CVE-2018-14006

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An integer overflow vulnerability exists in the function multipleTransfer of Neo Genesis Token (NGT), an Ethereum token smart contract. An attacker could use it to set any user's balance.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.mdExploit, Third Party Advisory
https://github.com/VenusADLab/EtherTokens/tree/master/Neo%20Genesis%20Token%28NGT%29
https://github.com/VenusADLab/EtherTokens/blob/master/SHARKTECH/SHARKTECH.mdExploit, Third Party Advisory
https://github.com/VenusADLab/EtherTokens/tree/master/Neo%20Genesis%20Token%28NGT%29

Timeline

Published: Jul 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-140079.8Citrix XenServer 7.1 and newer allows Directory Traversal.CVE-2018-140086.5Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.CVE-2018-140099.8Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.CVE-2018-14016.1IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2018-140109.8OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15 CVE-2018-140129.8WolfSight CMS 3.2 allows SQL injection via the PATH_INFO to the default URI.CVE-2018-140136.1Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.CVE-2018-140148.8In waimai Super Cms 20150505, there is a CSRF vulnerability that can add an admin account via admin.php?m=Member&a=adminadd.CVE-2018-140155.5The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application c CVE-2018-140165.5The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-based buf CVE-2018-140175.5The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial of service (heap-base CVE-2018-140205.3An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-ad