DFINITY Foundation
First CVE: Dec 8, 2023Active for: 3 years
5
CVEs Published
More CVEs Published than 15% of tracked CNAs
2.5
Avg CVEs / Year
More Avg CVEs / Year than 16% of tracked CNAs
7.6
Avg CVSS Score
Higher Avg CVSS Score than 74% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Self-Reporting Analysis
Of all the CVEs published by DFINITY Foundation as a CNA, 100.0% affect products that DFINITY Foundation develops as a vendor.
100.0%
Self-reported: 5Third-party: 0
Of all the CVEs published that affect products developed by DFINITY Foundation, 100.0% are self-published by DFINITY Foundation as a CNA.
100.0%
Self-published: 5Published by other CNAs: 0
Trends Over Time
The number and severity of CVEs published by DFINITY Foundation over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 8, 2023
2 years ago
Most Recent CVE
Dec 9, 2024
592 days ago
Top CVEs
All CVEs published by DFINITY Foundation as a CNA, regardless of affected vendor or product.
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-1631CRITICAL Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be use | Feb 21, 2024 | 9.1 | 26 | NO | NO |
CVE-2024-7884HIGH When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the | Sep 5, 2024 | 7.5 | 22 | NO | NO |
CVE-2024-4435HIGH When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered recently that when we deallocate a node, in some cases only | May 21, 2024 | 7.5 | 22 | NO | NO |
CVE-2023-6245HIGH The Candid library causes a Denial of Service while
parsing a specially crafted payload with 'empty' data type. For example,
if the payload is `record { * ; empty }` and the cani | Dec 8, 2023 | 7.5 | 21 | NO | NO |
CVE-2024-11991MEDIUM Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could pot | Dec 9, 2024 | 6.5 | 19 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA5 CVEs
20%
60%
20%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network5 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low5 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None5 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None5 (100.0%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (5 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by DFINITY Foundation as a CNA.
Media Mentions
Media articles that mention a CVE ID published by DFINITY Foundation as a CNA — matched by CVE ID, not by organization name.