182 matches found
EUVD-2023-0188
Malicious code in bioql PyPI...
EUVD-2024-0602
Malicious code in bioql PyPI...
EUVD-2023-2289
Malicious code in bioql PyPI...
EUVD-2022-6524
Malicious code in bioql PyPI...
EUVD-2023-0941
Malicious code in bioql PyPI...
EUVD-2023-3124
Malicious code in bioql PyPI...
EUVD-2022-0403
Malicious code in bioql PyPI...
EUVD-2022-6647
Malicious code in bioql PyPI...
EUVD-2025-21789
Malicious code in bioql PyPI...
MAL-2025-41588 Malicious code in openzeppelin-contracts-5.0.2 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in openzeppelin-contracts-5.0.2 (npm)
--- -= Per source details. Do not edit below this line.=-...
Out-of-bounds Read
@openzeppelin/contracts and @openzeppelin/contracts-upgradeable are vulnerable to Out-of-bounds Read. The vulnerability is due to improper bounds checking caused by the lastIndexOf function in Bytes.sol accessing uninitialized memory when given an empty buffer and a non-maximum position,...
CVE-2025-54070
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...
@1inch/delegating (2.0.0), @1inch/farming (4.0.0) +33 more potentially affected by CVE-2025-54070 via @openzeppelin/contracts (>=5.2.0, <=5.3.0)
@openzeppelin/contracts NPM version =5.2.0, =1.0.0-alpha.9, =0.1.0, =0.1.0, =0.0.4, =1.0.0, =0.1.0, =0.3.0, =0.5.3, =7.9.0-main3c5a2f8, =7.9.0-maine3c28f1, =7.9.0-main01f77d70, =7.9.0-mainc91b9b3, =8.0.9 and more Source cves: CVE-2025-54070 Source advisory: OSV:GHSA-9RCW-C2F9-2J55...
CVE-2025-54070 OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...
CVE-2025-54070 OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...
CVE-2025-54070 OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...
CVE-2025-54070
OpenZeppelin Contracts (Bytes.sol) lastIndexOf(bytes, byte, uint256) is vulnerable in versions prior to 5.4.0 when the input buffer is empty (buffer.length == 0) and pos != type(uint256).max. In this scenario, the function may access uninitialized memory at buffer + 0x20 + pos, potentially return...
PT-2025-29948 · Openzeppelin · Openzeppelin Contracts
Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions 5.2.0 through 5.3.9 Description: The lastIndexOfbytes,byte,uint256 function within the Bytes.sol library may access uninitialized memory under specific conditions. This occurs when the provided buffer length is...
OpenZeppelin Contracts 缓冲区错误漏洞
OpenZeppelin Contracts is a secure smart contract development library open-sourced by OpenZeppelin. A buffer error vulnerability exists in OpenZeppelin Contracts versions prior to 5.4.0, which stems from the lastIndexOf function potentially accessing uninitialized memory, potentially resulting in...