Privilege Escalation

openzeppelin/contracts is vulnerable to privilege escalation. The vulnerability exists due to the lack of sanitization in the initializer function which allowed an actor with executor role to escalate privileges...

Improper Initialization in OpenZeppelin

In OpenZeppelin =v4.4.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an...

CVE-2021-46320

In OpenZeppelin =v4.4.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an...

Code injection

In OpenZeppelin =v4.4.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an...

CVE-2021-46320

In OpenZeppelin =v4.4.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an...

CVE-2021-46320

Concretely documented in OpenZeppelin advisories: OpenZeppelin Contracts (and upgradeable variants)

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin =v4.4.0 that stems from initializer functions that are called separately from contract creation the most notable example being minimal proxies and can be re-enter...

GHSA-9C22-PWXW-P6HX OpenZeppelin Contracts initializer reentrancy may lead to double initialization

Impact Initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in plac...

PT-2021-24346 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions 3.2.0 through 4.4.0 Description: The issue concerns initializer functions that are invoked separate from contract creation, such as minimal proxies, which may be reentered if they make an untrusted non-view...

The vulnerability of the `parser_parse_object_initializer` function in the `js-parser-expr.c` component of the JavaScript framework for Internet of Things, JerryScript, and the IoT.js platform, arises due to the insufficient use of the `assert()` function. This allows attackers to trigger a service failure.

The vulnerability of the parserparseobjectinitializer function in the js-parser-expr.c component of the JavaScript framework for Internet of Things technology, JerryScript, and the IoT.js platform is related to the insufficient use of the assert function. Exploiting this vulnerability could allow...

Unspecified Vulnerability in JerryScript (CNVD-2021-42989)

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in the parserparseobjectinitializer in /home/JerryScript/jerry-core/parser/js/js-parser-expr.c in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

CVE-2020-23322

There is an Assertion in 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' in parserparseobjectinitializer in JerryScript 2.2.0...

CVE-2020-23322

There is an Assertion in 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' in parserparseobjectinitializer in JerryScript 2.2.0...

CVE-2020-23311

There is an Assertion 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' failed at js-parser-expr.c:3230 in parserparseobjectinitializer in JerryScript 2.2.0...

UBUNTU-CVE-2020-23322

There is an Assertion in 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' in parserparseobjectinitializer in JerryScript 2.2.0...

UBUNTU-CVE-2020-23311

There is an Assertion 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' failed at js-parser-expr.c:3230 in parserparseobjectinitializer in JerryScript 2.2.0...

CVE-2020-23322

CVE-2020-23322 concerns a vulnerability in JerryScript 2.2.0, specifically an assertion in parser_parse_object_initializer: context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA. The connected documents confirm the sam...

JerryScript 安全漏洞

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in the parserparseobjectinitializer in /home/JerryScript/jerry-core/parser/js/js-parser-expr.c in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

JerryScript 代码问题漏洞

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in the parserparseobjectinitializer in js-parser-expr.c:3230 in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

Possible Denial of Service vulnerability in Action Dispatch

There is a possible Denial of Service vulnerability in the Mime type parser of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2021-22902. Versions Affected: = 6.0.0 Not affected: \sMIMEPARAMETER\s\z/ end end...