauthorized access or actions...
CVE-2023-50976
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...
CVE-2023-50976
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...
CVE-2023-50976
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...
Crypto Hardware Wallet Ledger's Supply Chain Breach Results in $600,000 Theft
Crypto hardware wallet maker Ledger published a new version of its "@ledgerhq/connect-kit" npm module after unidentified threat actors pushed malicious code that led to the theft of more than $600,000 in virtual assets. The compromise was the result of a former employee falling victim to a phishi...
Malicious code in blockchain-transactions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 215468622a0157c93342bc12a15ffe8a82bdd165842794e07f19436ebbdc41f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8690 Malicious code in blockchain-transactions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 215468622a0157c93342bc12a15ffe8a82bdd165842794e07f19436ebbdc41f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Using block.timestamp as the deadline/expiry invites MEV
Lines of code 307 Vulnerability details Passing block.timestamp as the expiry/deadline of an operation does not mean "require immediate execution" - it means "whatever block this transaction appears in, I'm comfortable with that block's timestamp". Providing this value means that a malicious mine...
Slippage Handling
Lines of code Vulnerability details Impact The primitiveOutputAmount function reverts the transaction if the output amount is less than the minimumOutputAmount, which is a strict slippage protection. This could lead to failed transactions due to normal price fluctuations in the Curve pool. Proof ...
PayHere Payment Gateway < 2.2.12 - Unauthenticated Log Data Disclosure
Description The plugin automatically creates publicly-accessible log files containing sensitive information when transactions occur. PoC https://www.suppliment.lk/wp-content/uploads/payhere-logs/?SD https://www.medic.lk/wp-content/uploads/payhere-logs/?SD...
CVE-2023-49957
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to the expected ConcurrentTx status. This could result in critical transaction management and billing...
CVE-2023-49956
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions...
PT-2023-31423 · Dalmann · Ocpp.Core
Name of the Vulnerable Software and Affected Versions: Dalmann OCPP.Core versions prior to 1.3.0 Description: An issue was discovered in Dalmann OCPP.Core for OCPP Open Charge Point Protocol for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to t...
CVE-2023-49956
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP Open Charge Point Protocol for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions...
U.S. Treasury Sanctions Sinbad Cryptocurrency Mixer Used by North Korean Hackers
The U.S. Treasury Department on Wednesday imposed sanctions against Sinbad, a virtual currency mixer that has been put to use by the North Korea-linked Lazarus Group to launder ill-gotten proceeds. "Sinbad has processed millions of dollars' worth of virtual currency from Lazarus Group heists,...
BigProf Online Invoicing System Cross-Site Scripting Vulnerability
BigProf Online Invoicing System OIS is an online invoicing system. A cross-site scripting vulnerability exists in BigProf Online Inventory Manager version 3.2, which stems from a cross-site scripting vulnerability in the FirstRecord parameter of /inventory/transactionsview.php...
DOJ Charges Binance With Vast Money-Laundering Scheme and Sanctions Violations
From Russia to Iran, the feds have charged Binance with conducting well over $1 billion in transactions with sanctioned countries and criminal actors...
The dark side of Black Friday: decoding cyberthreats around the year’s biggest shopping season
As the annual Black Friday approaches, the digital landscape experiences an unprecedented surge in e-commerce and online shopping activity. Major sales aside, e-commerce is still a huge market. In 2022, global e-commerce retail revenue was estimated to reach $5.7 trillion worldwide, marking nearl...
The vulnerability of the software tool for processing and managing financial transactions conducted through the SWIFT international messaging system allows a perpetrator to disclose protected information or compromise the accessibility of that information, due to incorrect restrictions on XML links to external objects in the IBM Financial Transaction Manager for SWIFT Services.
The vulnerability of the software tool for processing and managing financial transactions conducted through the SWIFT messaging system is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose protected...