evm (>=0.13.0, <=0.20.0), evm-gasometer (>=0.13.0, <=0.20.0) +2 more potentially affected by unknown CVE via evm-core (>=0.13.1, <=0.20.0)

evm-core CARGO version =0.13.1, =0.13.0, =0.13.0, =0.13.0, =2.0.0-alpha.3, =2.0.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0066...

evm (>=0.22.0, <=0.22.1), evm-gasometer (0.22.0) +1 more potentially affected by unknown CVE via evm-core (0.22.0)

evm-core CARGO version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on evm-core and may be impacted: - evm =0.22.0, =0.22.1 - evm-gasometer 0.22.0 - evm-runtime 0.22.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0066...

RUSTSEC-2021-0066 Denial of service on EVM execution due to memory over-allocation

Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85...

Denial of service on EVM execution due to memory over-allocation

Prior to the patch, when executing specific EVM opcodes related to memory operations that use evmcore::Memory::copylarge, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack. The flaw was corrected in commit 19ade85...

Lack of chain information in the signed data leads to potential replay attacks.

Handle shw Vulnerability details Impact The Offer structure, whose hash is signed by a maker, does not contain information of the current chain. Therefore, the signature is valid on all EVM-compatible chains. In the situation of a future hard fork of the Ethereum network, the valid signatures on...

CVE-2021-27235

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diagzip.asp that allows anyone to export tables of a database...

CVE-2021-27233

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...

CVE-2021-27234

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. The web application suffers from SQL injection on Adminlog.asp, Archivemsgs.asp, Deletelog.asp, Eventlog.asp, and Evmlog.asp...

CVE-2021-27233

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...

Design/Logic Flaw

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diagzip.asp that allows anyone to export tables of a database...

Information disclosure

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...

CVE-2021-27233

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...

CVE-2021-27233

Mutare Voice (EVM) 3.x before 3.3.8 has an information disclosure on the admin portal Settings.asp where password information for external systems is visible in cleartext. Affected component: admin UI/settings page. Root cause: cleartext exposure of credentials in the admin portal. Impact: confid...

CVE-2021-27234

Mutare Voice (EVM) 3.x before 3.3.8 contains an SQL injection vulnerability in the web application, affecting Adminlog.asp, Archivemsgs.asp, Deletelog.asp, Eventlog.asp, and Evmlog.asp. The issue is caused by unsafe SQL query construction in the vulnerable pages. The connected sources do not prov...

CVE-2021-27235

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diagzip.asp that allows anyone to export tables of a database...

CVE-2021-27235

Mutare Voice (EVM) 3.x before 3.3.8 contains an insecure admin-portal export at diagzip.asp that allows unauthenticated users to export database tables. Root cause is a misconfigured export function without proper access controls, enabling potential data disclosure. Affected product: Mutare Voice...

CVE-2021-27236

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution...

CVE-2021-27236

Mutare Voice (EVM) 3.x before 3.3.8 is affected. The issue is an Unauthenticated Local File Inclusion via getfile.asp that can be leveraged to achieve Remote Code Execution. Affected component: getfile.asp in Mutare Voice; root cause: unauthenticated LFI. Impact: allows remote code execution with...

CVE-2021-27236: Exposure of Resource to Wrong Sphere

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution...

CVE-2021-27233: Cleartext Storage of Sensitive Information

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...