Remote code execution

Obyte formerly Byteball Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution...

CVE-2022-25642

Obyte formerly Byteball Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution...

CVE-2022-25642

Obyte formerly Byteball Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution...

CVE-2022-25642

CVE-2022-25642 affects the Obyte (formerly Byteball) Wallet prior to 3.4.1. The vulnerability arises in the chat/message handling due to insufficient input filtering/escaping of user-submitted data, enabling cross-site scripting that can lead to remote code execution. Affected: Obyte Wallet

WordPress Ethereum Wallet plugin <= 4.0.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ethereum Wallet plugin versions = 4.0.8. Solution Update the WordPress Ethereum Wallet plugin to the latest available version at least 4.0.9...

Obyte Wallet 跨站脚本漏洞

Obyte Wallet is a distributed ledger based on a directed acyclic graph Dag from the Obyte Foundation in the Principality of Liechtenstein. A cross-site scripting vulnerability exists in Obyte Wallet versions prior to 3.4.1, which stems from the software's lack of filtering and escaping of...

WordPress Ethereum Wallet plugin <= 4.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ethereum Wallet plugin versions = 4.0.8. Solution Update the WordPress Ethereum Wallet plugin to the latest available version at least 4.0.9...

CVE-2021-37103

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2021-37103

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality...

Design/Logic Flaw

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2021-37103

CVE-2021-37103 involves an improper permission management vulnerability in Huawei HUAWEI EMUI/Magic UI Wallet apps (UIWallet). The root cause described across connected records is incorrect handling of privileges by the Wallet UI components, potentially enabling confidentiality impacts on service...

CVE-2021-37103

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality...

Kraken botnet bypass Windows Defender to steal crypto wallet data

By Deeba Ahmed Kraken botnet utilizes SmokeLoader malware, and its operators have already been raking in around $3,000 per month. ZeroFox… This is a post from HackRead.com Read the original post: Kraken botnet bypass Windows Defender to steal crypto wallet data...

[WP-H0] DEFAULT_ADMIN_ROLE of BribeVault can steal tokens from users' wallets

Lines of code Vulnerability details The current design/implementation allows the DEFAULTADMINROLE of BribeVault to steal funds from any address that approved this contract up to allowance: As a DEFAULTADMINROLE, the attack is simply do the following steps: 1. grantDepositorRole to self; 2...

Playing With Crypto? You’ll Need a Wallet (or Several)

Buying and selling NFTs or transferring digital currency is going to require a little leap of faith. Here’s how to get started...

U.S. Arrests Two and Seizes $3.6 Billion Cryptocurrency Stolen in 2016 Bitfinex Hack

The U.S. Justice Department DoJ on Tuesday announced the arrest of a married couple in connection with conspiring to launder cryptocurrency worth $4.5 billion that was siphoned during the hack of the virtual currency exchange Bitfinex in 2016. Ilya Lichtenstein, 34, and his wife, Heather Morgan,...

GSD-2022-1000069 Hardware glitching attack in Trezor One Hardware Wallet version Unknown

The Trezor Hardware Wallet One based on the ARM Cortex-M3-based STM32 F2 uses the RDP2 security level by default in SDP2 RAM cannot be copied, but the security can be downgraded to RDP1 where the contents of memory can be copied via glitch injection during device power on. Please note although th...

A New Destructive Malware Targeting Ukrainian Government and Business Entities

Cybersecurity teams from Microsoft on Saturday disclosed they identified evidence of a new destructive malware operation dubbed "WhisperGate" targeting government, non-profit, and information technology entities in Ukraine amid brewing geopolitical tensions between the country and Russia. "The...

Telegram Abused to Steal Crypto-Wallet Credentials

Attackers are targeting crypto-wallets of Telegram users with the Echelon infostealer, in an effort aimed at defrauding new or unsuspecting users of a cryptocurrency discussion channel on the messaging platform, researchers have found. Researchers at the SafeGuard Cyber’s Division Seven threat...

Attacker can empty all the funds by creating fake promotions

Handle WatchPug Vulnerability details The current implementation of calculateRewardAmount allows a arbitrary epochId, which can even be a epochId numberOfEpochs. A malicious user can call claimRewards with epochIds larger than numberOfEpochs and claim other users' rewards. Furthermore, since...