CVE-2024-27094
Published Mar 21, 2024OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When thi…
Vendor/product archive
openzeppelin / contracts_upgradeable CVEs
Beta · best-effort12 CVEs tagged to openzeppelin / contracts_upgradeable — 0 Critical, 2 High, 10 Medium, 0 Low, 0 Unrated.
CVE-2023-49798
Published Dec 9, 2023OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Mult…
CVE-2023-34459
Published Jun 16, 2023OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to version 4.9.2, when the `verifyMultiProof`, `verifyMultiProofCalldata`,…
CVE-2023-34234
Published Jun 7, 2023OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel…
CVE-2023-30541
Published Apr 17, 2023OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the pr…
CVE-2023-30542
Published Apr 16, 2023OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of prop…
CVE-2023-26488
Published Mar 3, 2023OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batc…
CVE-2022-39384
Published Nov 4, 2022OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract crea…
CVE-2022-35961
Published Aug 15, 2022OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability…
CVE-2022-35916
Published Aug 1, 2022OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrum…
CVE-2022-35915
Published Aug 1, 2022OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by retur…
CVE-2022-31198
Published Aug 1, 2022OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFraction`, a mechanism…
Showing 1-12 of 12 CVEsPage 1 of 1