Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 134 of 521.
- GHSA-9j39-4686-m3c4 Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
- GHSA-9gxv-x7rp-r2hc gree/jose - "None" Algorithm treated as valid in tokens
- GHSA-9ghp-w2hm-vfpf Dump Undefined Memory by `JitDumpFile`
- GHSA-9cw3-j7wg-jwj8 Neos Flow Information disclosure in entity security
- GHSA-9cq2-pcgr-8h62 Cross-site Scripting in eZFind spellcheck
- GHSA-98h9-727m-44qv Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
- GHSA-9895-53fc-98v2 TYPO3 SQL Injection in dbal
- GHSA-9895-26wr-4fgv EZsystems Remote code execution in file uploads
- GHSA-97m3-52wr-xvv2 Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE
- GHSA-97jm-g33h-f46g silverstripe/framework ReadOnly transformation for formfields exploitable
- GHSA-97h7-mf38-g9mf Adminer file disclosure vulnerability
- GHSA-9763-4f94-gfch CIRCL's Kyber: timing side-channel (kyberslash2)
- GHSA-96jg-pmc4-cx39 TYPO3 CMS Insecure Deserialization
- GHSA-96c6-m98x-hxjx Zend-Session session validation vulnerability
- GHSA-95rx-m9m5-m94v ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions
- GHSA-95qm-3xp7-vfj5 TYPO3 Cross-Site Scripting in Form Framework validation handling
- GHSA-945h-6vcv-pc8h Sylius Admin Bundle Cross-Site Request Forgery vulnerability
- GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability
- GHSA-8x2v-pcg7-94f4 Zend-JSON vulnerable to XXE/XEE attacks
- GHSA-8wx3-8m4x-g5h4 FOSUserBundle User Identity Validation Vulnerability
- GHSA-8wcc-m6j2-qxvm ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion
- GHSA-8v6m-7f5v-hhx6 Silverstripe Brute force bypass on default admin
- GHSA-8v5x-6vv5-jv4g amphp/http Host Header Injection vulnerability
- GHSA-8v28-3g86-chj5 .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.
- GHSA-8qw9-gf7w-42x5 Minor fix to previous patch for CVE-2022-35918
- GHSA-8q77-cv62-jj38 Zendframework has potential Cross-site Scripting vector in multiple view helpers
- GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering
- GHSA-8m24-3cfx-9fjw sp1 has insufficient observation of cumulative sum
- GHSA-8jp9-mpv9-98rj amphp/http-client Header leakage on cross-domain redirects
- GHSA-8j9v-4hhh-x43c Cross-Site Scripting (XSS) in TYPO3 component CSS styled content
- GHSA-8j7c-682x-r9f2 Magento RCE,XSS and other vulnerabilities
- GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module
- GHSA-8h28-f46f-m87h Insecure Deserialization in TYPO3 CMS
- GHSA-8fx8-3rg2-79xw Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
- GHSA-8c85-4rr5-chr4 Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS
- GHSA-8c25-vj2w-p72j TYPO3 Cross-Site Scripting in Frontend User Login
- GHSA-88jp-9jrv-6368 Silverstripe XSS In GridField print
- GHSA-87pf-7x99-5xc4 Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers
- GHSA-87mp-xc4x-x8rh asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption
- GHSA-87m9-rv8p-rgmg go-grpc-compression has a zstd decompression bombing vulnerability
- GHSA-879p-8gw4-mcpw fgr Vulnerable to Insecure Default Variable Initialization
- GHSA-86xw-vmcx-9mj4 Drupal Content moderation Access bypass
- GHSA-86r8-4g3w-7xjp Cross-Site Scripting in TYPO3 Backend
- GHSA-86h5-xcpx-cfqc ASA-2024-005: Potential slashing evasion during re-delegation
- GHSA-85rg-8m6h-825p Vulnerabilities with the k8sGPT
- GHSA-85ch-44w7-rf32 TYPO3 Cross-Site Scripting in Fluid ViewHelpers
- GHSA-857q-xmph-p2v5 s2n-tls's mTLS API ordering may skip client authentication
- GHSA-84x2-2qv6-qg56 Nervos CKB P2P DoS Attacks
- GHSA-84jw-g43v-8gjm DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS
- GHSA-84c3-j8r2-mcm8 @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys
- GHSA-848f-mph5-9pm9 Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
- GHSA-83jv-4prm-34g7 Shopware Remote Code Execution Vulnerability
- GHSA-8327-84cj-8xjm Stack overflow when parsing specially crafted JSON ABI strings
- GHSA-82vp-jr39-4j2j TYPO3 Security Misconfiguration in Frontend Session Handling
- GHSA-82rv-45pc-v28w eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities
- GHSA-82jv-9wjw-pqh6 Prototype pollution in emit function
- GHSA-7xg2-83f8-39mr The DES/3DES cipher was used as part of the TLS protocol by installation tools
- GHSA-7x4w-cj9r-h4v9 Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
- GHSA-7x29-qqmq-v6qc GitHub Actions Script Injection in `ultralytics/actions`
- GHSA-7wh8-jrq7-p27f SimpleSAMLphp exposes credentials in session storage
- GHSA-7vw7-qx38-37vr Propel2 SQL injection possible with limit() on MySQL
- GHSA-7v7m-pcw5-h3cg Pusher Service Channel Authentication Bypass
- GHSA-7v68-3pr5-h3cr Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
- GHSA-7v38-w32m-wx4m Types for Vela Insecure Variable Substitution
- GHSA-7qwg-fcpw-xg5g Privilege Escalation & SQL Injection in TYPO3 CMS
- GHSA-7q74-g774-7x3g Interchain Security: The signers of ICS messages do not need to match the provider address
- GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component
- GHSA-7prj-hgx4-2xc3 Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy
- GHSA-7mx2-7q8p-pgmw Symfony may allow a user to switch to using another user's identity
- GHSA-7m2v-x7rg-5hm5 silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms
- GHSA-7jmw-8259-q9jx Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
- GHSA-7jjx-3qw9-j6h6 cggmp21-keygen has ambiguous challenge derivation
- GHSA-7h74-7vcw-4mwp Insecure deserialize Vulnerability in FLOW3
- GHSA-7h65-4p22-39j6 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
- GHSA-7gwj-7fhm-vw4w Drupal core unrestricted file upload
- GHSA-7g7c-qhf3-x59p propel/propel1 SQL injection possible with limit() on MySQL
- GHSA-7fjv-25q9-2w88 State Guessing Vulnerability in laravel/socialite
- GHSA-7f6p-phw2-8253 Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws
- GHSA-7f4j-64p6-5h5v Traefik affected by HTTP/2 CONTINUATION flood in net/http
- GHSA-7f4f-p7mq-p4fv Drupal External URL injection through URL aliases leading to Open Redirect
- GHSA-7f32-hm4h-w77q github-slug-action use of `set-env` Runner commands which are processed via stdout
- GHSA-7cvr-xhm5-x998 Twig Path Traversal vulnerability in the filesystem loader
- GHSA-78p3-fwcq-62c2 The endpoint `/site-structure/localizer/save-string/:lang/:defstring` accepts two parameter values: `lang` and `defstring`.
- GHSA-78hm-5hjw-58mh ua-parser/uap-php ReDoS vulnerability
- GHSA-7852-w36x-6mf6 Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior
- GHSA-77mv-mp2j-gxxh pygmentize Remote Code Execution
- GHSA-77hh-43cm-v8j6 tuf's Metadata API: Targets.get_delegated_role() is missing input validation
- GHSA-779c-7w4p-2c4g Silverstripe admin XSS Vulnerability via WYSIWYG editor
- GHSA-772m-43f3-hmf8 TYPO3 Broken Access Control in Localization Handling
- GHSA-76w8-mqx4-wjrf Doctrine DBAL SQL injection possibility
- GHSA-76r3-m635-p3vc TYPO3 Cross-Site Scripting in Language Pack Handling
- GHSA-75qh-gg76-p2w4 CWA-2023-004: Excessive number of function parameters in compiled Wasm
- GHSA-75j2-9gmc-m855 Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
- GHSA-753p-wrj5-g8fj PQClean has a correctness error in HQC decapsulation
- GHSA-74r5-g7vc-j2v2 zerovec-derive incorrectly uses `#[repr(packed)]`
- GHSA-7336-ghhp-f2qj Shopware Remote Code Execution Vulnerability
- GHSA-7225-m954-23v7 ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic
- GHSA-6xwf-7rfm-4gwc TYPO3 Cross-Site Scripting in Filelist Module
- GHSA-6xh8-8pfv-53vx Authentication Bypass in TYPO3 CMS
- GHSA-6xch-2vxx-5pvr eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)