Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-32609 State: PUBLISHED Published: 2024-05-09T16:29:33.863Z Last Updated: 2025-02-13T15:48:08.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32610 State: PUBLISHED Published: 2024-05-09T16:29:59.182Z Last Updated: 2025-02-13T15:48:09.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 has a SEGV in H5T_close_real in H5T.c, resulting in a corrupted instruction pointer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32611 State: PUBLISHED Published: 2024-05-09T16:37:42.438Z Last Updated: 2025-02-13T15:48:09.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32612 State: PUBLISHED Published: 2024-05-09T16:38:21.884Z Last Updated: 2025-02-13T15:48:10.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5HL__fl_deserialize in H5HLcache.c, resulting in the corruption of the instruction pointer, a different vulnerability than CVE-2024-32613. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32613 State: PUBLISHED Published: 2024-05-09T16:42:24.893Z Last Updated: 2025-02-13T15:48:11.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer over-read in the function H5HL__fl_deserialize in H5HLcache.c, a different vulnerability than CVE-2024-32612. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32614 State: PUBLISHED Published: 2024-05-09T16:42:50.363Z Last Updated: 2025-02-13T15:52:23.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 has a SEGV in H5VM_memcpyvv in H5VM.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32615 State: PUBLISHED Published: 2024-05-09T16:43:08.948Z Last Updated: 2025-02-13T15:52:23.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use of an initialized pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32616 State: PUBLISHED Published: 2024-05-09T16:43:27.959Z Last Updated: 2025-02-13T15:52:24.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5O__dtype_encode_helper in H5Odtype.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32617 State: PUBLISHED Published: 2024-05-09T16:43:49.875Z Last Updated: 2025-02-13T15:52:25.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer over-read caused by the unsafe use of strdup in H5MM_xstrdup in H5MM.c (called from H5G__ent_to_link in H5Glink.c). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32618 State: PUBLISHED Published: 2024-05-09T16:44:11.593Z Last Updated: 2025-02-13T15:52:25.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T__get_native_type in H5Tnative.c, resulting in the corruption of the instruction pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32619 State: PUBLISHED Published: 2024-05-09T16:44:27.927Z Last Updated: 2025-02-13T15:52:26.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T_copy_reopen in H5T.c, resulting in the corruption of the instruction pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32620 State: PUBLISHED Published: 2024-05-09T16:44:48.042Z Last Updated: 2025-02-13T15:52:26.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5F_addr_decode_len in H5Fint.c, resulting in the corruption of the instruction pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32621 State: PUBLISHED Published: 2024-05-09T16:45:13.181Z Last Updated: 2025-02-13T15:52:27.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob_get in H5VLnative_blob.c), resulting in the corruption of the instruction pointer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32622 State: PUBLISHED Published: 2024-05-09T16:45:31.936Z Last Updated: 2025-02-13T15:52:27.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a out-of-bounds read operation in H5FL_arr_malloc in H5FL.c (called from H5S_set_extent_simple in H5S.c). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32623 State: PUBLISHED Published: 2024-05-09T16:45:50.084Z Last Updated: 2025-02-13T15:52:28.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5VM_array_fill in H5VM.c (called from H5S_select_elements in H5Spoint.c). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32624 State: PUBLISHED Published: 2024-05-09T16:46:09.653Z Last Updated: 2025-02-13T15:52:28.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T__ref_mem_setnull in H5Tref.c (called from H5T__conv_ref in H5Tconv.c), resulting in the corruption of the instruction pointer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-32625 State: PUBLISHED Published: 2024-04-16T09:00:52.486Z Last Updated: 2024-08-02T02:13:40.281Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: ASR Products: Falcon/Crane Problem Types: CWE-457 Description: In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computations Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.asrmicro.com/en/goods/psirt?cid=38
CVE ID: CVE-2024-32631 State: PUBLISHED Published: 2024-04-16T08:44:04.334Z Last Updated: 2024-08-02T02:13:40.138Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H) Vendors: ASR Products: Falcon/Crane Problem Types: CWE-125 Description: Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.asrmicro.com/en/goods/psirt?cid=38
CVE ID: CVE-2024-32632 State: PUBLISHED Published: 2024-04-16T08:51:39.886Z Last Updated: 2024-08-02T02:13:40.096Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: ASR Products: Falcon/Crane Problem Types: CWE-686 Description: A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.asrmicro.com/en/goods/psirt?cid=38
CVE ID: CVE-2024-32633 State: PUBLISHED Published: 2024-04-16T08:54:53.330Z Last Updated: 2024-08-20T18:09:22.892Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: ASR Products: Falcon/Crane Problem Types: CWE-570 Description: An unsigned value can never be negative, so eMMC full disk test will always evaluate the same way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=38
CVE ID: CVE-2024-32634 State: PUBLISHED Published: 2024-04-16T08:57:29.713Z Last Updated: 2024-08-02T02:13:40.135Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H) Vendors: ASR Products: Falcon Problem Types: CWE-561 Description: In huge memory get unmapped area check, code can never be reached because of a logical contradiction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.asrmicro.com/en/goods/psirt?cid=38
CVE ID: CVE-2024-32635 State: PUBLISHED Published: 2024-05-14T10:02:42.291Z Last Updated: 2024-08-13T07:54:05.071Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V14.2, Teamcenter Visualization V14.3, Teamcenter Visualization V2312 Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.10), Teamcenter Visualization V2312 (All versions < V2312.0005). The affected applications contain an out of bounds read past the unmapped memory region while p
versions < V2312.0005). The affected applications contain an out of bounds read past the unmapped memory region while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-046364.html - https://cert-portal.siemens.com/productcert/html/ssa-856475.html
CVE ID: CVE-2024-32636 State: PUBLISHED Published: 2024-05-14T10:02:43.480Z Last Updated: 2024-08-13T07:54:06.352Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V14.2, Teamcenter Visualization V14.3, Teamcenter Visualization V2312 Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.10), Teamcenter Visualization V2312 (All versions < V2312.0005). The affected applications contain an out of bounds read past the end of an allocated structure
versions < V2312.0005). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-046364.html - https://cert-portal.siemens.com/productcert/html/ssa-856475.html
CVE ID: CVE-2024-32637 State: PUBLISHED Published: 2024-05-14T10:02:44.682Z Last Updated: 2024-08-13T07:54:07.678Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V14.2, Teamcenter Visualization V14.3, Teamcenter Visualization V2312 Problem Types: CWE-476 Description: A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.10), Teamcenter Visualization V2312 (All versions < V2312.0005). The affected applications contain a null pointer dereference vulnerability while parsing special
versions < V2312.0005). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-046364.html - https://cert-portal.siemens.com/productcert/html/ssa-856475.html
CVE ID: CVE-2024-32638 State: PUBLISHED Published: 2024-05-02T09:20:29.127Z Last Updated: 2025-02-13T17:52:13.382Z Vendors: Apache Software Foundation Products: Apache APISIX Problem Types: CWE-444 Description: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov - http://www.openwall.com/lists/oss-security/2024/05/0
https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov - http://www.openwall.com/lists/oss-security/2024/05/02/2
CVE ID: CVE-2024-32639 State: PUBLISHED Published: 2024-05-14T10:02:45.885Z Last Updated: 2024-08-02T02:13:40.378Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Tecnomatix Plant Simulation V2302 Problem Types: CWE-787 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0011). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22974) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
ext of the current process. (ZDI-CAN-22974) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-923361.html
CVE ID: CVE-2024-32640 State: PUBLISHED Published: 2025-08-11T20:38:56.268Z Last Updated: 2025-08-11T20:59:20.872Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MasaCMS Products: MasaCMS Problem Types: CWE-89 Description: MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.6, 7.3.13, and 7.2.8 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.6, 7.3.13, and 7.2.8 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gw
nalyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-24rr-gwx3-jhqc - https://github.com/MasaCMS/MasaCMS/releases/tag/7.2.8 - https://github.com/MasaCMS/MasaCMS/releases/tag/7.3.13 - https://github.com/MasaCMS/MasaCMS/releases/tag/7.4.6 - https://github.com/Stuub/CVE-2024-32640-SQLI-MuraCMS - https://projectdiscovery.io/blog/hacking-apple-with-sql-injection?ref=projectdiscovery-io-blog-newsletter - https://www.seebug.org/vuldb/ssvid-99835
CVE ID: CVE-2024-32644 State: PUBLISHED Published: 2024-04-19T14:53:44.423Z Last Updated: 2024-08-02T02:13:40.251Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: evmos Products: evmos Problem Types: CWE-662 Description: Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the execution of a transaction. The exploit is based on the fact that to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we ite
to sync the Cosmos SDK state and the EVM one, we rely on the `stateDB.Commit()` method. When we call this method, we iterate though all the `dirtyStorage` and, **if and only if** it is different than the `originStorage`, we set the new state. Setting the new state means we update the Cosmos SDK KVStore. If a contract storage state that is the same before and after a transaction, but is changed during the transaction and can call an external contract after the change, it can be exploited to make the transaction similar to non-atomic. The vulnerability is **critical** since this could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0. Add
his could lead to drain of funds through creative SC interactions. The issue has been patched in versions >=V17.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/evmos/evmos/security/advisories/GHSA-3fp5-2xwh-fxm6 - https://github.com/evmos/evmos/commit/08982b5ee726b97bc50eaf58d1914829648b6a5f - https://github.com/evmos/evmos/blob/b196a522ba4951890b40992e9f97aa610f8b5f9c/x/evm/statedb/statedb.go#L460-L465
CVE ID: CVE-2024-32645 State: PUBLISHED Published: 2024-04-25T17:18:27.026Z Last Updated: 2024-08-02T02:13:40.291Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-20 Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect
d_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-xchq-w5r3-4wg3
CVE ID: CVE-2024-32646 State: PUBLISHED Published: 2024-04-25T17:21:59.687Z Last Updated: 2024-08-02T02:13:40.232Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-20 Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `<address>.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable pro
can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-r56x-j438-vw5m
CVE ID: CVE-2024-32647 State: PUBLISHED Published: 2024-04-25T17:41:44.052Z Last Updated: 2024-08-02T02:13:40.122Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-95 Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple
from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6 - https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847
CVE ID: CVE-2024-32648 State: PUBLISHED Published: 2024-04-25T17:48:32.135Z Last Updated: 2024-08-02T02:13:40.467Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-667 Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
the impact is low. Version 0.3.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-m2v9-w374-5hj9 - https://github.com/vyperlang/vyper/issues/2455 - https://github.com/vyperlang/vyper/commit/93287e5ac184b53b395c907d40701f721daf8177
CVE ID: CVE-2024-32649 State: PUBLISHED Published: 2024-04-25T17:53:01.072Z Last Updated: 2024-08-02T02:13:40.270Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-95 Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contrac
h, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h