CVE-2024-39696

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-396978.6phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may p CVE-2024-396987.5electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerif CVE-2024-396995.0Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file im CVE-2024-39707.5Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disc CVE-2024-397009.8JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option CVE-2024-397017.7Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin o CVE-2024-397025.9In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Den CVE-2024-397038.8In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API e CVE-2024-397049.8Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary code CVE-2024-397059.8NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download fun CVE-2024-397075.3Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could le CVE-2024-397087.0An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096 on Windows. Sometim