# Vulnerabilities published in 2024


- [GHSA-p9mp-vq4v-v5m5](https://insights.sbomify.com/GHSA-p9mp-vq4v-v5m5/): eZ Publish Legacy Passwordless login for LDAP users (not scored)
- [GHSA-p9fg-j6ww-953m](https://insights.sbomify.com/GHSA-p9fg-j6ww-953m/): FOSRestBundle issue with broken validation of JSONP callbacks (not scored)
- [GHSA-p84g-j2gh-83g3](https://insights.sbomify.com/GHSA-p84g-j2gh-83g3/): TYPO3 possible cache poisoning on the homepage when anchors are used (not scored)
- [GHSA-p7mv-53f2-4cwj](https://insights.sbomify.com/GHSA-p7mv-53f2-4cwj/): CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data (not scored)
- [GHSA-p72q-h37j-3hq7](https://insights.sbomify.com/GHSA-p72q-h37j-3hq7/): dbt uses a SQLparse version with a high vulnerability (not scored)
- [GHSA-p62r-7637-3wwc](https://insights.sbomify.com/GHSA-p62r-7637-3wwc/): Laravel Hijacked authentication cookies vulnerability (not scored)
- [GHSA-p5wf-cmr4-xrwr](https://insights.sbomify.com/GHSA-p5wf-cmr4-xrwr/): Permissive Regular Expression in tacquito (not scored)
- [GHSA-p5h2-vr99-xm99](https://insights.sbomify.com/GHSA-p5h2-vr99-xm99/): silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` (not scored)
- [GHSA-p5c5-gmj4-g48f](https://insights.sbomify.com/GHSA-p5c5-gmj4-g48f/): Cross-Site Scripting (XSS) vulnerability in typolinks (not scored)
- [GHSA-p4v8-jgcv-9g75](https://insights.sbomify.com/GHSA-p4v8-jgcv-9g75/): safe_pqc_kyber leaks parts of secret keys (not scored)
- [GHSA-p4m5-32pr-2hqr](https://insights.sbomify.com/GHSA-p4m5-32pr-2hqr/): PyPop C extensions possible vulnerability: missing arguments and redundant null pointers (not scored)
- [GHSA-p2v5-xcqm-4fv6](https://insights.sbomify.com/GHSA-p2v5-xcqm-4fv6/): silverstripe/taxonomy SQL Injection vulnerability (not scored)
- [GHSA-p2h4-7fp3-cmh8](https://insights.sbomify.com/GHSA-p2h4-7fp3-cmh8/): TYPO3 Disclosure of Information about Installed Extensions (not scored)
- [GHSA-mxjf-hc9v-xgv2](https://insights.sbomify.com/GHSA-mxjf-hc9v-xgv2/): ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting (not scored)
- [GHSA-mwvh-p3hx-x4gg](https://insights.sbomify.com/GHSA-mwvh-p3hx-x4gg/): Ibexa Kernel's files with blacklisted extensions can be still saved to drafts (not scored)
- [GHSA-mvf6-3f2g-xfxf](https://insights.sbomify.com/GHSA-mvf6-3f2g-xfxf/): endroid/qr-code-bundle File Disclosure via logo_path query parameter (not scored)
- [GHSA-mqjc-x563-c9q8](https://insights.sbomify.com/GHSA-mqjc-x563-c9q8/): silverstripe/framework CSV Excel Macro Injection (not scored)
- [GHSA-mqf5-275h-gf6r](https://insights.sbomify.com/GHSA-mqf5-275h-gf6r/): Silverstripe framework is vulnerable to XSS in install.php (not scored)
- [GHSA-mq6v-w35g-3c97](https://insights.sbomify.com/GHSA-mq6v-w35g-3c97/): Local File Inclusion vulnerability in zmarkdown (not scored)
- [GHSA-mpqj-f4v3-334h](https://insights.sbomify.com/GHSA-mpqj-f4v3-334h/): Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter (not scored)
- [GHSA-mpcw-3j5p-p99x](https://insights.sbomify.com/GHSA-mpcw-3j5p-p99x/): Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE) (not scored)
- [GHSA-mmwx-rj87-vfgr](https://insights.sbomify.com/GHSA-mmwx-rj87-vfgr/): DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources (not scored)
- [GHSA-mmcv-fvq8-r9x3](https://insights.sbomify.com/GHSA-mmcv-fvq8-r9x3/): Symfony XML decoding attack vector through external entities (not scored)
- [GHSA-mhpx-3rv8-wrjm](https://insights.sbomify.com/GHSA-mhpx-3rv8-wrjm/): ZendFramework potential XML eXternal Entity injection vectors (not scored)
- [GHSA-mh4h-27gq-cxwj](https://insights.sbomify.com/GHSA-mh4h-27gq-cxwj/): Drupal core Access bypass (not scored)
- [GHSA-mh3r-6cp5-hc2j](https://insights.sbomify.com/GHSA-mh3r-6cp5-hc2j/): Authentication Bypass in TYPO3 Frontend (not scored)
- [GHSA-mgfg-7533-7jf6](https://insights.sbomify.com/GHSA-mgfg-7533-7jf6/): ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL (not scored)
- [GHSA-mg7h-9qfx-4r83](https://insights.sbomify.com/GHSA-mg7h-9qfx-4r83/): ZendFramework Potential Proxy Injection Vulnerabilities (not scored)
- [GHSA-mg4x-prh7-g4mx](https://insights.sbomify.com/GHSA-mg4x-prh7-g4mx/): Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability (not scored)
- [GHSA-mf74-qq7w-6j7v](https://insights.sbomify.com/GHSA-mf74-qq7w-6j7v/): Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images (not scored)
- [GHSA-mcfc-67vm-j568](https://insights.sbomify.com/GHSA-mcfc-67vm-j568/): Magento Cross-Site Scripting (XSS) vulnerability (not scored)
- [GHSA-mc39-h54g-pvw6](https://insights.sbomify.com/GHSA-mc39-h54g-pvw6/): libdav1d-sys affected by dav1d AV1 decoder integer overflow (not scored)
- [GHSA-m9fv-whq2-6wmc](https://insights.sbomify.com/GHSA-m9fv-whq2-6wmc/): Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar (not scored)
- [GHSA-m99c-q26r-m7m7](https://insights.sbomify.com/GHSA-m99c-q26r-m7m7/): Evmos vulnerable to unauthorized account creation with vesting module (not scored)
- [GHSA-m96r-7vqm-j95g](https://insights.sbomify.com/GHSA-m96r-7vqm-j95g/): Typo3 Information Disclosure in User Authentication (not scored)
- [GHSA-m8v7-x398-pxrf](https://insights.sbomify.com/GHSA-m8v7-x398-pxrf/): Silverstripe XSS in CMS Edit Page (not scored)
- [GHSA-m7hr-j867-3f34](https://insights.sbomify.com/GHSA-m7hr-j867-3f34/): ZendFramework has potential Cross-site Scripting vector in multiple view helpers (not scored)
- [GHSA-m5q3-mvcr-gc5m](https://insights.sbomify.com/GHSA-m5q3-mvcr-gc5m/): silverstripe/framework BackURL validation bypass with malformed URLs (not scored)
- [GHSA-m56h-5xx3-2jc2](https://insights.sbomify.com/GHSA-m56h-5xx3-2jc2/): Prototype pollution in jsii.configureCategories (not scored)
- [GHSA-m4gq-x24j-jpmf](https://insights.sbomify.com/GHSA-m4gq-x24j-jpmf/): Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify (not scored)
- [GHSA-m3rh-cvr5-x6q4](https://insights.sbomify.com/GHSA-m3rh-cvr5-x6q4/): CosmWasm wasmd has large address count in ValidateBasic (not scored)
- [GHSA-m2hp-5x78-74mg](https://insights.sbomify.com/GHSA-m2hp-5x78-74mg/): Insecure Unserialize Vulnerability in FLOW3 (not scored)
- [GHSA-m2hh-2m46-x6j5](https://insights.sbomify.com/GHSA-m2hh-2m46-x6j5/): silverstripe/framework may disclose database credentials during connection failure (not scored)
- [GHSA-jwvj-pwww-3mj5](https://insights.sbomify.com/GHSA-jwvj-pwww-3mj5/): laravel framework Unexpected database bindings via requests (not scored)
- [GHSA-jrpw-8884-2747](https://insights.sbomify.com/GHSA-jrpw-8884-2747/): eZ Platform Bundled jQuery affected by CVE-2019-11358 (not scored)
- [GHSA-jqr8-q455-xx45](https://insights.sbomify.com/GHSA-jqr8-q455-xx45/): TYPO3 Brute Force Protection Bypass in backend login (not scored)
- [GHSA-jqr7-5h7r-ch8p](https://insights.sbomify.com/GHSA-jqr7-5h7r-ch8p/): Shopware Non-Persistent XSS in the Frontend (not scored)
- [GHSA-jqp8-v74p-g8px](https://insights.sbomify.com/GHSA-jqp8-v74p-g8px/): Silverstripe XSS in Director::force_redirect() (not scored)
- [GHSA-jq9q-6p42-qpr7](https://insights.sbomify.com/GHSA-jq9q-6p42-qpr7/): Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS (not scored)
- [GHSA-jq87-2wxp-8349](https://insights.sbomify.com/GHSA-jq87-2wxp-8349/): ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` (not scored)
- [GHSA-jp37-5qhw-mffw](https://insights.sbomify.com/GHSA-jp37-5qhw-mffw/): Sharks has a Bias of Polynomial Coefficients in Secret Sharing (not scored)
- [GHSA-jmmp-vh96-78rm](https://insights.sbomify.com/GHSA-jmmp-vh96-78rm/): Zend-Feed URL Rewrite vulnerability (not scored)
- [GHSA-jmh9-6rjq-gjh9](https://insights.sbomify.com/GHSA-jmh9-6rjq-gjh9/): Vulnerable embedded jQuery Version (not scored)
- [GHSA-jm3v-qxmh-hxwv](https://insights.sbomify.com/GHSA-jm3v-qxmh-hxwv/): Scrapy's redirects ignoring scheme-specific proxy settings (not scored)
- [GHSA-jjx7-8462-w4m4](https://insights.sbomify.com/GHSA-jjx7-8462-w4m4/): Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution (not scored)
- [GHSA-jh2j-j4j9-crg3](https://insights.sbomify.com/GHSA-jh2j-j4j9-crg3/): opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 (not scored)
- [GHSA-jf8c-36vw-98x4](https://insights.sbomify.com/GHSA-jf8c-36vw-98x4/): Drupal core Remote Code Execution (not scored)
- [GHSA-jcmq-5rrv-j2g4](https://insights.sbomify.com/GHSA-jcmq-5rrv-j2g4/): PowerShell is subject to remote code execution vulnerability (not scored)
- [GHSA-j982-5jv7-v43r](https://insights.sbomify.com/GHSA-j982-5jv7-v43r/): Silverstripe Form field validation message XSS vulnerability (not scored)
- [GHSA-j86x-pjmr-9m6w](https://insights.sbomify.com/GHSA-j86x-pjmr-9m6w/): SQL Injection in TYPO3 Frontend Login (not scored)
- [GHSA-j86v-2vjr-fg8f](https://insights.sbomify.com/GHSA-j86v-2vjr-fg8f/): Etcd Gateway TLS endpoint validation only confirms TCP reachability (not scored)
- [GHSA-j68w-pg49-f6vx](https://insights.sbomify.com/GHSA-j68w-pg49-f6vx/): Symfony XML decoding attack vector through external entities (not scored)
- [GHSA-j66p-fvp2-fxhj](https://insights.sbomify.com/GHSA-j66p-fvp2-fxhj/): Drupal core Arbitrary PHP code execution (not scored)
- [GHSA-j5vm-7qcc-2wwg](https://insights.sbomify.com/GHSA-j5vm-7qcc-2wwg/): Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output (not scored)
- [GHSA-j543-vg33-g6vj](https://insights.sbomify.com/GHSA-j543-vg33-g6vj/): ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` (not scored)
- [GHSA-j496-crgh-34mx](https://insights.sbomify.com/GHSA-j496-crgh-34mx/): ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks (not scored)
- [GHSA-j3px-q95c-9683](https://insights.sbomify.com/GHSA-j3px-q95c-9683/): Denial of service because of stack overflow with malicious decompression input (not scored)
- [GHSA-hxr6-2p24-hf98](https://insights.sbomify.com/GHSA-hxr6-2p24-hf98/): Traefik affected by CVE-2024-53259 (not scored)
- [GHSA-hxhc-wmg8-xrqf](https://insights.sbomify.com/GHSA-hxhc-wmg8-xrqf/): namshi/jose insecure JSON Web Signatures (JWS) (not scored)
- [GHSA-hx5q-v6pj-533r](https://insights.sbomify.com/GHSA-hx5q-v6pj-533r/): SAML authentication bypass due to missing validation on unsigned SAML messages (not scored)
- [GHSA-hx53-jchx-cr52](https://insights.sbomify.com/GHSA-hx53-jchx-cr52/): Symfony2 improper IP based access control (not scored)
- [GHSA-hx3m-959f-v849](https://insights.sbomify.com/GHSA-hx3m-959f-v849/): ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()` (not scored)
- [GHSA-hww5-6x85-mc24](https://insights.sbomify.com/GHSA-hww5-6x85-mc24/): Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API (not scored)
- [GHSA-hvp5-5x4f-33fq](https://insights.sbomify.com/GHSA-hvp5-5x4f-33fq/): JADX file override vulnerability (not scored)
- [GHSA-hvm9-wc8j-mgrc](https://insights.sbomify.com/GHSA-hvm9-wc8j-mgrc/): TShock Security Escalation Exploit (not scored)
- [GHSA-hvh4-5qr6-3v7r](https://insights.sbomify.com/GHSA-hvh4-5qr6-3v7r/): Observable Timing Discrepancy in pypqc (not scored)
- [GHSA-hvgw-gg3p-295j](https://insights.sbomify.com/GHSA-hvgw-gg3p-295j/): Read private customer data reclaiming carts in Klaviyo Magento (not scored)
- [GHSA-hqmp-g7ph-x543](https://insights.sbomify.com/GHSA-hqmp-g7ph-x543/): TunnelVision - decloaking VPNs using DHCP (not scored)
- [GHSA-hq76-662x-7mw4](https://insights.sbomify.com/GHSA-hq76-662x-7mw4/): Pimcore includes vulnerable PHPOffice/PhpSpreadsheet (not scored)
- [GHSA-hq4p-5mpr-jj9m](https://insights.sbomify.com/GHSA-hq4p-5mpr-jj9m/): Silverstripe XSS in dev/build returnURL Parameter (not scored)
- [GHSA-hq37-rfjc-mr8h](https://insights.sbomify.com/GHSA-hq37-rfjc-mr8h/): Cross-Site Scripting (XSS) in TYPO3 Backend (not scored)
- [GHSA-hjx6-f647-mvf9](https://insights.sbomify.com/GHSA-hjx6-f647-mvf9/): Invenio-Communities has a Cross-Site Scripting (XSS) vulnerability in React components (not scored)
- [GHSA-hjx5-v9xg-7h25](https://insights.sbomify.com/GHSA-hjx5-v9xg-7h25/): TYPO3 Denial of Service in Frontend Record Registration (not scored)
- [GHSA-hjqq-29pw-96wj](https://insights.sbomify.com/GHSA-hjqq-29pw-96wj/): Nervos CKB node panics when processing a block which parent timestamp is too new (not scored)
- [GHSA-hhvj-mcrx-3vcf](https://insights.sbomify.com/GHSA-hhvj-mcrx-3vcf/): silverstripe/framework has Cross-site Scripting vulnerability in page name (not scored)
- [GHSA-hh95-5xm5-v8v7](https://insights.sbomify.com/GHSA-hh95-5xm5-v8v7/): TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling (not scored)
- [GHSA-hg58-rf2h-6rr7](https://insights.sbomify.com/GHSA-hg58-rf2h-6rr7/): CometBFT is unstability during blocksync when syncing from malicious peer (not scored)
- [GHSA-hg35-vqp3-fv39](https://insights.sbomify.com/GHSA-hg35-vqp3-fv39/): ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings (not scored)
- [GHSA-hfpp-2vhw-qq43](https://insights.sbomify.com/GHSA-hfpp-2vhw-qq43/): eZ Platform Admin UI Password reset vulnerability (not scored)
- [GHSA-h97c-qp24-439v](https://insights.sbomify.com/GHSA-h97c-qp24-439v/): Insecure State Generation in laravel/socialite (not scored)
- [GHSA-h934-f4m4-wc8x](https://insights.sbomify.com/GHSA-h934-f4m4-wc8x/): Typo3 Information Disclosure in Page Tree (not scored)
- [GHSA-h7h7-6mx3-r89v](https://insights.sbomify.com/GHSA-h7h7-6mx3-r89v/): Unsound usages of `Vec::from_raw_parts` (not scored)
- [GHSA-h6xm-c6r4-vmwf](https://insights.sbomify.com/GHSA-h6xm-c6r4-vmwf/): Unsound usages of `u8` type casting in spl-token-swap (not scored)
- [GHSA-h6mp-mc7g-mg49](https://insights.sbomify.com/GHSA-h6mp-mc7g-mg49/): scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token (not scored)
- [GHSA-h63c-xvpf-264j](https://insights.sbomify.com/GHSA-h63c-xvpf-264j/): ADOdb SQL injection vulnerability (not scored)
- [GHSA-h533-5v22-8vcp](https://insights.sbomify.com/GHSA-h533-5v22-8vcp/): firebase/php-jwt: "None" Algorithm treated as valid on tokens (not scored)
- [GHSA-h4gh-qq45-vh27](https://insights.sbomify.com/GHSA-h4gh-qq45-vh27/): pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels (not scored)
- [GHSA-h4c3-5275-vrmg](https://insights.sbomify.com/GHSA-h4c3-5275-vrmg/): Nervos CKB Pool does not remove the conflicting transactions from the statistics (not scored)
- [GHSA-gxxj-g9v8-w28p](https://insights.sbomify.com/GHSA-gxxj-g9v8-w28p/): Drupal core Arbitrary PHP code execution (not scored)
- [GHSA-gwpm-pm6x-h7rj](https://insights.sbomify.com/GHSA-gwpm-pm6x-h7rj/): ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/132/