CVE-2021-47631

CVE-2021-47631 affects the Linux kernel (ARM: da850-evm path) where a NULL pointer dereference could occur in da850_evm_config_emac() during boot on palmetto-bmc/QEMU setups. The root cause is emac_pdata being NULL because davinci_soc_info is populated only on Davinci machines, while the function...

CVE-2021-47631

In the Linux kernel, the following vulnerability has been resolved: ARM: davinci: da850-evm: Avoid NULL pointer dereference With newer versions of GCC, there is a panic in da850evmconfigemac when booting multiv5defconfig in QEMU under the palmetto-bmc machine: Unable to handle kernel NULL pointer...

CVE-2025-27105 AugAssign evaluation order causing OOB write within the object in Vyper

vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the...

CVE-2022-36008

Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause ...

CVE-2025-21607

The CVE-2025-21607 issue affects the Vyper Pythonic smart contract language compiler when using precompiles EcRecover (0x1) and Identity (0x4); the success flag of those calls isn’t checked, allowing an attacker to allocate gas to cause a precompile to fail while the rest of execution continues, ...

CVE-2025-21607 Success of Certain Precompile Calls not Checked in Vyper

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall executi...

Vyper Does Not Check the Success of Certain Precompile Calls

Summary When the Vyper Compiler uses the precompiles EcRecover 0x1 and Identity 0x4, the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be...

MAL-2024-11413 Malicious code in orderly-evm-crosschain (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in orderly-evm-crosschain (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-10604 Malicious code in @david-lab/evm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da15cab58cbaaf01db60d8e67007017a770017bc33db5b17508dcd03db50b1a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @david-lab/evm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da15cab58cbaaf01db60d8e67007017a770017bc33db5b17508dcd03db50b1a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Transaction Replay Attack

github.com/cosmos/ethermint is vulnerable to Transaction Replay Attack. The vulnerability is due to a flaw in the EVM module where, if the victim sends a very large nonce transaction, the attacker can replay the transaction through the application...

Consensus Attack

github.com/ethereum/go-ethereum is vulnerable to a Consensus Attack. The vulnerability is due to Geth's pre-compiled dataCopy contract performing a shallow copy on invocation, which allows an attacker to manipulate Ethereum Virtual Machine EVM memory and cause a consensus mismatch between nodes...

Malicious code in evm-oracle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3c91e468e1cf1503476c51feda4ab0bfb701bc195a5b682801c9182256704b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8901 Malicious code in evm-oracle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3c91e468e1cf1503476c51feda4ab0bfb701bc195a5b682801c9182256704b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-48803 phy: ti: Fix missing sentinel for clk_div_table

In the Linux kernel, the following vulnerability has been resolved: phy: ti: Fix missing sentinel for clkdivtable gettablemaxdiv tries to access "clkdivtable" array out of bound defined in phy-j721e-wiz.c. Add a sentinel entry to prevent the following global-out-of-bounds error reported by enabli...

MAL-2024-7095 Malicious code in bluefin-exchange-contracts-evm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5de25fa81235c71b8908ce290060da71c925d70200b0aa17c4ce09f9a4517e1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bluefin-exchange-contracts-evm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5de25fa81235c71b8908ce290060da71c925d70200b0aa17c4ce09f9a4517e1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37159 Evmos is missing create validator check

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0...

CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...