Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 133 of 521.
- GHSA-gwfx-p7mr-f92v Missing Access Check in TYPO3 CMS
- GHSA-gw5w-5j7f-jmjj Unsound usages of `std::slice::from_raw_parts`
- GHSA-gvpp-6jrj-5pqc Zend-Form vulnerable to Cross-site Scripting
- GHSA-gv7f-5qqh-vxfx xous has unsound usages of `core::slice::from_raw_parts`
- GHSA-gp6m-fq6h-cjcx Magento LTS vulnerable to stored XSS in admin file form
- GHSA-gmx7-gr5q-85w5 magic-crypt uses insecure cryptographic algorithms
- GHSA-gmc6-fwg3-75m5 Mimekit has vulnerable dependency that can lead to denial of service
- GHSA-gm98-g2wf-7c68 amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance
- GHSA-gj55-2xf9-67rq HTML injection in JupyterLite leading to DOM Clobbering
- GHSA-gj48-w74w-8gvm Path Traversal in TYPO3 Core
- GHSA-gfvf-2f25-f34r Drupal Anonymous Open Redirect
- GHSA-gff2-p6vm-3p8g ZendFramework potential remote code execution in zend-mail via Sendmail adapter
- GHSA-gcfg-hmwx-wq5h Httpful is Missing Certificate Validation
- GHSA-gc5h-6jx9-q2qh eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
- GHSA-g9rv-6g56-65h8 Typo3 Security Misconfiguration in User Session Handling
- GHSA-g8w7-7vgg-x7xg CWA-2024-005: Stackoverflow in wasmd
- GHSA-g8pg-33v4-9r96 Thelia authentication bypass vulnerability
- GHSA-g8fc-vrcg-8vjg Constallation has pods exposed to peers in VPC
- GHSA-g84q-cq55-xwgp silverstripe/framework member disclosure in login form
- GHSA-g7hw-jh4p-75wr TYPO3 Cross-Site Scripting in Filelist Module
- GHSA-g776-759r-pf6x TYPO3 Broken Access Control in Import Module
- GHSA-g6f5-4w43-2x63 ScnSocialAuth Cross-site Scripting vulnerability in login redirect param
- GHSA-g5xx-c4hv-9ccc CometBFT's state syncing validator from malicious node may lead to a chain split
- GHSA-g5vj-wj9x-4jg9 symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension
- GHSA-g5p6-327m-3fxx Talos Linux ships runc vulnerable to the escape to the host attack
- GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration
- GHSA-g52p-86j5-xr8q ZendFramework Potential Cross-site Scripting in Development Environment Error View Script
- GHSA-g4xv-r3qw-v3q2 typo3 Information Disclosure Security Note
- GHSA-g4v6-69p6-q3p4 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
- GHSA-g4pf-3jvq-2gcw TYPO3 Remote Code Execution in third party library swiftmailer
- GHSA-g4m4-9q4c-mfw6 Fiona affected by CVE-2020-14152 related to madler-zlib
- GHSA-g4hp-pfvf-vm5w SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
- GHSA-g4c9-qfvw-fmr4 TYPO3 Cross-Site Scripting in Backend Modal Component
- GHSA-g49q-jw42-6x85 thelounge may publicly disclose of all usernames/idents via port 113
- GHSA-g46h-v2cc-6c94 Information Disclosure in TYPO3 CMS
- GHSA-g43w-98wp-m694 SilverStripe framework XML Quadratic Blowup Attack
- GHSA-fwfx-rrv8-crpf op_panic in the base runtime can force a panic in the runtime's containing thread
- GHSA-fvv5-h29g-f6w5 Impact A bug in permissions validation allows a user with the `ci:ReadAction` permission to skip read checks when copying an object.
- GHSA-frm9-7pm9-5rgc SilverStripe comments module includes version of jQuery vulnerable to Cross-site Scripting
- GHSA-fqpg-rq76-99pq Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx
- GHSA-fq4p-86hh-42v9 Zend-Diactoros URL Rewrite vulnerability
- GHSA-fpr5-jp2j-4q2f paillier-zk has ambiguous challenge derivation
- GHSA-fpgj-cr28-fvpx CWA-2024-006: wasmd non-deterministic module_query_safe query
- GHSA-fm76-w8jw-xf8m When creating a new plugin using the `git` source, the user-controlled value `req.body.name` is used to build the plugin directo
- GHSA-fh7v-q458-7vmw ibexa/http-cache affected by Breach with Varnish VCL
- GHSA-fh7r-58q4-6387 Zendframework URL Rewrite vulnerability
- GHSA-fgrx-4637-fcf5 fuel/core Crypt encryption compromised.
- GHSA-f9hr-7cfq-mjg2 TYPO3 Arbitrary Code Execution via File List Module
- GHSA-f95p-4cv5-8w8x linkme fails to ensure slice elements match the slice's declared type
- GHSA-f84q-mgj9-8jfc Drupal Content moderation Access bypass
- GHSA-f7qj-v3vp-4856 libafl has unsound usages of `core::slice::from_raw_parts_mut`
- GHSA-f7cq-5v43-8pwp Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop
- GHSA-f77q-r5qm-w4m8 sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic
- GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie
- GHSA-f75p-x5vm-83qp symfony/translation XML Entity Expansion vulnerability
- GHSA-f6mm-5fc7-3g3c goreleaser shows environment by default
- GHSA-f6jh-hvg2-9525 crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber)
- GHSA-f624-8hfq-5fh3 TYPO3 Information Disclosure of Installed Extensions
- GHSA-f5rr-9r84-wwqf Typo3 Broken Access Control in Import Module
- GHSA-f5pp-pmq8-gp46 Passbolt Api Retrieval of HTTP-only cookies
- GHSA-f57v-q966-7fh6 Monolog Header injection in NativeMailerHandler
- GHSA-f4fj-q6m4-cc52 ZendFramework vulnerable to XXE/XEE attacks
- GHSA-f43j-8hq4-2xj9 silverstripe/framework uploaded PHP script execution in assets
- GHSA-f3wp-xpv2-6vmg silverstripe/framework password encryption salt not updated
- GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling
- GHSA-f3q4-ggfp-jv34 Adyen APIs Library for Python timing attack vulnerability
- GHSA-cxww-7g56-2vh6 @actions/download-artifact has an Arbitrary File Write via artifact extraction
- GHSA-cxjf-x6jp-p7mc opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
- GHSA-cxf7-m5g2-v594 Zend-Mail remote code execution in zend-mail via Sendmail adapter
- GHSA-cx7h-h87r-jpgr The kstring integration in gix-attributes is unsound
- GHSA-cwgq-83w5-8jfq silverstripe/framework has possible denial of service attack vector when flushing
- GHSA-cvp8-5r8g-fhvq omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
- GHSA-cv5c-2qv5-w2m2 Passbolt Api Remote code execution
- GHSA-cv25-3pxr-4q7x Magento Open Source Security Advisory: Patch SUPEE-10975
- GHSA-crr3-h4m8-7f56 silverstripe/framework vulnerable to member disclosure in login form
- GHSA-crjg-w57m-rqqf DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks
- GHSA-cq96-9974-v8hm Dynamic Variable Evaluation in qiskit-ibm-runtime
- GHSA-cg8w-5jrc-675g Zend-HTTP URL Rewrite vulnerability
- GHSA-cg84-55jx-4237 eZ Platform Password reset vulnerability
- GHSA-cg4m-qjjp-7497 TYPO3 Cross-Site Scripting in link validator component
- GHSA-cfqx-f43m-vfh7 @saltcorn/server arbitrary file and directory listing when accessing build mobile app results
- GHSA-cc97-g92w-jm65 TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution
- GHSA-cc2w-ghc5-m5qr Laravel Risk of mass-assignment vulnerabilities
- GHSA-cc2j-92jq-wgjg eZ Publish Information disclosure in backend content tree menu
- GHSA-c9cp-9c75-9v8c containerd started with non-empty inheritable Linux process capabilities
- GHSA-c8v3-jhv9-4ppc Use-after-free when setting the locale
- GHSA-c7xh-gjv4-4jgv kcp's impersonation allows access to global administrative groups
- GHSA-c7rj-92xr-wprg Insecure Unserialize in TYPO3 Backend
- GHSA-c7p6-3c9c-f88q Information Disclosure in TYPO3 CMS
- GHSA-c636-cg5r-2498 Symfony XML Entity Expansion security vulnerability
- GHSA-c5mj-39cf-3pp5 TYPO3 Security Misconfiguration for Backend User Accounts
- GHSA-c4cm-r9fh-jgj9 commonground-api-common unexploitable privilege escalation in JWT authentication middleware
- GHSA-c4c3-j73v-634r silverstripe/framework has Cross-site Scripting vulnerability in page history comparison
- GHSA-9wwx-c723-vm8x eZ Platform REST API returns list of all SiteAccesses
- GHSA-9wv8-3h8h-x2wc doctrine/doctrine-module zero-valued authentication credentials vulnerability
- GHSA-9wrw-p9rm-r782 onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
- GHSA-9v78-h226-2rmq Zendframework potential security issue in login mechanism
- GHSA-9rx9-7fmh-gj3g TYPO3 Broken Access Control in Localization Handling
- GHSA-9q78-27f3-2jmh webp crate may expose memory contents when encoding an image
- GHSA-9phw-7h96-q3rv scheb/two-factor-bundle bypass two-factor authentication with remember-me option