Parity

14 CVEs across 5 Parity products. Browse Parity vulnerabilities, severities, and proof-of-concept exploits.

Parity products with known CVEs

ProductCVEs
Frontier8
Libsecp256k13
Browser1
Ethereum Client1
Ink\!1
Parity CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2023-45130High7.52023-10-13Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode…
CVE-2023-34449Medium5.32023-06-14ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and p…
CVE-2023-28431High7.52023-03-22Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior t…
CVE-2022-39242Medium5.32022-09-24Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted…
CVE-2022-36008High7.12022-08-19Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM rev…
CVE-2022-31111Medium5.32022-07-06Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance t…
CVE-2022-21685Medium6.52022-01-14Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile…
CVE-2021-41138Medium5.32021-10-13Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transac…
CVE-2021-39193Medium5.32021-09-03Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause inv…
CVE-2021-38195Critical9.82021-08-08An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger…
CVE-2019-25003High7.52020-12-31An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers ca…
CVE-2019-20399Medium5.92020-01-23A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a s…
CVE-2017-14460High7.52018-01-19An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent…
CVE-2017-18016Medium5.32018-01-11Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via th…