Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 132 of 521.
- GHSA-p9mp-vq4v-v5m5 eZ Publish Legacy Passwordless login for LDAP users
- GHSA-p9fg-j6ww-953m FOSRestBundle issue with broken validation of JSONP callbacks
- GHSA-p84g-j2gh-83g3 TYPO3 possible cache poisoning on the homepage when anchors are used
- GHSA-p7mv-53f2-4cwj CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data
- GHSA-p72q-h37j-3hq7 dbt uses a SQLparse version with a high vulnerability
- GHSA-p62r-7637-3wwc Laravel Hijacked authentication cookies vulnerability
- GHSA-p5wf-cmr4-xrwr Permissive Regular Expression in tacquito
- GHSA-p5h2-vr99-xm99 silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`
- GHSA-p5c5-gmj4-g48f Cross-Site Scripting (XSS) vulnerability in typolinks
- GHSA-p4v8-jgcv-9g75 safe_pqc_kyber leaks parts of secret keys
- GHSA-p4m5-32pr-2hqr PyPop C extensions possible vulnerability: missing arguments and redundant null pointers
- GHSA-p2v5-xcqm-4fv6 silverstripe/taxonomy SQL Injection vulnerability
- GHSA-p2h4-7fp3-cmh8 TYPO3 Disclosure of Information about Installed Extensions
- GHSA-mxjf-hc9v-xgv2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting
- GHSA-mwvh-p3hx-x4gg Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
- GHSA-mvf6-3f2g-xfxf endroid/qr-code-bundle File Disclosure via logo_path query parameter
- GHSA-mqjc-x563-c9q8 silverstripe/framework CSV Excel Macro Injection
- GHSA-mqf5-275h-gf6r Silverstripe framework is vulnerable to XSS in install.php
- GHSA-mq6v-w35g-3c97 Local File Inclusion vulnerability in zmarkdown
- GHSA-mpqj-f4v3-334h Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter
- GHSA-mpcw-3j5p-p99x Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)
- GHSA-mmwx-rj87-vfgr DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources
- GHSA-mmcv-fvq8-r9x3 Symfony XML decoding attack vector through external entities
- GHSA-mhpx-3rv8-wrjm ZendFramework potential XML eXternal Entity injection vectors
- GHSA-mh4h-27gq-cxwj Drupal core Access bypass
- GHSA-mh3r-6cp5-hc2j Authentication Bypass in TYPO3 Frontend
- GHSA-mgfg-7533-7jf6 ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL
- GHSA-mg7h-9qfx-4r83 ZendFramework Potential Proxy Injection Vulnerabilities
- GHSA-mg4x-prh7-g4mx Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability
- GHSA-mf74-qq7w-6j7v Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images
- GHSA-mcfc-67vm-j568 Magento Cross-Site Scripting (XSS) vulnerability
- GHSA-mc39-h54g-pvw6 libdav1d-sys affected by dav1d AV1 decoder integer overflow
- GHSA-m9fv-whq2-6wmc Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
- GHSA-m99c-q26r-m7m7 Evmos vulnerable to unauthorized account creation with vesting module
- GHSA-m96r-7vqm-j95g Typo3 Information Disclosure in User Authentication
- GHSA-m8v7-x398-pxrf Silverstripe XSS in CMS Edit Page
- GHSA-m7hr-j867-3f34 ZendFramework has potential Cross-site Scripting vector in multiple view helpers
- GHSA-m5q3-mvcr-gc5m silverstripe/framework BackURL validation bypass with malformed URLs
- GHSA-m56h-5xx3-2jc2 Prototype pollution in jsii.configureCategories
- GHSA-m4gq-x24j-jpmf Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify
- GHSA-m3rh-cvr5-x6q4 CosmWasm wasmd has large address count in ValidateBasic
- GHSA-m2hp-5x78-74mg Insecure Unserialize Vulnerability in FLOW3
- GHSA-m2hh-2m46-x6j5 silverstripe/framework may disclose database credentials during connection failure
- GHSA-jwvj-pwww-3mj5 laravel framework Unexpected database bindings via requests
- GHSA-jrpw-8884-2747 eZ Platform Bundled jQuery affected by CVE-2019-11358
- GHSA-jqr8-q455-xx45 TYPO3 Brute Force Protection Bypass in backend login
- GHSA-jqr7-5h7r-ch8p Shopware Non-Persistent XSS in the Frontend
- GHSA-jqp8-v74p-g8px Silverstripe XSS in Director::force_redirect()
- GHSA-jq9q-6p42-qpr7 Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS
- GHSA-jq87-2wxp-8349 ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`
- GHSA-jp37-5qhw-mffw Sharks has a Bias of Polynomial Coefficients in Secret Sharing
- GHSA-jmmp-vh96-78rm Zend-Feed URL Rewrite vulnerability
- GHSA-jmh9-6rjq-gjh9 Vulnerable embedded jQuery Version
- GHSA-jm3v-qxmh-hxwv Scrapy's redirects ignoring scheme-specific proxy settings
- GHSA-jjx7-8462-w4m4 Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
- GHSA-jh2j-j4j9-crg3 opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
- GHSA-jf8c-36vw-98x4 Drupal core Remote Code Execution
- GHSA-jcmq-5rrv-j2g4 PowerShell is subject to remote code execution vulnerability
- GHSA-j982-5jv7-v43r Silverstripe Form field validation message XSS vulnerability
- GHSA-j86x-pjmr-9m6w SQL Injection in TYPO3 Frontend Login
- GHSA-j86v-2vjr-fg8f Etcd Gateway TLS endpoint validation only confirms TCP reachability
- GHSA-j68w-pg49-f6vx Symfony XML decoding attack vector through external entities
- GHSA-j66p-fvp2-fxhj Drupal core Arbitrary PHP code execution
- GHSA-j5vm-7qcc-2wwg Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output
- GHSA-j543-vg33-g6vj ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor`
- GHSA-j496-crgh-34mx ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks
- GHSA-j3px-q95c-9683 Denial of service because of stack overflow with malicious decompression input
- GHSA-hxr6-2p24-hf98 Traefik affected by CVE-2024-53259
- GHSA-hxhc-wmg8-xrqf namshi/jose insecure JSON Web Signatures (JWS)
- GHSA-hx5q-v6pj-533r SAML authentication bypass due to missing validation on unsigned SAML messages
- GHSA-hx53-jchx-cr52 Symfony2 improper IP based access control
- GHSA-hx3m-959f-v849 ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
- GHSA-hww5-6x85-mc24 Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
- GHSA-hvp5-5x4f-33fq JADX file override vulnerability
- GHSA-hvm9-wc8j-mgrc TShock Security Escalation Exploit
- GHSA-hvh4-5qr6-3v7r Observable Timing Discrepancy in pypqc
- GHSA-hvgw-gg3p-295j Read private customer data reclaiming carts in Klaviyo Magento
- GHSA-hqmp-g7ph-x543 TunnelVision - decloaking VPNs using DHCP
- GHSA-hq76-662x-7mw4 Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
- GHSA-hq4p-5mpr-jj9m Silverstripe XSS in dev/build returnURL Parameter
- GHSA-hq37-rfjc-mr8h Cross-Site Scripting (XSS) in TYPO3 Backend
- GHSA-hjx6-f647-mvf9 Invenio-Communities has a Cross-Site Scripting (XSS) vulnerability in React components
- GHSA-hjx5-v9xg-7h25 TYPO3 Denial of Service in Frontend Record Registration
- GHSA-hjqq-29pw-96wj Nervos CKB node panics when processing a block which parent timestamp is too new
- GHSA-hhvj-mcrx-3vcf silverstripe/framework has Cross-site Scripting vulnerability in page name
- GHSA-hh95-5xm5-v8v7 TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling
- GHSA-hg58-rf2h-6rr7 CometBFT is unstability during blocksync when syncing from malicious peer
- GHSA-hg35-vqp3-fv39 ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings
- GHSA-hfpp-2vhw-qq43 eZ Platform Admin UI Password reset vulnerability
- GHSA-h97c-qp24-439v Insecure State Generation in laravel/socialite
- GHSA-h934-f4m4-wc8x Typo3 Information Disclosure in Page Tree
- GHSA-h7h7-6mx3-r89v Unsound usages of `Vec::from_raw_parts`
- GHSA-h6xm-c6r4-vmwf Unsound usages of `u8` type casting in spl-token-swap
- GHSA-h6mp-mc7g-mg49 scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token
- GHSA-h63c-xvpf-264j ADOdb SQL injection vulnerability
- GHSA-h533-5v22-8vcp firebase/php-jwt: "None" Algorithm treated as valid on tokens
- GHSA-h4gh-qq45-vh27 pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
- GHSA-h4c3-5275-vrmg Nervos CKB Pool does not remove the conflicting transactions from the statistics
- GHSA-gxxj-g9v8-w28p Drupal core Arbitrary PHP code execution
- GHSA-gwpm-pm6x-h7rj ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`