CVE-2024-37159

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
evmos	evmos	< 18.0.0

References

Timeline

Published: Jun 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-37166.2A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in CVE-2024-371604.8Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scri CVE-2024-371616.1MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting CVE-2024-371625.3zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stac CVE-2024-371637.5SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecure CVE-2024-371648.5Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply cu CVE-2024-371656.1Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulne CVE-2024-371668.9ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code CVE-2024-371674.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that th CVE-2024-371685.3@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8 CVE-2024-371695.3@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses CVE-2024-37177.5The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions