OpenZeppelin

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

OpenZeppelin records in CISA KEV

No OpenZeppelin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Contracts 20 records MEDIUM Contracts Upgradeable 12 records MEDIUM Openzeppelin 1 record LOW Openzeppelin-eth 1 record LOW Openzeppelin-solidity 1 record LOW Openzeppelin Contracts 1 record LOW Openzeppelin Contracts-upgradable 1 record LOW

Records

20 records in Contracts · all components

TI-2022-13196 CVE-2022-31153 · GHSA-8mjr-jr5h-q2xr

OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

MEDIUM 62

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01455 Published 2022-07-15 Fixed in 0.2.1 CWE-664

TI-2021-16554 CVE-2021-39168 · GHSA-vrw4-w73r-6mm8

TimelockController vulnerability in OpenZeppelin Contracts

MEDIUM 46

OpenZepplin is a library for smart contract development.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0159 Published 2021-08-26 Fixed in 4.3.1, 3.4.2 +1 CWE-269

TI-2021-16553 CVE-2021-39167 · GHSA-fg47-3c2x-m2wr

TimelockController vulnerability in OpenZeppelin Contracts

MEDIUM 46

OpenZepplin is a library for smart contract development.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0159 Published 2021-08-26 Fixed in 4.3.1, 3.4.2 +1 CWE-269

TI-2021-18096 CVE-2021-41264 · GHSA-5vp3-v4hc-gx76

UUPSUpgradeable vulnerability in OpenZeppelin Contracts

MEDIUM 45

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01487 Published 2021-11-12 Fixed in 4.3.2 CWE-665

TI-2022-13238 CVE-2022-31198 · GHSA-xrc4-737v-9q75

GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

MEDIUM 40

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00788 Published 2022-08-01 Fixed in 4.7.2 CWE-682

TI-2022-13212 CVE-2022-31170 · GHSA-qh9x-gcfh-pcrw

OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

MEDIUM 40

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00788 Published 2022-07-21 Fixed in 4.7.1 CWE-20

TI-2023-14377 CVE-2023-30542 · GHSA-93hq-5wgc-jc82

GovernorCompatibilityBravo may trim proposal calldata

LOW 39

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00584 Published 2023-04-16 Fixed in 4.8.3 CWE-20

TI-2022-13213 CVE-2022-31172 · GHSA-4g63-c64m-25w9

OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

LOW 39

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00503 Published 2022-07-21 Fixed in 4.7.1 CWE-20

TI-2022-16386 CVE-2022-35961 · GHSA-4h98-2769-gh6h

ECDSA signature malleability in OpenZeppelin Contracts

LOW 37

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 7.9 Network Low privileges User interaction EPSS 0.00453 Published 2022-08-14 Fixed in 4.7.3 CWE-354

TI-2024-17955 CVE-2024-27094 · GHSA-9vx6-7xxf-x967

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

LOW 34

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00763 Published 2024-02-29 Fixed in 4.9.6, 5.0.2 CWE-125

TI-2023-27205 CVE-2023-49798 · GHSA-699g-q6qh-q4v8

Duplicated execution of subcalls in OpenZeppelin Contracts

LOW 34

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00543 Published 2023-12-08 Fixed in 4.9.5 CWE-670

TI-2023-14376 CVE-2023-30541 · GHSA-mx2q-35m2-x2rh

TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

LOW 32

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00812 Published 2023-04-17 Fixed in 4.8.3 CWE-436

TI-2023-17070 CVE-2023-34234 · GHSA-5h3x-9wvq-w4m2

Governor proposal creation may be blocked by frontrunning in OpenZeppelin

LOW 31

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00595 Published 2023-06-07 Fixed in 4.9.1 CWE-862

TI-2022-16343 CVE-2022-35916 · GHSA-9j3m-g383-29qr

Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

LOW 31

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00598 Published 2022-08-01 Fixed in 4.7.2 CWE-669

TI-2022-16342 CVE-2022-35915 · GHSA-7grf-83vw-6f5x

Unbounded gas consumption in @openzeppelin/contracts

LOW 31

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00799 Published 2022-08-01 Fixed in 4.7.2 CWE-400

TI-2023-11635 CVE-2023-26488 · GHSA-878m-3g6q-594q

OpenZeppelin Contracts contains Incorrect Calculation

LOW 30

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00713 Published 2023-03-03 Fixed in 4.8.2 CWE-682

TI-2024-30375 CVE-2024-45304

OwnableTwoStep allows a pending owner to accept ownership after the original owner has…

LOW 29

Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00479 Published 2024-08-30 Fixed in 0.16.0 CWE-670

TI-2023-09738 CVE-2023-23940 · GHSA-626q-v9j4-mcp4

OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass

LOW 28

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0022 Published 2023-02-03 Fixed in 0.6.1 CWE-345

TI-2023-17284 CVE-2023-34459 · GHSA-wprv-93r4-jj2p

OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

LOW 27

OpenZeppelin Contracts is a library for smart contract development.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00371 Published 2023-06-16 Fixed in 4.9.2 CWE-354

TI-2022-18758 CVE-2022-39384 · GHSA-9c22-pwxw-p6hx

OpenZeppelin Contracts initializer reentrancy may lead to double initialization

LOW 26

OpenZeppelin Contracts is a library for secure smart contract development.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00661 Published 2022-11-04 Fixed in 4.4.1 CWE-665

Open these records in search →

Critical	3
High	9
Medium	13
Low	1
No CVSS	0