# Vulnerabilities published in 2024


- [GHSA-gwfx-p7mr-f92v](https://insights.sbomify.com/GHSA-gwfx-p7mr-f92v/): Missing Access Check in TYPO3 CMS (not scored)
- [GHSA-gw5w-5j7f-jmjj](https://insights.sbomify.com/GHSA-gw5w-5j7f-jmjj/): Unsound usages of `std::slice::from_raw_parts` (not scored)
- [GHSA-gvpp-6jrj-5pqc](https://insights.sbomify.com/GHSA-gvpp-6jrj-5pqc/): Zend-Form vulnerable to Cross-site Scripting (not scored)
- [GHSA-gv7f-5qqh-vxfx](https://insights.sbomify.com/GHSA-gv7f-5qqh-vxfx/): xous has unsound usages of `core::slice::from_raw_parts` (not scored)
- [GHSA-gp6m-fq6h-cjcx](https://insights.sbomify.com/GHSA-gp6m-fq6h-cjcx/): Magento LTS vulnerable to stored XSS in admin file form (not scored)
- [GHSA-gmx7-gr5q-85w5](https://insights.sbomify.com/GHSA-gmx7-gr5q-85w5/): magic-crypt uses insecure cryptographic algorithms (not scored)
- [GHSA-gmc6-fwg3-75m5](https://insights.sbomify.com/GHSA-gmc6-fwg3-75m5/): Mimekit has vulnerable dependency that can lead to denial of service (not scored)
- [GHSA-gm98-g2wf-7c68](https://insights.sbomify.com/GHSA-gm98-g2wf-7c68/): amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance (not scored)
- [GHSA-gj55-2xf9-67rq](https://insights.sbomify.com/GHSA-gj55-2xf9-67rq/): HTML injection in JupyterLite leading to DOM Clobbering (not scored)
- [GHSA-gj48-w74w-8gvm](https://insights.sbomify.com/GHSA-gj48-w74w-8gvm/): Path Traversal in TYPO3 Core (not scored)
- [GHSA-gfvf-2f25-f34r](https://insights.sbomify.com/GHSA-gfvf-2f25-f34r/): Drupal Anonymous Open Redirect (not scored)
- [GHSA-gff2-p6vm-3p8g](https://insights.sbomify.com/GHSA-gff2-p6vm-3p8g/): ZendFramework potential remote code execution in zend-mail via Sendmail adapter (not scored)
- [GHSA-gcfg-hmwx-wq5h](https://insights.sbomify.com/GHSA-gcfg-hmwx-wq5h/): Httpful is Missing Certificate Validation (not scored)
- [GHSA-gc5h-6jx9-q2qh](https://insights.sbomify.com/GHSA-gc5h-6jx9-q2qh/): eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget (not scored)
- [GHSA-g9rv-6g56-65h8](https://insights.sbomify.com/GHSA-g9rv-6g56-65h8/): Typo3 Security Misconfiguration in User Session Handling (not scored)
- [GHSA-g8w7-7vgg-x7xg](https://insights.sbomify.com/GHSA-g8w7-7vgg-x7xg/): CWA-2024-005: Stackoverflow in wasmd (not scored)
- [GHSA-g8pg-33v4-9r96](https://insights.sbomify.com/GHSA-g8pg-33v4-9r96/): Thelia authentication bypass vulnerability (not scored)
- [GHSA-g8fc-vrcg-8vjg](https://insights.sbomify.com/GHSA-g8fc-vrcg-8vjg/): Constallation has pods exposed to peers in VPC (not scored)
- [GHSA-g84q-cq55-xwgp](https://insights.sbomify.com/GHSA-g84q-cq55-xwgp/): silverstripe/framework member disclosure in login form (not scored)
- [GHSA-g7hw-jh4p-75wr](https://insights.sbomify.com/GHSA-g7hw-jh4p-75wr/): TYPO3 Cross-Site Scripting in Filelist Module (not scored)
- [GHSA-g776-759r-pf6x](https://insights.sbomify.com/GHSA-g776-759r-pf6x/): TYPO3 Broken Access Control in Import Module (not scored)
- [GHSA-g6f5-4w43-2x63](https://insights.sbomify.com/GHSA-g6f5-4w43-2x63/): ScnSocialAuth Cross-site Scripting vulnerability in login redirect param (not scored)
- [GHSA-g5xx-c4hv-9ccc](https://insights.sbomify.com/GHSA-g5xx-c4hv-9ccc/): CometBFT's state syncing validator from malicious node may lead to a chain split (not scored)
- [GHSA-g5vj-wj9x-4jg9](https://insights.sbomify.com/GHSA-g5vj-wj9x-4jg9/): symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension (not scored)
- [GHSA-g5p6-327m-3fxx](https://insights.sbomify.com/GHSA-g5p6-327m-3fxx/): Talos Linux ships runc vulnerable to the escape to the host attack (not scored)
- [GHSA-g585-crjf-vhwq](https://insights.sbomify.com/GHSA-g585-crjf-vhwq/): TYPO3 Denial of Service in Frontend Record Registration (not scored)
- [GHSA-g52p-86j5-xr8q](https://insights.sbomify.com/GHSA-g52p-86j5-xr8q/): ZendFramework Potential Cross-site Scripting in Development Environment Error View Script (not scored)
- [GHSA-g4xv-r3qw-v3q2](https://insights.sbomify.com/GHSA-g4xv-r3qw-v3q2/): typo3 Information Disclosure Security Note (not scored)
- [GHSA-g4v6-69p6-q3p4](https://insights.sbomify.com/GHSA-g4v6-69p6-q3p4/): WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM (not scored)
- [GHSA-g4pf-3jvq-2gcw](https://insights.sbomify.com/GHSA-g4pf-3jvq-2gcw/): TYPO3 Remote Code Execution in third party library swiftmailer (not scored)
- [GHSA-g4m4-9q4c-mfw6](https://insights.sbomify.com/GHSA-g4m4-9q4c-mfw6/): Fiona affected by CVE-2020-14152 related to madler-zlib (not scored)
- [GHSA-g4hp-pfvf-vm5w](https://insights.sbomify.com/GHSA-g4hp-pfvf-vm5w/): SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation (not scored)
- [GHSA-g4c9-qfvw-fmr4](https://insights.sbomify.com/GHSA-g4c9-qfvw-fmr4/): TYPO3 Cross-Site Scripting in Backend Modal Component (not scored)
- [GHSA-g49q-jw42-6x85](https://insights.sbomify.com/GHSA-g49q-jw42-6x85/): thelounge may publicly disclose of all usernames/idents via port 113 (not scored)
- [GHSA-g46h-v2cc-6c94](https://insights.sbomify.com/GHSA-g46h-v2cc-6c94/): Information Disclosure in TYPO3 CMS (not scored)
- [GHSA-g43w-98wp-m694](https://insights.sbomify.com/GHSA-g43w-98wp-m694/): SilverStripe framework XML Quadratic Blowup Attack (not scored)
- [GHSA-fwfx-rrv8-crpf](https://insights.sbomify.com/GHSA-fwfx-rrv8-crpf/): op_panic in the base runtime can force a panic in the runtime's containing thread (not scored)
- [GHSA-fvv5-h29g-f6w5](https://insights.sbomify.com/GHSA-fvv5-h29g-f6w5/): Impact A bug in permissions validation allows a user with the `ci:ReadAction` permission to skip read checks when copying an object. (not scored)
- [GHSA-frm9-7pm9-5rgc](https://insights.sbomify.com/GHSA-frm9-7pm9-5rgc/): SilverStripe comments module includes version of jQuery vulnerable to Cross-site Scripting (not scored)
- [GHSA-fqpg-rq76-99pq](https://insights.sbomify.com/GHSA-fqpg-rq76-99pq/): Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx (not scored)
- [GHSA-fq4p-86hh-42v9](https://insights.sbomify.com/GHSA-fq4p-86hh-42v9/): Zend-Diactoros URL Rewrite vulnerability (not scored)
- [GHSA-fpr5-jp2j-4q2f](https://insights.sbomify.com/GHSA-fpr5-jp2j-4q2f/): paillier-zk has ambiguous challenge derivation (not scored)
- [GHSA-fpgj-cr28-fvpx](https://insights.sbomify.com/GHSA-fpgj-cr28-fvpx/): CWA-2024-006: wasmd non-deterministic module_query_safe query (not scored)
- [GHSA-fm76-w8jw-xf8m](https://insights.sbomify.com/GHSA-fm76-w8jw-xf8m/): When creating a new plugin using the `git` source, the user-controlled value `req.body.name` is used to build the plugin directo (not scored)
- [GHSA-fh7v-q458-7vmw](https://insights.sbomify.com/GHSA-fh7v-q458-7vmw/): ibexa/http-cache affected by Breach with Varnish VCL (not scored)
- [GHSA-fh7r-58q4-6387](https://insights.sbomify.com/GHSA-fh7r-58q4-6387/): Zendframework URL Rewrite vulnerability (not scored)
- [GHSA-fgrx-4637-fcf5](https://insights.sbomify.com/GHSA-fgrx-4637-fcf5/): fuel/core Crypt encryption compromised. (not scored)
- [GHSA-f9hr-7cfq-mjg2](https://insights.sbomify.com/GHSA-f9hr-7cfq-mjg2/): TYPO3 Arbitrary Code Execution via File List Module (not scored)
- [GHSA-f95p-4cv5-8w8x](https://insights.sbomify.com/GHSA-f95p-4cv5-8w8x/): linkme fails to ensure slice elements match the slice's declared type (not scored)
- [GHSA-f84q-mgj9-8jfc](https://insights.sbomify.com/GHSA-f84q-mgj9-8jfc/): Drupal Content moderation Access bypass (not scored)
- [GHSA-f7qj-v3vp-4856](https://insights.sbomify.com/GHSA-f7qj-v3vp-4856/): libafl has unsound usages of `core::slice::from_raw_parts_mut` (not scored)
- [GHSA-f7cq-5v43-8pwp](https://insights.sbomify.com/GHSA-f7cq-5v43-8pwp/): Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop (not scored)
- [GHSA-f77q-r5qm-w4m8](https://insights.sbomify.com/GHSA-f77q-r5qm-w4m8/): sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic (not scored)
- [GHSA-f777-f784-36gm](https://insights.sbomify.com/GHSA-f777-f784-36gm/): TYPO3 Security Misconfiguration in Install Tool Cookie (not scored)
- [GHSA-f75p-x5vm-83qp](https://insights.sbomify.com/GHSA-f75p-x5vm-83qp/): symfony/translation XML Entity Expansion vulnerability (not scored)
- [GHSA-f6mm-5fc7-3g3c](https://insights.sbomify.com/GHSA-f6mm-5fc7-3g3c/): goreleaser shows environment by default (not scored)
- [GHSA-f6jh-hvg2-9525](https://insights.sbomify.com/GHSA-f6jh-hvg2-9525/): crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber) (not scored)
- [GHSA-f624-8hfq-5fh3](https://insights.sbomify.com/GHSA-f624-8hfq-5fh3/): TYPO3 Information Disclosure of Installed Extensions (not scored)
- [GHSA-f5rr-9r84-wwqf](https://insights.sbomify.com/GHSA-f5rr-9r84-wwqf/): Typo3 Broken Access Control in Import Module (not scored)
- [GHSA-f5pp-pmq8-gp46](https://insights.sbomify.com/GHSA-f5pp-pmq8-gp46/): Passbolt Api Retrieval of HTTP-only cookies (not scored)
- [GHSA-f57v-q966-7fh6](https://insights.sbomify.com/GHSA-f57v-q966-7fh6/): Monolog Header injection in NativeMailerHandler (not scored)
- [GHSA-f4fj-q6m4-cc52](https://insights.sbomify.com/GHSA-f4fj-q6m4-cc52/): ZendFramework vulnerable to XXE/XEE attacks (not scored)
- [GHSA-f43j-8hq4-2xj9](https://insights.sbomify.com/GHSA-f43j-8hq4-2xj9/): silverstripe/framework uploaded PHP script execution in assets (not scored)
- [GHSA-f3wp-xpv2-6vmg](https://insights.sbomify.com/GHSA-f3wp-xpv2-6vmg/): silverstripe/framework password encryption salt not updated (not scored)
- [GHSA-f3wf-q4fj-3gxf](https://insights.sbomify.com/GHSA-f3wf-q4fj-3gxf/): TYPO3 Denial of Service in Online Media Asset Handling (not scored)
- [GHSA-f3q4-ggfp-jv34](https://insights.sbomify.com/GHSA-f3q4-ggfp-jv34/): Adyen APIs Library for Python timing attack vulnerability (not scored)
- [GHSA-cxww-7g56-2vh6](https://insights.sbomify.com/GHSA-cxww-7g56-2vh6/): @actions/download-artifact has an Arbitrary File Write via artifact extraction (not scored)
- [GHSA-cxjf-x6jp-p7mc](https://insights.sbomify.com/GHSA-cxjf-x6jp-p7mc/): opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 (not scored)
- [GHSA-cxf7-m5g2-v594](https://insights.sbomify.com/GHSA-cxf7-m5g2-v594/): Zend-Mail remote code execution in zend-mail via Sendmail adapter (not scored)
- [GHSA-cx7h-h87r-jpgr](https://insights.sbomify.com/GHSA-cx7h-h87r-jpgr/): The kstring integration in gix-attributes is unsound (not scored)
- [GHSA-cwgq-83w5-8jfq](https://insights.sbomify.com/GHSA-cwgq-83w5-8jfq/): silverstripe/framework has possible denial of service attack vector when flushing (not scored)
- [GHSA-cvp8-5r8g-fhvq](https://insights.sbomify.com/GHSA-cvp8-5r8g-fhvq/): omniauth-saml vulnerable to Improper Verification of Cryptographic Signature (not scored)
- [GHSA-cv5c-2qv5-w2m2](https://insights.sbomify.com/GHSA-cv5c-2qv5-w2m2/): Passbolt Api Remote code execution (not scored)
- [GHSA-cv25-3pxr-4q7x](https://insights.sbomify.com/GHSA-cv25-3pxr-4q7x/): Magento Open Source Security Advisory: Patch SUPEE-10975 (not scored)
- [GHSA-crr3-h4m8-7f56](https://insights.sbomify.com/GHSA-crr3-h4m8-7f56/): silverstripe/framework vulnerable to member disclosure in login form (not scored)
- [GHSA-crjg-w57m-rqqf](https://insights.sbomify.com/GHSA-crjg-w57m-rqqf/): DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks (not scored)
- [GHSA-cq96-9974-v8hm](https://insights.sbomify.com/GHSA-cq96-9974-v8hm/): Dynamic Variable Evaluation in qiskit-ibm-runtime (not scored)
- [GHSA-cg8w-5jrc-675g](https://insights.sbomify.com/GHSA-cg8w-5jrc-675g/): Zend-HTTP URL Rewrite vulnerability (not scored)
- [GHSA-cg84-55jx-4237](https://insights.sbomify.com/GHSA-cg84-55jx-4237/): eZ Platform Password reset vulnerability (not scored)
- [GHSA-cg4m-qjjp-7497](https://insights.sbomify.com/GHSA-cg4m-qjjp-7497/): TYPO3 Cross-Site Scripting in link validator component (not scored)
- [GHSA-cfqx-f43m-vfh7](https://insights.sbomify.com/GHSA-cfqx-f43m-vfh7/): @saltcorn/server arbitrary file and directory listing when accessing build mobile app results (not scored)
- [GHSA-cc97-g92w-jm65](https://insights.sbomify.com/GHSA-cc97-g92w-jm65/): TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution (not scored)
- [GHSA-cc2w-ghc5-m5qr](https://insights.sbomify.com/GHSA-cc2w-ghc5-m5qr/): Laravel Risk of mass-assignment vulnerabilities (not scored)
- [GHSA-cc2j-92jq-wgjg](https://insights.sbomify.com/GHSA-cc2j-92jq-wgjg/): eZ Publish Information disclosure in backend content tree menu (not scored)
- [GHSA-c9cp-9c75-9v8c](https://insights.sbomify.com/GHSA-c9cp-9c75-9v8c/): containerd started with non-empty inheritable Linux process capabilities (not scored)
- [GHSA-c8v3-jhv9-4ppc](https://insights.sbomify.com/GHSA-c8v3-jhv9-4ppc/): Use-after-free when setting the locale (not scored)
- [GHSA-c7xh-gjv4-4jgv](https://insights.sbomify.com/GHSA-c7xh-gjv4-4jgv/): kcp's impersonation allows access to global administrative groups (not scored)
- [GHSA-c7rj-92xr-wprg](https://insights.sbomify.com/GHSA-c7rj-92xr-wprg/): Insecure Unserialize in TYPO3 Backend (not scored)
- [GHSA-c7p6-3c9c-f88q](https://insights.sbomify.com/GHSA-c7p6-3c9c-f88q/): Information Disclosure in TYPO3 CMS (not scored)
- [GHSA-c636-cg5r-2498](https://insights.sbomify.com/GHSA-c636-cg5r-2498/): Symfony XML Entity Expansion security vulnerability (not scored)
- [GHSA-c5mj-39cf-3pp5](https://insights.sbomify.com/GHSA-c5mj-39cf-3pp5/): TYPO3 Security Misconfiguration for Backend User Accounts (not scored)
- [GHSA-c4cm-r9fh-jgj9](https://insights.sbomify.com/GHSA-c4cm-r9fh-jgj9/): commonground-api-common unexploitable privilege escalation in JWT authentication middleware (not scored)
- [GHSA-c4c3-j73v-634r](https://insights.sbomify.com/GHSA-c4c3-j73v-634r/): silverstripe/framework has Cross-site Scripting vulnerability in page history comparison (not scored)
- [GHSA-9wwx-c723-vm8x](https://insights.sbomify.com/GHSA-9wwx-c723-vm8x/): eZ Platform REST API returns list of all SiteAccesses (not scored)
- [GHSA-9wv8-3h8h-x2wc](https://insights.sbomify.com/GHSA-9wv8-3h8h-x2wc/): doctrine/doctrine-module zero-valued authentication credentials vulnerability (not scored)
- [GHSA-9wrw-p9rm-r782](https://insights.sbomify.com/GHSA-9wrw-p9rm-r782/): onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse. (not scored)
- [GHSA-9v78-h226-2rmq](https://insights.sbomify.com/GHSA-9v78-h226-2rmq/): Zendframework potential security issue in login mechanism (not scored)
- [GHSA-9rx9-7fmh-gj3g](https://insights.sbomify.com/GHSA-9rx9-7fmh-gj3g/): TYPO3 Broken Access Control in Localization Handling (not scored)
- [GHSA-9q78-27f3-2jmh](https://insights.sbomify.com/GHSA-9q78-27f3-2jmh/): webp crate may expose memory contents when encoding an image (not scored)
- [GHSA-9phw-7h96-q3rv](https://insights.sbomify.com/GHSA-9phw-7h96-q3rv/): scheb/two-factor-bundle bypass two-factor authentication with remember-me option (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/133/