# Vulnerabilities published in 2024


- [GHSA-vjg6-93fv-qv64](https://insights.sbomify.com/GHSA-vjg6-93fv-qv64/): Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only (not scored)
- [GHSA-vj2j-6g3w-4662](https://insights.sbomify.com/GHSA-vj2j-6g3w-4662/): Silverstripe Missing CSRF protection in login form (not scored)
- [GHSA-vhxv-fg4m-p2w8](https://insights.sbomify.com/GHSA-vhxv-fg4m-p2w8/): Some CORS middleware allow untrusted origins (not scored)
- [GHSA-vhmj-5q9r-mm9g](https://insights.sbomify.com/GHSA-vhmj-5q9r-mm9g/): BlastRADIUS also affects eduMFA (not scored)
- [GHSA-vh7q-j8p5-2h4h](https://insights.sbomify.com/GHSA-vh7q-j8p5-2h4h/): silverstripe/framework sends passwords back to browsers under some circumstances (not scored)
- [GHSA-vh6j-wv25-8qxr](https://insights.sbomify.com/GHSA-vh6j-wv25-8qxr/): Flow Bugfix Releases for Entity Security (not scored)
- [GHSA-vgxh-x8jv-hmff](https://insights.sbomify.com/GHSA-vgxh-x8jv-hmff/): silverstripe/framework code execution vulnerability (not scored)
- [GHSA-vgm8-r9gm-fw59](https://insights.sbomify.com/GHSA-vgm8-r9gm-fw59/): TYPO3 Cross-Site Scripting in legacy form component (not scored)
- [GHSA-vfm6-r2gc-pwww](https://insights.sbomify.com/GHSA-vfm6-r2gc-pwww/): Symfony2 security issue when the trust proxy mode is enabled (not scored)
- [GHSA-vfgc-c76h-mwh4](https://insights.sbomify.com/GHSA-vfgc-c76h-mwh4/): Drupal core Cross-Site Scripting (XSS) vulnerabilities (not scored)
- [GHSA-vcg6-8fxc-x5cq](https://insights.sbomify.com/GHSA-vcg6-8fxc-x5cq/): silverstripe/framework allows upload of dangerous file types (not scored)
- [GHSA-v8mx-hp2q-gw85](https://insights.sbomify.com/GHSA-v8mx-hp2q-gw85/): Golang SDK for Vela Insecure Variable Substitution (not scored)
- [GHSA-v8m4-3w37-ghxx](https://insights.sbomify.com/GHSA-v8m4-3w37-ghxx/): TYPO3 Cross-Site Scripting in Form Framework validation handling (not scored)
- [GHSA-v8hp-239v-9367](https://insights.sbomify.com/GHSA-v8hp-239v-9367/): OroCRM Forced Redirect to External Website (not scored)
- [GHSA-v86m-j5f7-ccwh](https://insights.sbomify.com/GHSA-v86m-j5f7-ccwh/): Passbolt Api E-mail HTML injection (not scored)
- [GHSA-v858-922f-fj9v](https://insights.sbomify.com/GHSA-v858-922f-fj9v/): SimpleSAMLphp Link Injection vulnerability (not scored)
- [GHSA-v84h-653v-4pq9](https://insights.sbomify.com/GHSA-v84h-653v-4pq9/): Some CORS middleware allow untrusted origins (not scored)
- [GHSA-v6rw-hhgg-wc4x](https://insights.sbomify.com/GHSA-v6rw-hhgg-wc4x/): Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit (not scored)
- [GHSA-v5jp-4h2p-j2p4](https://insights.sbomify.com/GHSA-v5jp-4h2p-j2p4/): Privilege Escalation in TYPO3 CMS (not scored)
- [GHSA-v4qr-8h2v-qpjx](https://insights.sbomify.com/GHSA-v4qr-8h2v-qpjx/): Cross-Site Scripting in TYPO3 CMS Backend (not scored)
- [GHSA-v42g-7q2x-cw32](https://insights.sbomify.com/GHSA-v42g-7q2x-cw32/): Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) (not scored)
- [GHSA-v363-rrf2-5fmj](https://insights.sbomify.com/GHSA-v363-rrf2-5fmj/): Unsound use of str::from_utf8_unchecked on bytes which are not UTF-8 (not scored)
- [GHSA-v273-j5hq-26xp](https://insights.sbomify.com/GHSA-v273-j5hq-26xp/): Drupal core uses a vulnerable Third-party library CKEditor (not scored)
- [GHSA-rxc9-f2x6-qh4w](https://insights.sbomify.com/GHSA-rxc9-f2x6-qh4w/): TYPO3 Security Misconfiguration for Backend User Accounts (not scored)
- [GHSA-rvj4-q8q5-8grf](https://insights.sbomify.com/GHSA-rvj4-q8q5-8grf/): ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability (not scored)
- [GHSA-rv8r-8mh5-5376](https://insights.sbomify.com/GHSA-rv8r-8mh5-5376/): TYPO3 Information Disclosure in Backend User Interface (not scored)
- [GHSA-rq6q-hjvh-5mwh](https://insights.sbomify.com/GHSA-rq6q-hjvh-5mwh/): Flow Swift Mailer package Remote code execution (not scored)
- [GHSA-rp9h-rf7g-hwgr](https://insights.sbomify.com/GHSA-rp9h-rf7g-hwgr/): s2n-tls has undefined behavior at process exit (not scored)
- [GHSA-rm66-9gh4-4gp8](https://insights.sbomify.com/GHSA-rm66-9gh4-4gp8/): cggmp21 vulnerable to ambiguous challenge derivation (not scored)
- [GHSA-rjpm-qmq7-q85w](https://insights.sbomify.com/GHSA-rjpm-qmq7-q85w/): Symfony XXE security vulnerability (not scored)
- [GHSA-rjfv-pjvx-mjgv](https://insights.sbomify.com/GHSA-rjfv-pjvx-mjgv/): AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers (not scored)
- [GHSA-rjc6-vm4h-85cg](https://insights.sbomify.com/GHSA-rjc6-vm4h-85cg/): Sensitive Information Exposure Through Insecure Logging For Secrets Like Metadata.DockerBuildArgs (not scored)
- [GHSA-rj3w-99gc-8j58](https://insights.sbomify.com/GHSA-rj3w-99gc-8j58/): Laravel Risk of mass-assignment vulnerabilities (not scored)
- [GHSA-rg2q-2jh9-447q](https://insights.sbomify.com/GHSA-rg2q-2jh9-447q/): Gas mispricing in cosmwasm-vm (not scored)
- [GHSA-rcm4-jv5g-wccm](https://insights.sbomify.com/GHSA-rcm4-jv5g-wccm/): zfr authentication adapter did not verify validity of tokens (not scored)
- [GHSA-rc4p-p3j9-6577](https://insights.sbomify.com/GHSA-rc4p-p3j9-6577/): pypqc private key retrieval vulnerability (not scored)
- [GHSA-r9vp-fp72-xgf7](https://insights.sbomify.com/GHSA-r9vp-fp72-xgf7/): silverstripe/framework's `Member.Name` is not escaped (not scored)
- [GHSA-r9vc-jfmh-6j48](https://insights.sbomify.com/GHSA-r9vc-jfmh-6j48/): TYPO3 frontend login vulnerable to Session Fixation (not scored)
- [GHSA-r9rv-9mh8-pxf4](https://insights.sbomify.com/GHSA-r9rv-9mh8-pxf4/): Nervos CKB BlockTimeTooNew should not be considered as invalid block (not scored)
- [GHSA-r9cr-qmfw-pmrc](https://insights.sbomify.com/GHSA-r9cr-qmfw-pmrc/): Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) (not scored)
- [GHSA-r97r-64vp-fghm](https://insights.sbomify.com/GHSA-r97r-64vp-fghm/): Silverstripe XSS vulnerability via VirtualPage (not scored)
- [GHSA-r85g-7jpv-8xrx](https://insights.sbomify.com/GHSA-r85g-7jpv-8xrx/): silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL (not scored)
- [GHSA-r6mm-wmhf-849m](https://insights.sbomify.com/GHSA-r6mm-wmhf-849m/): Time-Based Information Disclosure Vulnerability in Flow (not scored)
- [GHSA-r67r-42wx-c8r7](https://insights.sbomify.com/GHSA-r67r-42wx-c8r7/): Drupal External URL injection through URL aliases leading to Open Redirect (not scored)
- [GHSA-r3pr-fh25-wrfc](https://insights.sbomify.com/GHSA-r3pr-fh25-wrfc/): silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms (not scored)
- [GHSA-r32j-mr8p-hfp8](https://insights.sbomify.com/GHSA-r32j-mr8p-hfp8/): Silverstripe XSS in TreeDropdownField and TreeMultiSelectField (not scored)
- [GHSA-r2r8-36pq-27cm](https://insights.sbomify.com/GHSA-r2r8-36pq-27cm/): nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values (not scored)
- [GHSA-r287-hc8j-w56h](https://insights.sbomify.com/GHSA-r287-hc8j-w56h/): TYPO3 Information Disclosure Vulnerability Exploitable by Editors (not scored)
- [GHSA-qwvp-268g-jjm8](https://insights.sbomify.com/GHSA-qwvp-268g-jjm8/): Data Leakage Vulnerability in livewire/livewire (not scored)
- [GHSA-qvgg-r6rq-vwfx](https://insights.sbomify.com/GHSA-qvgg-r6rq-vwfx/): datadog/dd-trace Circumvents open_basedir INI directive (not scored)
- [GHSA-qrxh-46mr-pr7q](https://insights.sbomify.com/GHSA-qrxh-46mr-pr7q/): TYPO3 is susceptible to Cross-Site Flashing (not scored)
- [GHSA-qr8r-m495-7hc4](https://insights.sbomify.com/GHSA-qr8r-m495-7hc4/): Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbft (not scored)
- [GHSA-qr5f-6fcv-w69q](https://insights.sbomify.com/GHSA-qr5f-6fcv-w69q/): Typo3 Security Misconfiguration in Frontend Session Handling (not scored)
- [GHSA-qr4w-53vh-m672](https://insights.sbomify.com/GHSA-qr4w-53vh-m672/): opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 (not scored)
- [GHSA-qp29-wcc2-vmpc](https://insights.sbomify.com/GHSA-qp29-wcc2-vmpc/): Silverstripe HtmlEditor embed url sanitisation (not scored)
- [GHSA-qmwf-j7g7-f5jw](https://insights.sbomify.com/GHSA-qmwf-j7g7-f5jw/): Cross-Site Scripting in third party library mso/idna-convert (not scored)
- [GHSA-qm9f-c3v9-wphv](https://insights.sbomify.com/GHSA-qm9f-c3v9-wphv/): Security Update for the OPC UA .NET Standard Stack (not scored)
- [GHSA-qm5v-pj64-852j](https://insights.sbomify.com/GHSA-qm5v-pj64-852j/): Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab" (not scored)
- [GHSA-qm5c-m76r-2hfr](https://insights.sbomify.com/GHSA-qm5c-m76r-2hfr/): Laravel RCE vulnerability in "cookie" session driver (not scored)
- [GHSA-qjcv-rx3v-7mvj](https://insights.sbomify.com/GHSA-qjcv-rx3v-7mvj/): Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go (not scored)
- [GHSA-qhjc-hg94-245v](https://insights.sbomify.com/GHSA-qhjc-hg94-245v/): eZ Platform Prevent accepting app.php in URL in Platform.sh (not scored)
- [GHSA-qg7m-mwxm-j3h7](https://insights.sbomify.com/GHSA-qg7m-mwxm-j3h7/): Zend-developer-tools information disclosure vulnerability (not scored)
- [GHSA-qffc-gwpp-m2xr](https://insights.sbomify.com/GHSA-qffc-gwpp-m2xr/): XML External Entity (XXE) Processing in TYPO3 Core (not scored)
- [GHSA-qf65-hph9-453r](https://insights.sbomify.com/GHSA-qf65-hph9-453r/): Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library (not scored)
- [GHSA-qf36-fx9f-232x](https://insights.sbomify.com/GHSA-qf36-fx9f-232x/): ZendFramework potential SQL Injection Vector When Using PDO_MySql (not scored)
- [GHSA-qc7w-4567-84wv](https://insights.sbomify.com/GHSA-qc7w-4567-84wv/): Zendframework vulnerable to XXE/XEE attacks (not scored)
- [GHSA-qc6v-5g5m-8cw2](https://insights.sbomify.com/GHSA-qc6v-5g5m-8cw2/): ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/http (not scored)
- [GHSA-q9j3-4ghj-6h57](https://insights.sbomify.com/GHSA-q9j3-4ghj-6h57/): Inadequate XSS Prevention in CodeIgniter/Framework Security Library (not scored)
- [GHSA-q9c4-9v5m-597p](https://insights.sbomify.com/GHSA-q9c4-9v5m-597p/): Typo3 Information Disclosure in Backend User Interface (not scored)
- [GHSA-q8fc-v85f-78pw](https://insights.sbomify.com/GHSA-q8fc-v85f-78pw/): stormpath/sdk uses Insecure Random Number Generator (not scored)
- [GHSA-q849-wxrc-vqrp](https://insights.sbomify.com/GHSA-q849-wxrc-vqrp/): hull.js Code Injection Vulnerability (not scored)
- [GHSA-q73v-79x3-jv2w](https://insights.sbomify.com/GHSA-q73v-79x3-jv2w/): eZ Platform Admin UI Cross-site Scripting vulnerability (not scored)
- [GHSA-q73f-w3h7-7wcc](https://insights.sbomify.com/GHSA-q73f-w3h7-7wcc/): Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result (not scored)
- [GHSA-q6cp-qfwq-4gcv](https://insights.sbomify.com/GHSA-q6cp-qfwq-4gcv/): h2 servers vulnerable to degradation of service with CONTINUATION Flood (not scored)
- [GHSA-q669-2vfg-cxcg](https://insights.sbomify.com/GHSA-q669-2vfg-cxcg/): Nervos CKB Unaligned Pointer Dereference (not scored)
- [GHSA-q5fm-55c2-v6j9](https://insights.sbomify.com/GHSA-q5fm-55c2-v6j9/): Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib (not scored)
- [GHSA-q4xf-7fw5-4x8v](https://insights.sbomify.com/GHSA-q4xf-7fw5-4x8v/): Laravel Hijacked authentication cookies vulnerability (not scored)
- [GHSA-q445-7m23-qrmw](https://insights.sbomify.com/GHSA-q445-7m23-qrmw/): openssl's `MemBio::get_buf` has undefined behavior with empty buffers (not scored)
- [GHSA-q3jm-v27q-jfww](https://insights.sbomify.com/GHSA-q3jm-v27q-jfww/): titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack (not scored)
- [GHSA-q3g4-2vw9-xv27](https://insights.sbomify.com/GHSA-q3g4-2vw9-xv27/): Shopware Remote Code Execution Vulnerability (not scored)
- [GHSA-q2gc-gg3x-7942](https://insights.sbomify.com/GHSA-q2gc-gg3x-7942/): Symfony XML Entity Expansion security vulnerability (not scored)
- [GHSA-pw2q-qwvj-gh43](https://insights.sbomify.com/GHSA-pw2q-qwvj-gh43/): Cache Flooding in TYPO3 Frontend (not scored)
- [GHSA-prpf-cj87-hwvr](https://insights.sbomify.com/GHSA-prpf-cj87-hwvr/): Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities (not scored)
- [GHSA-pr99-c33p-fwf6](https://insights.sbomify.com/GHSA-pr99-c33p-fwf6/): Drupal core Denial of Service (not scored)
- [GHSA-pr39-8257-fxc2](https://insights.sbomify.com/GHSA-pr39-8257-fxc2/): Nervos CKB DoS: Process exists when p2p discovery protocol receives unsupported peer IP (not scored)
- [GHSA-pqjm-xcp8-wgmm](https://insights.sbomify.com/GHSA-pqjm-xcp8-wgmm/): Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads (not scored)
- [GHSA-pqhp-25j4-6hq9](https://insights.sbomify.com/GHSA-pqhp-25j4-6hq9/): smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables (not scored)
- [GHSA-pqfv-97hj-g97g](https://insights.sbomify.com/GHSA-pqfv-97hj-g97g/): TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure (not scored)
- [GHSA-ppvg-hw62-6ph9](https://insights.sbomify.com/GHSA-ppvg-hw62-6ph9/): TYPO3 Security Misconfiguration in Install Tool Cookie (not scored)
- [GHSA-ppm4-r2vc-pg74](https://insights.sbomify.com/GHSA-ppm4-r2vc-pg74/): SimpleSAMLphp Information Disclosure vulnerability (not scored)
- [GHSA-ppgf-8745-8pgx](https://insights.sbomify.com/GHSA-ppgf-8745-8pgx/): Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS (not scored)
- [GHSA-pp84-v3mw-gg4w](https://insights.sbomify.com/GHSA-pp84-v3mw-gg4w/): Taipy 3.1.1 affected by CVEs on flask-core and pymongo (not scored)
- [GHSA-pp7v-wxx9-hm6r](https://insights.sbomify.com/GHSA-pp7v-wxx9-hm6r/): Thelia BackOffice default template vulnerable to Cross-site Scripting (not scored)
- [GHSA-pp7q-6j3f-74vj](https://insights.sbomify.com/GHSA-pp7q-6j3f-74vj/): silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage (not scored)
- [GHSA-pmxp-7224-h794](https://insights.sbomify.com/GHSA-pmxp-7224-h794/): Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search (not scored)
- [GHSA-pm3m-32r3-7mfh](https://insights.sbomify.com/GHSA-pm3m-32r3-7mfh/): Etcd embed auto compaction retention negative value causing a compaction loop or a crash (not scored)
- [GHSA-pjx8-984p-7p3x](https://insights.sbomify.com/GHSA-pjx8-984p-7p3x/): FOSUserBundle Entropy is lost in the TokenGenerator (not scored)
- [GHSA-ph62-fv59-vf9h](https://insights.sbomify.com/GHSA-ph62-fv59-vf9h/): silverstripe/framework users inadvertently passing sensitive data to LoginAttempt (not scored)
- [GHSA-pfr9-2p92-qrhq](https://insights.sbomify.com/GHSA-pfr9-2p92-qrhq/): Heap Buffer overflow using c_chars_to_str function (not scored)
- [GHSA-pf56-h9qf-rxq4](https://insights.sbomify.com/GHSA-pf56-h9qf-rxq4/): Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/131/