839 matches found
MAL-2025-32033 Malicious code in rehype-ora-norma-cosmos (npm)
The package rehype-ora-norma-cosmos was found to contain malicious code...
MAL-2025-18657 Malicious code in dotenv-cosmos-taurus-kinetic (npm)
The package dotenv-cosmos-taurus-kinetic was found to contain malicious code...
MAL-2025-27401 Malicious code in nextjs-cosmos-spinner-auth0 (npm)
The package nextjs-cosmos-spinner-auth0 was found to contain malicious code...
MAL-2025-27142 Malicious code in nconf-galaxy-repository-cosmos (npm)
The package nconf-galaxy-repository-cosmos was found to contain malicious code...
GO-2025-3803 Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk
Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt in github.com/cosmos/cosmos-sdk...
cosmwasm-std crate 输入验证错误漏洞
cosmwasm-std crate is a CosmWasm open source framework for building smart contracts in Wasm for the Cosmos SDK. An input validation error vulnerability exists in cosmwasm-std crate versions prior to 2.0.2, which stems from an integer overflow that could lead to a computation error...
Integer Overflow
github.com/cosmos/cosmos-sdk is vulnerable to Integer Overflow. The vulnerability is due to a malicious validator being able to deposit values that trigger an overflow in the Validator Rewards pool, potentially halting the blockchain...
Integer Overflow or Wraparound
Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via DepositValidatorRewardsPool. An attacker can cause a chain halt by introducing an overflow condition through a crafted malicious deposit into the Validator Rewards pool when full. Details Denial of...
GHSA-P22H-3M2V-CMGH Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt
Description Name: ISA-2025-005: Integer Overflow in Cosmos SDK Component: CosmosSDK Criticality: High Considerable Impact; Likely Likelihood per ACMv1.2 Affected versions: = v0.50.13, = 0.53.2 Affected users: Validators, Full nodes, Users on chains that utilize the distribution module Cosmos SDK...
Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt
Description Name: ISA-2025-005: Integer Overflow in Cosmos SDK Component: CosmosSDK Criticality: High Considerable Impact; Likely Likelihood per ACMv1.2 Affected versions: = v0.50.13, = 0.53.2 Affected users: Validators, Full nodes, Users on chains that utilize the distribution module Cosmos SDK...
Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary
Summary Sending a message that modifies the validator set at the epoch boundary halts the chain. Impact Denial of Service - Comos-sdk prevents modifying the validator set from two different modules - https://github.com/cosmos/cosmos-sdk/blob/release/v0.50.x/types/module/module.goL811. Such an...
GHSA-RJ53-J6JW-7F7G Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary
Summary Sending a message that modifies the validator set at the epoch boundary halts the chain. Impact Denial of Service - Comos-sdk prevents modifying the validator set from two different modules - https://github.com/cosmos/cosmos-sdk/blob/release/v0.50.x/types/module/module.goL811. Such an...
PT-2025-30106 · Go · Github.Com/Cosmos/Cosmos-Sdk
Description Name: ISA-2025-005: Integer Overflow in Cosmos SDK Component: CosmosSDK Criticality: High Considerable Impact; Likely Likelihood per ACMv1.2 Affected versions: = v0.50.13, = 0.53.2 Affected users: Validators, Full nodes, Users on chains that utilize the distribution module Cosmos SDK...
PT-2025-30107 · Go · Github.Com/Babylonlabs-Io/Babylon/V2
Summary Sending a message that modifies the validator set at the epoch boundary halts the chain. Impact Denial of Service - Comos-sdk prevents modifying the validator set from two different modules - https://github.com/cosmos/cosmos-sdk/blob/release/v0.50.x/types/module/module.goL811. Such an...
Directory Traversal
openc3-cosmos-tool-iframe is vulnerable to Directory Traversal. The vulnerability is due to improper input validation and insufficient sanitization of path parameters in the /script-api/scripts/ endpoint, allowing attackers to access unauthorized directories...
CVE-2025-28382
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...
CVE-2025-28386
A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file...
CVE-2025-28381
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...
CVE-2025-28380
A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...