Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
155 results · page 3 of 4
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32647 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32646 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `<address>.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32645 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine.CVE-2024-32481 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range `stmt.parse_For_range()`. The issue arises when `start` is signed, instead of using `sle`, `le` is used and `start` is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to `1` and is hence interpreted as a very large unsigned integer making the assertion always fail. Any contract having a `range(start, start + N)` where `start` is a signed integer with the possibility for `start` to be negative is affected. If a call goes through the loop while supplying a negative `start` the execution will revert. Version 0.4.0b1 fixes the issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024oidcc is the OpenID Connect client library for Erlang.CVE-2024-31209 · Other software · erlef · reported by GitHubMedium 5.3
oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.
- Product
- oidcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) valCVE-2023-50966 · Other software · potatosalad · reported by MITREMedium 5.3
erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
- Product
- erlang-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-26149 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-24564 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2024-24563 · Other software · vyperlang · reported by GitHubCritical 9.8
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an `int` as an index for an array. The typechecker allows the usage of signed integers to be used as indexes to arrays. The vulnerability is present in different forms in all versions, including `0.3.10`. For ints, the 2's complement representation is used. Because the array was declared very large, the bounds checking will pass Negative values will simply be represented as very large numbers. As of time of publication, a fixed version does not exist. There are three potential vulnerability classes: unpredictable behavior, accessing inaccessible elements and denial of service. Class 1: If it is possible to index an array with a negative integer without reverting, this is most likely not anticipated by the developer and such accesses can cause unpredictable behavior for the contract. Class 2: If a contract has an invariant in the form `assert index < x`, the developer will suppose that no elements on indexes `y | y >= x` are accessible. However, by using nega
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Vyper is a Pythonic Smart Contract Language for the EVM.CVE-2024-24559 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper code). `sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found so the issue shouldn't be possible to trigger when compiling the compiler-generated `IR`. This issue isn't triggered during normal compilation of vyper code so the impact is low. At the time of publication there is no patch available.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2024-24560 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 (overlapping with the input buffer). When checking RETURNDATASIZE for dynamic types, the size is compared only to the minimum allowed size for that type, and not to the returned value's length. As a result, malformed return data can cause the contract to mistake data from the input buffer for returndata. When the called contract returns invalid ABIv2 encoded data, the calling contract can read different invalid data (from the dirty buffer) than the called contract returned.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-24561 · Other software · vyperlang · reported by GitHubCritical 9.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2024-24567 · Other software · vyperlang · reported by GitHubMedium 4.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2024-22419 · Other software · vyperlang · reported by GitHubHigh 7.3
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API of copy functions (for `>=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don't occur. This issue has been addressed in 0.4.0.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-46247 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`. The intermediate floating point step can produce a rounding error if there are enough bits set in the IEEE-754 mantissa. Roughly speaking, if `type_.size_in_bytes` is large (> 2**46), and slightly less than a power of 2, the calculation can overestimate how many slots are needed by 1. If `type_.size_in_bytes` is slightly more than a power of 2, the calculation can underestimate how many slots are needed by 1. This issue is patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installatCVE-2023-45312 · Other software · Mtproto · reported by MITREHigh 8.8
In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability.
- Product
- MT Proto Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Vyper is a Pythonic Smart Contract Language for the EVM.CVE-2023-42460 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users are advised to reference pull request #3626.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-42443 · Other software · vyperlang · reported by GitHubHigh 8.1
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode. Each builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. As of time of publication,
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-42441 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2023Vyper is a Pythonic Smart Contract Language.CVE-2023-41052 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2023Vyper is a Pythonic Smart Contract Language.CVE-2023-40015 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (deprecated), raw_call, <, >, <=, >=, ==, !=, in, not in (when lhs and rhs are enums)`. This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect: state modifying external call , state modifying internal call, `raw_call`, `pop()` when used on a Dynamic Array stored in the storage, `create_minimal_proxy_to`, `create_copy_of`, `create_from_blueprint`. This issue has not yet been patched. Users are advised to make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM).CVE-2023-39363 · Other software · vyperlang · reported by GitHubCritical 9.1
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM).CVE-2023-37902 · Other software · vyperlang · reported by GitHubMedium 5.3
Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature. Version 0.3.10 contains a patch for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2023-32675 · Other software · vyperlang · reported by GitHubLow 3.7
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-32059 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-32058 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023Vyper is a Pythonic smart contract language for the Ethereum virtual machine.CVE-2023-31146 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Vyper is a pythonic smart contract language for the EVM.CVE-2023-30837 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.CVE-2023-30629 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.vyperlang.orggithub.com
Sep 28, 2022Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.CVE-2020-15325 · Network & remote access · Zyxel · reported by MITREMedium 5.3
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.
- Product
- Cloudcnm Secumanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iozyxel.com
Sep 21, 2022In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situationsCVE-2022-37026 · Other software · Erlang · reported by MITRECritical 9.8
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
- Product
- Erlang/otp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorderlangforums.comerlangforums.com
Jun 9, 2022Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-29255 · Other software · vyperlang · reported by GitHubHigh 8.2
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24845 · Other software · vyperlang · reported by GitHubHigh 8.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24788 · Other software · vyperlang · reported by GitHubHigh 7.1
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2022-24787 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2021Vyper is a Pythonic Smart Contract Language for the EVM.CVE-2021-41121 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021Vyper is a Pythonic Smart Contract Language for the EVM.CVE-2021-41122 · Other software · vyperlang · reported by GitHubMedium 4.3
Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2021A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3.CVE-2021-29221 · Other software · Erlang Project · reported by security@deepsurface.comHigh 7
A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe filesystem permissions.
- Product
- Erlang/OTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeepsurface.comgithub.com
Jan 15, 2021An issue was discovered in Erlang/OTP before 23.2.2.CVE-2020-35733 · Other software · Erlang · reported by MITREHigh 7.5
An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.
- Product
- Erlang/otp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack.CVE-2020-24719 · Other software · Couchbase · reported by MITRECritical 9.8
Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.
- Product
- Couchbase Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcouchbase.comcouchbase.com
Oct 2, 2020Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal.CVE-2020-25623 · Other software · Erlang · reported by MITREHigh 7.5
Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used.
- Product
- Erlang/otp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.CVE-2020-13802 · Other software · Erlang · reported by MITRECritical 9.8
Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.
- Product
- Rebar3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 15, 2020yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP vCVE-2020-12872 · Other software · Yaws · reported by MITREMedium 5.5
yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.
- Product
- Yaws
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2019inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client dataCVE-2016-1000107 · Other software · Erlang · reported by MITREMedium 6.1
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
- Product
- Erlang/otp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.erlang.org
Aug 19, 2019The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity CVE-2019-15160 · Other software · Kbrw · reported by MITREHigh 7.5
The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
- Product
- Sweet XML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications CVE-2019-1000014 · Other software · Erlang · reported by MITREHigh 8.8
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
- Product
- Rebar3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2017The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding.CVE-2017-1000385 · Other software · Erlang · reported by MITREMedium 5.9
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).
- Product
- Erlang/otp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2017Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submiCVE-2017-12635 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
- Product
- Apache CouchDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlists.apache.org
Mar 18, 2017An issue was discovered in Erlang/OTP 18.x.CVE-2016-10253 · Other software · Erlang · reported by MITRECritical 9.8
An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.
- Product
- Erlang/otp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comusn.ubuntu.com
Apr 7, 2016Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtaCVE-2015-2774 · Other software · Erlang · reported by MITREMedium 5.9
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
- Product
- Erlang/otp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.