# Vulnerabilities published in 2024


- [MAL-2024-10017](https://insights.sbomify.com/MAL-2024-10017/): Malicious code in ethreeum (PyPI) (malicious package)
- [MAL-2024-10016](https://insights.sbomify.com/MAL-2024-10016/): Malicious code in ethherum (PyPI) (malicious package)
- [MAL-2024-10015](https://insights.sbomify.com/MAL-2024-10015/): Malicious code in ethherium (PyPI) (malicious package)
- [MAL-2024-10014](https://insights.sbomify.com/MAL-2024-10014/): Malicious code in etheurm (PyPI) (malicious package)
- [MAL-2024-10013](https://insights.sbomify.com/MAL-2024-10013/): Malicious code in etheum (PyPI) (malicious package)
- [MAL-2024-10012](https://insights.sbomify.com/MAL-2024-10012/): Malicious code in etheruum (PyPI) (malicious package)
- [MAL-2024-10011](https://insights.sbomify.com/MAL-2024-10011/): Malicious code in etherun (PyPI) (malicious package)
- [MAL-2024-10010](https://insights.sbomify.com/MAL-2024-10010/): Malicious code in etherumm (PyPI) (malicious package)
- [MAL-2024-1001](https://insights.sbomify.com/MAL-2024-1001/): Malicious code in blockledger (npm) (malicious package)
- [MAL-2024-10009](https://insights.sbomify.com/MAL-2024-10009/): Malicious code in etherum (PyPI) (malicious package)
- [MAL-2024-10008](https://insights.sbomify.com/MAL-2024-10008/): Malicious code in etheruim (PyPI) (malicious package)
- [MAL-2024-10007](https://insights.sbomify.com/MAL-2024-10007/): Malicious code in etheruemm (PyPI) (malicious package)
- [MAL-2024-10006](https://insights.sbomify.com/MAL-2024-10006/): Malicious code in etheruem (PyPI) (malicious package)
- [MAL-2024-10005](https://insights.sbomify.com/MAL-2024-10005/): Malicious code in etherriuumm (PyPI) (malicious package)
- [MAL-2024-10004](https://insights.sbomify.com/MAL-2024-10004/): Malicious code in etherriuum (PyPI) (malicious package)
- [MAL-2024-10003](https://insights.sbomify.com/MAL-2024-10003/): Malicious code in etherrium (PyPI) (malicious package)
- [MAL-2024-10002](https://insights.sbomify.com/MAL-2024-10002/): Malicious code in etherreumm (PyPI) (malicious package)
- [MAL-2024-10001](https://insights.sbomify.com/MAL-2024-10001/): Malicious code in etherreum (PyPI) (malicious package)
- [MAL-2024-10000](https://insights.sbomify.com/MAL-2024-10000/): Malicious code in etherreeum (PyPI) (malicious package)
- [MAL-2024-1000](https://insights.sbomify.com/MAL-2024-1000/): Malicious code in custom-solutions (npm) (malicious package)
- [MAL-2024-100](https://insights.sbomify.com/MAL-2024-100/): Malicious code in wdpr-ra-node-csp (npm) (malicious package)
- [MAL-2024-10](https://insights.sbomify.com/MAL-2024-10/): Malicious code in @msmg-money/vue-datadog (npm) (malicious package)
- [MAL-2024-1](https://insights.sbomify.com/MAL-2024-1/): Malicious code in squaredev-next-online-payments-example (npm) (malicious package)
- [GO-2024-3293](https://insights.sbomify.com/GO-2024-3293/): Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5 (not scored)
- [GO-2024-3068](https://insights.sbomify.com/GO-2024-3068/): Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia (not scored)
- [GO-2024-3012](https://insights.sbomify.com/GO-2024-3012/): Malicious code in github.com/PromonLogicalis/asn1 (not scored)
- [GO-2024-2451](https://insights.sbomify.com/GO-2024-2451/): IV collision in github.com/bincyber/go-sqlcrypter (not scored)
- [GHSA-xx4r-5265-48j6](https://insights.sbomify.com/GHSA-xx4r-5265-48j6/): silverstripe/framework SQL injection in full text search (not scored)
- [GHSA-xvcp-33rc-j8gq](https://insights.sbomify.com/GHSA-xvcp-33rc-j8gq/): Insecure Unserialize in TYPO3 Import/Export (not scored)
- [GHSA-xrv3-jmcp-374j](https://insights.sbomify.com/GHSA-xrv3-jmcp-374j/): zerovec incorrectly uses `#[repr(packed)]` (not scored)
- [GHSA-xr7q-jx4m-x55m](https://insights.sbomify.com/GHSA-xr7q-jx4m-x55m/): Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go (not scored)
- [GHSA-xpff-c35g-j3cr](https://insights.sbomify.com/GHSA-xpff-c35g-j3cr/): silverstripe/framework Privilege Escalation Risk in Member Edit form (not scored)
- [GHSA-xmrp-424f-vfpx](https://insights.sbomify.com/GHSA-xmrp-424f-vfpx/): SQLx Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts (not scored)
- [GHSA-xmp3-7745-g4vj](https://insights.sbomify.com/GHSA-xmp3-7745-g4vj/): ezsystems/ez-support-tools Failing access control in system info view (not scored)
- [GHSA-xmgr-jff3-fcfv](https://insights.sbomify.com/GHSA-xmgr-jff3-fcfv/): TYPO3 Security Misconfiguration in User Session Handling (not scored)
- [GHSA-xm4r-5rj9-2pg3](https://insights.sbomify.com/GHSA-xm4r-5rj9-2pg3/): gratient 0.5 contains credential harvesting code (not scored)
- [GHSA-xm3x-4ph3-3x9c](https://insights.sbomify.com/GHSA-xm3x-4ph3-3x9c/): friendsofsymfony/oauth2-php open redirection in oauth (not scored)
- [GHSA-xjw3-5r5c-m5ph](https://insights.sbomify.com/GHSA-xjw3-5r5c-m5ph/): typo3 Security fix for Flow Swift Mailer package (not scored)
- [GHSA-xgmx-j3hv-jh9x](https://insights.sbomify.com/GHSA-xgmx-j3hv-jh9x/): TYPO3 Cross-Site Scripting in Link Handling (not scored)
- [GHSA-xgfm-fjx6-62mj](https://insights.sbomify.com/GHSA-xgfm-fjx6-62mj/): readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects (not scored)
- [GHSA-xg9w-r469-m455](https://insights.sbomify.com/GHSA-xg9w-r469-m455/): ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities (not scored)
- [GHSA-xfhw-6mc4-mgxf](https://insights.sbomify.com/GHSA-xfhw-6mc4-mgxf/): crayon: ObjectPool creates uninitialized memory when freeing objects (not scored)
- [GHSA-xffp-6w68-4775](https://insights.sbomify.com/GHSA-xffp-6w68-4775/): Zendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress` (not scored)
- [GHSA-xc69-p8fc-m6m5](https://insights.sbomify.com/GHSA-xc69-p8fc-m6m5/): silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source) (not scored)
- [GHSA-x8jh-xj3x-gx3c](https://insights.sbomify.com/GHSA-x8jh-xj3x-gx3c/): `fast-float` has multiple soundness issues (not scored)
- [GHSA-x883-2vmg-xwf7](https://insights.sbomify.com/GHSA-x883-2vmg-xwf7/): Authelia's Group Changes may not have the expected results (YAML file backend) (not scored)
- [GHSA-x86x-qhf8-f37w](https://insights.sbomify.com/GHSA-x86x-qhf8-f37w/): willdurand/js-translation-bundle potential path traversal attack and remote code injection (not scored)
- [GHSA-x7xj-jvwp-97rv](https://insights.sbomify.com/GHSA-x7xj-jvwp-97rv/): RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists (not scored)
- [GHSA-x6xg-3fj2-4pq3](https://insights.sbomify.com/GHSA-x6xg-3fj2-4pq3/): `exotel` project on PyPI compromised, malicious release made (not scored)
- [GHSA-x6v2-xmrq-574j](https://insights.sbomify.com/GHSA-x6v2-xmrq-574j/): Drupal Anonymous Open Redirect (not scored)
- [GHSA-x5w2-wcr8-9q45](https://insights.sbomify.com/GHSA-x5w2-wcr8-9q45/): Silverstripe Missing security check on dev/build/defaults (not scored)
- [GHSA-x5r5-2qrx-rqj8](https://insights.sbomify.com/GHSA-x5r5-2qrx-rqj8/): Transparent TLS may not be applied to Marbles with certain manifest configurations (not scored)
- [GHSA-x565-32qp-m3vf](https://insights.sbomify.com/GHSA-x565-32qp-m3vf/): phin may include sensitive headers in subsequent requests after redirect (not scored)
- [GHSA-x4rj-f7m6-42c3](https://insights.sbomify.com/GHSA-x4rj-f7m6-42c3/): TYPO3 CMS Authentication Bypass vulnerability (not scored)
- [GHSA-x428-565f-8xj2](https://insights.sbomify.com/GHSA-x428-565f-8xj2/): TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API (not scored)
- [GHSA-x3f4-45xf-rjm7](https://insights.sbomify.com/GHSA-x3f4-45xf-rjm7/): `ruzstd` uninit and out-of-bounds memory reads (not scored)
- [GHSA-x2f4-8wxf-w3vf](https://insights.sbomify.com/GHSA-x2f4-8wxf-w3vf/): ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations (not scored)
- [GHSA-wxxw-5gq6-j2g5](https://insights.sbomify.com/GHSA-wxxw-5gq6-j2g5/): contao/core Insufficient input validation allows for code injection and remote execution (not scored)
- [GHSA-wxfg-253g-m7r4](https://insights.sbomify.com/GHSA-wxfg-253g-m7r4/): Drupal core Open Redirect vulnerability (not scored)
- [GHSA-wwq9-3cpr-mm53](https://insights.sbomify.com/GHSA-wwq9-3cpr-mm53/): Borsh serialization of HashMap is non-canonical (not scored)
- [GHSA-ww6p-q26w-fr6m](https://insights.sbomify.com/GHSA-ww6p-q26w-fr6m/): phpxmlrpc/extra XSS in class documenting_xmlrpc_server (not scored)
- [GHSA-wvvp-jwf5-qcpc](https://insights.sbomify.com/GHSA-wvvp-jwf5-qcpc/): TYPO3 Information Disclosure in Page Tree (not scored)
- [GHSA-wrw7-89jp-8q8g](https://insights.sbomify.com/GHSA-wrw7-89jp-8q8g/): Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` (not scored)
- [GHSA-wrpf-2x8h-82gr](https://insights.sbomify.com/GHSA-wrpf-2x8h-82gr/): Typo3 Arbitrary File Disclosure in Form Component (not scored)
- [GHSA-wr3c-6c22-m9v6](https://insights.sbomify.com/GHSA-wr3c-6c22-m9v6/): Privilege Escalation in TYPO3 Neos (not scored)
- [GHSA-wq9x-qwcq-mmgf](https://insights.sbomify.com/GHSA-wq9x-qwcq-mmgf/): Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts (not scored)
- [GHSA-wq8p-mqvg-2p5h](https://insights.sbomify.com/GHSA-wq8p-mqvg-2p5h/): laravel framework SQL Injection via limit and offset functions (not scored)
- [GHSA-wq88-fq4x-h2pm](https://insights.sbomify.com/GHSA-wq88-fq4x-h2pm/): WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM (not scored)
- [GHSA-wq43-8r5p-w3mc](https://insights.sbomify.com/GHSA-wq43-8r5p-w3mc/): contao/core PHP object injection vulnerability allows for arbitrary code execution (not scored)
- [GHSA-wp8j-c736-c5r3](https://insights.sbomify.com/GHSA-wp8j-c736-c5r3/): TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors (not scored)
- [GHSA-wm25-j4gw-6vr3](https://insights.sbomify.com/GHSA-wm25-j4gw-6vr3/): pREST vulnerable to jwt bypass + sql injection (not scored)
- [GHSA-wjxc-pjx9-4wvm](https://insights.sbomify.com/GHSA-wjxc-pjx9-4wvm/): Nervos CKB Panic on malformed input (not scored)
- [GHSA-wjg9-v8cf-f5q2](https://insights.sbomify.com/GHSA-wjg9-v8cf-f5q2/): silverstripe/graphql Cross-Site Request Forgery vulnerability (not scored)
- [GHSA-wj85-rg5g-v8jm](https://insights.sbomify.com/GHSA-wj85-rg5g-v8jm/): TYPO3 Information Disclosure in User Authentication (not scored)
- [GHSA-wh8q-72cp-p5wf](https://insights.sbomify.com/GHSA-wh8q-72cp-p5wf/): Cross-Site Scripting in TYPO3 component Indexed Search (not scored)
- [GHSA-wg8h-gxf4-g4gh](https://insights.sbomify.com/GHSA-wg8h-gxf4-g4gh/): TYPO3 Cross-Site Scripting in Online Media Asset Rendering (not scored)
- [GHSA-wg2x-rv86-mmpx](https://insights.sbomify.com/GHSA-wg2x-rv86-mmpx/): SPV Merkle proof malleability allows the maintainer to prove invalid transactions (not scored)
- [GHSA-w9p3-26fx-5mp3](https://insights.sbomify.com/GHSA-w9p3-26fx-5mp3/): eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS) (not scored)
- [GHSA-w8gf-g2vq-j2f4](https://insights.sbomify.com/GHSA-w8gf-g2vq-j2f4/): amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames (not scored)
- [GHSA-w8fq-xgvh-cxc2](https://insights.sbomify.com/GHSA-w8fq-xgvh-cxc2/): Silverstripe Forum Module CSRF Vulnerability (not scored)
- [GHSA-w5w5-8vfh-xcjq](https://insights.sbomify.com/GHSA-w5w5-8vfh-xcjq/): whoami stack buffer overflow on several Unix platforms (not scored)
- [GHSA-w5mj-j45q-m638](https://insights.sbomify.com/GHSA-w5mj-j45q-m638/): ZendFramework1 Potential Security Issues in Bundled Dojo Library (not scored)
- [GHSA-w59h-378f-2frm](https://insights.sbomify.com/GHSA-w59h-378f-2frm/): Unsound sending of non-Send types across threads in threadalone (not scored)
- [GHSA-w4hv-vmv9-hgcr](https://insights.sbomify.com/GHSA-w4hv-vmv9-hgcr/): GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219` (not scored)
- [GHSA-w333-5f96-mjrr](https://insights.sbomify.com/GHSA-w333-5f96-mjrr/): Drupal core Denial of Service (not scored)
- [GHSA-w2pj-9cgh-mq2c](https://insights.sbomify.com/GHSA-w2pj-9cgh-mq2c/): opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 (not scored)
- [GHSA-w228-rfpx-fhm4](https://insights.sbomify.com/GHSA-w228-rfpx-fhm4/): cg vulnerable to an Open Redirect Vulnerability on Referer Header (not scored)
- [GHSA-vxcf-c7mx-pg53](https://insights.sbomify.com/GHSA-vxcf-c7mx-pg53/): Build corruption when using `PYO3_CONFIG_FILE` environment variable (not scored)
- [GHSA-vx3h-qwqw-r2wq](https://insights.sbomify.com/GHSA-vx3h-qwqw-r2wq/): Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP (not scored)
- [GHSA-vvm3-rv48-j3g5](https://insights.sbomify.com/GHSA-vvm3-rv48-j3g5/): Zendframework Potential XSS or HTML Injection vector in Zend_Json (not scored)
- [GHSA-vv6c-69r6-chg9](https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/): Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly (not scored)
- [GHSA-vr95-p7q6-8m9q](https://insights.sbomify.com/GHSA-vr95-p7q6-8m9q/): Laravel Cross-site Scripting (XSS) vulnerability in blade templating (not scored)
- [GHSA-vq4j-qcx7-ppc6](https://insights.sbomify.com/GHSA-vq4j-qcx7-ppc6/): Thelia Cross-site Scripting vulnerability in BackOffice (not scored)
- [GHSA-vpr3-rc99-2wpr](https://insights.sbomify.com/GHSA-vpr3-rc99-2wpr/): Information Disclosure in TYPO3 Backend (not scored)
- [GHSA-vpr3-cw3h-prw8](https://insights.sbomify.com/GHSA-vpr3-cw3h-prw8/): SimpleSAMLphp Reflected Cross-site Scripting vulnerability (not scored)
- [GHSA-vp8p-c6xj-xpj7](https://insights.sbomify.com/GHSA-vp8p-c6xj-xpj7/): Silverstripe External redirection risk in Security?ReturnURL (not scored)
- [GHSA-vmqh-5232-v43r](https://insights.sbomify.com/GHSA-vmqh-5232-v43r/): Panic in wasmvm can slow down block production (not scored)
- [GHSA-vmg2-r3xv-r3xf](https://insights.sbomify.com/GHSA-vmg2-r3xv-r3xf/): Simulation of Wasmd message can cause crashing (not scored)
- [GHSA-vjwg-28gv-pm8h](https://insights.sbomify.com/GHSA-vjwg-28gv-pm8h/): Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881 (not scored)
- [GHSA-vjrg-wpm8-rhrw](https://insights.sbomify.com/GHSA-vjrg-wpm8-rhrw/): doctrine/orm Regression in Query Parenthesis can have Security Implications (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/130/