Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 131 of 521.
- GHSA-vjg6-93fv-qv64 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only
- GHSA-vj2j-6g3w-4662 Silverstripe Missing CSRF protection in login form
- GHSA-vhxv-fg4m-p2w8 Some CORS middleware allow untrusted origins
- GHSA-vhmj-5q9r-mm9g BlastRADIUS also affects eduMFA
- GHSA-vh7q-j8p5-2h4h silverstripe/framework sends passwords back to browsers under some circumstances
- GHSA-vh6j-wv25-8qxr Flow Bugfix Releases for Entity Security
- GHSA-vgxh-x8jv-hmff silverstripe/framework code execution vulnerability
- GHSA-vgm8-r9gm-fw59 TYPO3 Cross-Site Scripting in legacy form component
- GHSA-vfm6-r2gc-pwww Symfony2 security issue when the trust proxy mode is enabled
- GHSA-vfgc-c76h-mwh4 Drupal core Cross-Site Scripting (XSS) vulnerabilities
- GHSA-vcg6-8fxc-x5cq silverstripe/framework allows upload of dangerous file types
- GHSA-v8mx-hp2q-gw85 Golang SDK for Vela Insecure Variable Substitution
- GHSA-v8m4-3w37-ghxx TYPO3 Cross-Site Scripting in Form Framework validation handling
- GHSA-v8hp-239v-9367 OroCRM Forced Redirect to External Website
- GHSA-v86m-j5f7-ccwh Passbolt Api E-mail HTML injection
- GHSA-v858-922f-fj9v SimpleSAMLphp Link Injection vulnerability
- GHSA-v84h-653v-4pq9 Some CORS middleware allow untrusted origins
- GHSA-v6rw-hhgg-wc4x Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit
- GHSA-v5jp-4h2p-j2p4 Privilege Escalation in TYPO3 CMS
- GHSA-v4qr-8h2v-qpjx Cross-Site Scripting in TYPO3 CMS Backend
- GHSA-v42g-7q2x-cw32 Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
- GHSA-v363-rrf2-5fmj Unsound use of str::from_utf8_unchecked on bytes which are not UTF-8
- GHSA-v273-j5hq-26xp Drupal core uses a vulnerable Third-party library CKEditor
- GHSA-rxc9-f2x6-qh4w TYPO3 Security Misconfiguration for Backend User Accounts
- GHSA-rvj4-q8q5-8grf ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability
- GHSA-rv8r-8mh5-5376 TYPO3 Information Disclosure in Backend User Interface
- GHSA-rq6q-hjvh-5mwh Flow Swift Mailer package Remote code execution
- GHSA-rp9h-rf7g-hwgr s2n-tls has undefined behavior at process exit
- GHSA-rm66-9gh4-4gp8 cggmp21 vulnerable to ambiguous challenge derivation
- GHSA-rjpm-qmq7-q85w Symfony XXE security vulnerability
- GHSA-rjfv-pjvx-mjgv AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers
- GHSA-rjc6-vm4h-85cg Sensitive Information Exposure Through Insecure Logging For Secrets Like Metadata.DockerBuildArgs
- GHSA-rj3w-99gc-8j58 Laravel Risk of mass-assignment vulnerabilities
- GHSA-rg2q-2jh9-447q Gas mispricing in cosmwasm-vm
- GHSA-rcm4-jv5g-wccm zfr authentication adapter did not verify validity of tokens
- GHSA-rc4p-p3j9-6577 pypqc private key retrieval vulnerability
- GHSA-r9vp-fp72-xgf7 silverstripe/framework's `Member.Name` is not escaped
- GHSA-r9vc-jfmh-6j48 TYPO3 frontend login vulnerable to Session Fixation
- GHSA-r9rv-9mh8-pxf4 Nervos CKB BlockTimeTooNew should not be considered as invalid block
- GHSA-r9cr-qmfw-pmrc Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
- GHSA-r97r-64vp-fghm Silverstripe XSS vulnerability via VirtualPage
- GHSA-r85g-7jpv-8xrx silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL
- GHSA-r6mm-wmhf-849m Time-Based Information Disclosure Vulnerability in Flow
- GHSA-r67r-42wx-c8r7 Drupal External URL injection through URL aliases leading to Open Redirect
- GHSA-r3pr-fh25-wrfc silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms
- GHSA-r32j-mr8p-hfp8 Silverstripe XSS in TreeDropdownField and TreeMultiSelectField
- GHSA-r2r8-36pq-27cm nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values
- GHSA-r287-hc8j-w56h TYPO3 Information Disclosure Vulnerability Exploitable by Editors
- GHSA-qwvp-268g-jjm8 Data Leakage Vulnerability in livewire/livewire
- GHSA-qvgg-r6rq-vwfx datadog/dd-trace Circumvents open_basedir INI directive
- GHSA-qrxh-46mr-pr7q TYPO3 is susceptible to Cross-Site Flashing
- GHSA-qr8r-m495-7hc4 Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbft
- GHSA-qr5f-6fcv-w69q Typo3 Security Misconfiguration in Frontend Session Handling
- GHSA-qr4w-53vh-m672 opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
- GHSA-qp29-wcc2-vmpc Silverstripe HtmlEditor embed url sanitisation
- GHSA-qmwf-j7g7-f5jw Cross-Site Scripting in third party library mso/idna-convert
- GHSA-qm9f-c3v9-wphv Security Update for the OPC UA .NET Standard Stack
- GHSA-qm5v-pj64-852j Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"
- GHSA-qm5c-m76r-2hfr Laravel RCE vulnerability in "cookie" session driver
- GHSA-qjcv-rx3v-7mvj Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go
- GHSA-qhjc-hg94-245v eZ Platform Prevent accepting app.php in URL in Platform.sh
- GHSA-qg7m-mwxm-j3h7 Zend-developer-tools information disclosure vulnerability
- GHSA-qffc-gwpp-m2xr XML External Entity (XXE) Processing in TYPO3 Core
- GHSA-qf65-hph9-453r Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library
- GHSA-qf36-fx9f-232x ZendFramework potential SQL Injection Vector When Using PDO_MySql
- GHSA-qc7w-4567-84wv Zendframework vulnerable to XXE/XEE attacks
- GHSA-qc6v-5g5m-8cw2 ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/http
- GHSA-q9j3-4ghj-6h57 Inadequate XSS Prevention in CodeIgniter/Framework Security Library
- GHSA-q9c4-9v5m-597p Typo3 Information Disclosure in Backend User Interface
- GHSA-q8fc-v85f-78pw stormpath/sdk uses Insecure Random Number Generator
- GHSA-q849-wxrc-vqrp hull.js Code Injection Vulnerability
- GHSA-q73v-79x3-jv2w eZ Platform Admin UI Cross-site Scripting vulnerability
- GHSA-q73f-w3h7-7wcc Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result
- GHSA-q6cp-qfwq-4gcv h2 servers vulnerable to degradation of service with CONTINUATION Flood
- GHSA-q669-2vfg-cxcg Nervos CKB Unaligned Pointer Dereference
- GHSA-q5fm-55c2-v6j9 Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib
- GHSA-q4xf-7fw5-4x8v Laravel Hijacked authentication cookies vulnerability
- GHSA-q445-7m23-qrmw openssl's `MemBio::get_buf` has undefined behavior with empty buffers
- GHSA-q3jm-v27q-jfww titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack
- GHSA-q3g4-2vw9-xv27 Shopware Remote Code Execution Vulnerability
- GHSA-q2gc-gg3x-7942 Symfony XML Entity Expansion security vulnerability
- GHSA-pw2q-qwvj-gh43 Cache Flooding in TYPO3 Frontend
- GHSA-prpf-cj87-hwvr Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
- GHSA-pr99-c33p-fwf6 Drupal core Denial of Service
- GHSA-pr39-8257-fxc2 Nervos CKB DoS: Process exists when p2p discovery protocol receives unsupported peer IP
- GHSA-pqjm-xcp8-wgmm Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads
- GHSA-pqhp-25j4-6hq9 smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables
- GHSA-pqfv-97hj-g97g TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure
- GHSA-ppvg-hw62-6ph9 TYPO3 Security Misconfiguration in Install Tool Cookie
- GHSA-ppm4-r2vc-pg74 SimpleSAMLphp Information Disclosure vulnerability
- GHSA-ppgf-8745-8pgx Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
- GHSA-pp84-v3mw-gg4w Taipy 3.1.1 affected by CVEs on flask-core and pymongo
- GHSA-pp7v-wxx9-hm6r Thelia BackOffice default template vulnerable to Cross-site Scripting
- GHSA-pp7q-6j3f-74vj silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage
- GHSA-pmxp-7224-h794 Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search
- GHSA-pm3m-32r3-7mfh Etcd embed auto compaction retention negative value causing a compaction loop or a crash
- GHSA-pjx8-984p-7p3x FOSUserBundle Entropy is lost in the TokenGenerator
- GHSA-ph62-fv59-vf9h silverstripe/framework users inadvertently passing sensitive data to LoginAttempt
- GHSA-pfr9-2p92-qrhq Heap Buffer overflow using c_chars_to_str function
- GHSA-pf56-h9qf-rxq4 Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page