# Vulnerabilities published in 2024


- [GHSA-9j39-4686-m3c4](https://insights.sbomify.com/GHSA-9j39-4686-m3c4/): Ibexa Kernel's files with blacklisted extensions can be still saved to drafts (not scored)
- [GHSA-9gxv-x7rp-r2hc](https://insights.sbomify.com/GHSA-9gxv-x7rp-r2hc/): gree/jose - "None" Algorithm treated as valid in tokens (not scored)
- [GHSA-9ghp-w2hm-vfpf](https://insights.sbomify.com/GHSA-9ghp-w2hm-vfpf/): Dump Undefined Memory by `JitDumpFile` (not scored)
- [GHSA-9cw3-j7wg-jwj8](https://insights.sbomify.com/GHSA-9cw3-j7wg-jwj8/): Neos Flow Information disclosure in entity security (not scored)
- [GHSA-9cq2-pcgr-8h62](https://insights.sbomify.com/GHSA-9cq2-pcgr-8h62/): Cross-site Scripting in eZFind spellcheck (not scored)
- [GHSA-98h9-727m-44qv](https://insights.sbomify.com/GHSA-98h9-727m-44qv/): Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar (not scored)
- [GHSA-9895-53fc-98v2](https://insights.sbomify.com/GHSA-9895-53fc-98v2/): TYPO3 SQL Injection in dbal (not scored)
- [GHSA-9895-26wr-4fgv](https://insights.sbomify.com/GHSA-9895-26wr-4fgv/): EZsystems Remote code execution in file uploads (not scored)
- [GHSA-97m3-52wr-xvv2](https://insights.sbomify.com/GHSA-97m3-52wr-xvv2/): Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE (not scored)
- [GHSA-97jm-g33h-f46g](https://insights.sbomify.com/GHSA-97jm-g33h-f46g/): silverstripe/framework ReadOnly transformation for formfields exploitable (not scored)
- [GHSA-97h7-mf38-g9mf](https://insights.sbomify.com/GHSA-97h7-mf38-g9mf/): Adminer file disclosure vulnerability (not scored)
- [GHSA-9763-4f94-gfch](https://insights.sbomify.com/GHSA-9763-4f94-gfch/): CIRCL's Kyber: timing side-channel (kyberslash2) (not scored)
- [GHSA-96jg-pmc4-cx39](https://insights.sbomify.com/GHSA-96jg-pmc4-cx39/): TYPO3 CMS Insecure Deserialization (not scored)
- [GHSA-96c6-m98x-hxjx](https://insights.sbomify.com/GHSA-96c6-m98x-hxjx/): Zend-Session session validation vulnerability (not scored)
- [GHSA-95rx-m9m5-m94v](https://insights.sbomify.com/GHSA-95rx-m9m5-m94v/): ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions (not scored)
- [GHSA-95qm-3xp7-vfj5](https://insights.sbomify.com/GHSA-95qm-3xp7-vfj5/): TYPO3 Cross-Site Scripting in Form Framework validation handling (not scored)
- [GHSA-945h-6vcv-pc8h](https://insights.sbomify.com/GHSA-945h-6vcv-pc8h/): Sylius Admin Bundle Cross-Site Request Forgery vulnerability (not scored)
- [GHSA-8xhv-gqm4-3w99](https://insights.sbomify.com/GHSA-8xhv-gqm4-3w99/): ZendFramework1 Potential Insufficient Entropy Vulnerability (not scored)
- [GHSA-8x2v-pcg7-94f4](https://insights.sbomify.com/GHSA-8x2v-pcg7-94f4/): Zend-JSON vulnerable to XXE/XEE attacks (not scored)
- [GHSA-8wx3-8m4x-g5h4](https://insights.sbomify.com/GHSA-8wx3-8m4x-g5h4/): FOSUserBundle User Identity Validation Vulnerability (not scored)
- [GHSA-8wcc-m6j2-qxvm](https://insights.sbomify.com/GHSA-8wcc-m6j2-qxvm/): ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion (not scored)
- [GHSA-8v6m-7f5v-hhx6](https://insights.sbomify.com/GHSA-8v6m-7f5v-hhx6/): Silverstripe Brute force bypass on default admin (not scored)
- [GHSA-8v5x-6vv5-jv4g](https://insights.sbomify.com/GHSA-8v5x-6vv5-jv4g/): amphp/http Host Header Injection vulnerability (not scored)
- [GHSA-8v28-3g86-chj5](https://insights.sbomify.com/GHSA-8v28-3g86-chj5/): .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. (not scored)
- [GHSA-8qw9-gf7w-42x5](https://insights.sbomify.com/GHSA-8qw9-gf7w-42x5/): Minor fix to previous patch for CVE-2022-35918 (not scored)
- [GHSA-8q77-cv62-jj38](https://insights.sbomify.com/GHSA-8q77-cv62-jj38/): Zendframework has potential Cross-site Scripting vector in multiple view helpers (not scored)
- [GHSA-8m6j-p5jv-v69w](https://insights.sbomify.com/GHSA-8m6j-p5jv-v69w/): TYPO3 Cross-Site Scripting in Online Media Asset Rendering (not scored)
- [GHSA-8m24-3cfx-9fjw](https://insights.sbomify.com/GHSA-8m24-3cfx-9fjw/): sp1 has insufficient observation of cumulative sum (not scored)
- [GHSA-8jp9-mpv9-98rj](https://insights.sbomify.com/GHSA-8jp9-mpv9-98rj/): amphp/http-client Header leakage on cross-domain redirects (not scored)
- [GHSA-8j9v-4hhh-x43c](https://insights.sbomify.com/GHSA-8j9v-4hhh-x43c/): Cross-Site Scripting (XSS) in TYPO3 component CSS styled content (not scored)
- [GHSA-8j7c-682x-r9f2](https://insights.sbomify.com/GHSA-8j7c-682x-r9f2/): Magento RCE,XSS and other vulnerabilities (not scored)
- [GHSA-8h4m-r4wm-xj7r](https://insights.sbomify.com/GHSA-8h4m-r4wm-xj7r/): TYPO3 Arbitrary Code Execution via File List Module (not scored)
- [GHSA-8h28-f46f-m87h](https://insights.sbomify.com/GHSA-8h28-f46f-m87h/): Insecure Deserialization in TYPO3 CMS (not scored)
- [GHSA-8fx8-3rg2-79xw](https://insights.sbomify.com/GHSA-8fx8-3rg2-79xw/): Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) (not scored)
- [GHSA-8c85-4rr5-chr4](https://insights.sbomify.com/GHSA-8c85-4rr5-chr4/): Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS (not scored)
- [GHSA-8c25-vj2w-p72j](https://insights.sbomify.com/GHSA-8c25-vj2w-p72j/): TYPO3 Cross-Site Scripting in Frontend User Login (not scored)
- [GHSA-88jp-9jrv-6368](https://insights.sbomify.com/GHSA-88jp-9jrv-6368/): Silverstripe XSS In GridField print (not scored)
- [GHSA-87pf-7x99-5xc4](https://insights.sbomify.com/GHSA-87pf-7x99-5xc4/): Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers (not scored)
- [GHSA-87mp-xc4x-x8rh](https://insights.sbomify.com/GHSA-87mp-xc4x-x8rh/): asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption (not scored)
- [GHSA-87m9-rv8p-rgmg](https://insights.sbomify.com/GHSA-87m9-rv8p-rgmg/): go-grpc-compression has a zstd decompression bombing vulnerability (not scored)
- [GHSA-879p-8gw4-mcpw](https://insights.sbomify.com/GHSA-879p-8gw4-mcpw/): fgr Vulnerable to Insecure Default Variable Initialization (not scored)
- [GHSA-86xw-vmcx-9mj4](https://insights.sbomify.com/GHSA-86xw-vmcx-9mj4/): Drupal Content moderation Access bypass (not scored)
- [GHSA-86r8-4g3w-7xjp](https://insights.sbomify.com/GHSA-86r8-4g3w-7xjp/): Cross-Site Scripting in TYPO3 Backend (not scored)
- [GHSA-86h5-xcpx-cfqc](https://insights.sbomify.com/GHSA-86h5-xcpx-cfqc/): ASA-2024-005: Potential slashing evasion during re-delegation (not scored)
- [GHSA-85rg-8m6h-825p](https://insights.sbomify.com/GHSA-85rg-8m6h-825p/): Vulnerabilities with the k8sGPT (not scored)
- [GHSA-85ch-44w7-rf32](https://insights.sbomify.com/GHSA-85ch-44w7-rf32/): TYPO3 Cross-Site Scripting in Fluid ViewHelpers (not scored)
- [GHSA-857q-xmph-p2v5](https://insights.sbomify.com/GHSA-857q-xmph-p2v5/): s2n-tls's mTLS API ordering may skip client authentication (not scored)
- [GHSA-84x2-2qv6-qg56](https://insights.sbomify.com/GHSA-84x2-2qv6-qg56/): Nervos CKB P2P DoS Attacks (not scored)
- [GHSA-84jw-g43v-8gjm](https://insights.sbomify.com/GHSA-84jw-g43v-8gjm/): DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS (not scored)
- [GHSA-84c3-j8r2-mcm8](https://insights.sbomify.com/GHSA-84c3-j8r2-mcm8/): @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys (not scored)
- [GHSA-848f-mph5-9pm9](https://insights.sbomify.com/GHSA-848f-mph5-9pm9/): Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability (not scored)
- [GHSA-83jv-4prm-34g7](https://insights.sbomify.com/GHSA-83jv-4prm-34g7/): Shopware Remote Code Execution Vulnerability (not scored)
- [GHSA-8327-84cj-8xjm](https://insights.sbomify.com/GHSA-8327-84cj-8xjm/): Stack overflow when parsing specially crafted JSON ABI strings (not scored)
- [GHSA-82vp-jr39-4j2j](https://insights.sbomify.com/GHSA-82vp-jr39-4j2j/): TYPO3 Security Misconfiguration in Frontend Session Handling (not scored)
- [GHSA-82rv-45pc-v28w](https://insights.sbomify.com/GHSA-82rv-45pc-v28w/): eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities (not scored)
- [GHSA-82jv-9wjw-pqh6](https://insights.sbomify.com/GHSA-82jv-9wjw-pqh6/): Prototype pollution in emit function (not scored)
- [GHSA-7xg2-83f8-39mr](https://insights.sbomify.com/GHSA-7xg2-83f8-39mr/): The DES/3DES cipher was used as part of the TLS protocol by installation tools (not scored)
- [GHSA-7x4w-cj9r-h4v9](https://insights.sbomify.com/GHSA-7x4w-cj9r-h4v9/): Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) (not scored)
- [GHSA-7x29-qqmq-v6qc](https://insights.sbomify.com/GHSA-7x29-qqmq-v6qc/): GitHub Actions Script Injection in `ultralytics/actions` (not scored)
- [GHSA-7wh8-jrq7-p27f](https://insights.sbomify.com/GHSA-7wh8-jrq7-p27f/): SimpleSAMLphp exposes credentials in session storage (not scored)
- [GHSA-7vw7-qx38-37vr](https://insights.sbomify.com/GHSA-7vw7-qx38-37vr/): Propel2 SQL injection possible with limit() on MySQL (not scored)
- [GHSA-7v7m-pcw5-h3cg](https://insights.sbomify.com/GHSA-7v7m-pcw5-h3cg/): Pusher Service Channel Authentication Bypass (not scored)
- [GHSA-7v68-3pr5-h3cr](https://insights.sbomify.com/GHSA-7v68-3pr5-h3cr/): Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution (not scored)
- [GHSA-7v38-w32m-wx4m](https://insights.sbomify.com/GHSA-7v38-w32m-wx4m/): Types for Vela Insecure Variable Substitution (not scored)
- [GHSA-7qwg-fcpw-xg5g](https://insights.sbomify.com/GHSA-7qwg-fcpw-xg5g/): Privilege Escalation & SQL Injection in TYPO3 CMS (not scored)
- [GHSA-7q74-g774-7x3g](https://insights.sbomify.com/GHSA-7q74-g774-7x3g/): Interchain Security: The signers of ICS messages do not need to match the provider address (not scored)
- [GHSA-7q33-hxwj-7p8v](https://insights.sbomify.com/GHSA-7q33-hxwj-7p8v/): TYPO3 Cross-Site Scripting in Backend Modal Component (not scored)
- [GHSA-7prj-hgx4-2xc3](https://insights.sbomify.com/GHSA-7prj-hgx4-2xc3/): Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy (not scored)
- [GHSA-7mx2-7q8p-pgmw](https://insights.sbomify.com/GHSA-7mx2-7q8p-pgmw/): Symfony may allow a user to switch to using another user's identity (not scored)
- [GHSA-7m2v-x7rg-5hm5](https://insights.sbomify.com/GHSA-7m2v-x7rg-5hm5/): silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms (not scored)
- [GHSA-7jmw-8259-q9jx](https://insights.sbomify.com/GHSA-7jmw-8259-q9jx/): Traefik has unexpected behavior with IPv4-mapped IPv6 addresses (not scored)
- [GHSA-7jjx-3qw9-j6h6](https://insights.sbomify.com/GHSA-7jjx-3qw9-j6h6/): cggmp21-keygen has ambiguous challenge derivation (not scored)
- [GHSA-7h74-7vcw-4mwp](https://insights.sbomify.com/GHSA-7h74-7vcw-4mwp/): Insecure deserialize Vulnerability in FLOW3 (not scored)
- [GHSA-7h65-4p22-39j6](https://insights.sbomify.com/GHSA-7h65-4p22-39j6/): github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (not scored)
- [GHSA-7gwj-7fhm-vw4w](https://insights.sbomify.com/GHSA-7gwj-7fhm-vw4w/): Drupal core unrestricted file upload (not scored)
- [GHSA-7g7c-qhf3-x59p](https://insights.sbomify.com/GHSA-7g7c-qhf3-x59p/): propel/propel1 SQL injection possible with limit() on MySQL (not scored)
- [GHSA-7fjv-25q9-2w88](https://insights.sbomify.com/GHSA-7fjv-25q9-2w88/): State Guessing Vulnerability in laravel/socialite (not scored)
- [GHSA-7f6p-phw2-8253](https://insights.sbomify.com/GHSA-7f6p-phw2-8253/): Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws (not scored)
- [GHSA-7f4j-64p6-5h5v](https://insights.sbomify.com/GHSA-7f4j-64p6-5h5v/): Traefik affected by HTTP/2 CONTINUATION flood in net/http (not scored)
- [GHSA-7f4f-p7mq-p4fv](https://insights.sbomify.com/GHSA-7f4f-p7mq-p4fv/): Drupal External URL injection through URL aliases leading to Open Redirect (not scored)
- [GHSA-7f32-hm4h-w77q](https://insights.sbomify.com/GHSA-7f32-hm4h-w77q/): github-slug-action use of `set-env` Runner commands which are processed via stdout (not scored)
- [GHSA-7cvr-xhm5-x998](https://insights.sbomify.com/GHSA-7cvr-xhm5-x998/): Twig Path Traversal vulnerability in the filesystem loader (not scored)
- [GHSA-78p3-fwcq-62c2](https://insights.sbomify.com/GHSA-78p3-fwcq-62c2/): The endpoint `/site-structure/localizer/save-string/:lang/:defstring` accepts two parameter values: `lang` and `defstring`. (not scored)
- [GHSA-78hm-5hjw-58mh](https://insights.sbomify.com/GHSA-78hm-5hjw-58mh/): ua-parser/uap-php ReDoS vulnerability (not scored)
- [GHSA-7852-w36x-6mf6](https://insights.sbomify.com/GHSA-7852-w36x-6mf6/): Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior (not scored)
- [GHSA-77mv-mp2j-gxxh](https://insights.sbomify.com/GHSA-77mv-mp2j-gxxh/): pygmentize Remote Code Execution (not scored)
- [GHSA-77hh-43cm-v8j6](https://insights.sbomify.com/GHSA-77hh-43cm-v8j6/): tuf's Metadata API: Targets.get_delegated_role() is missing input validation (not scored)
- [GHSA-779c-7w4p-2c4g](https://insights.sbomify.com/GHSA-779c-7w4p-2c4g/): Silverstripe admin XSS Vulnerability via WYSIWYG editor (not scored)
- [GHSA-772m-43f3-hmf8](https://insights.sbomify.com/GHSA-772m-43f3-hmf8/): TYPO3 Broken Access Control in Localization Handling (not scored)
- [GHSA-76w8-mqx4-wjrf](https://insights.sbomify.com/GHSA-76w8-mqx4-wjrf/): Doctrine DBAL SQL injection possibility (not scored)
- [GHSA-76r3-m635-p3vc](https://insights.sbomify.com/GHSA-76r3-m635-p3vc/): TYPO3 Cross-Site Scripting in Language Pack Handling (not scored)
- [GHSA-75qh-gg76-p2w4](https://insights.sbomify.com/GHSA-75qh-gg76-p2w4/): CWA-2023-004: Excessive number of function parameters in compiled Wasm (not scored)
- [GHSA-75j2-9gmc-m855](https://insights.sbomify.com/GHSA-75j2-9gmc-m855/): Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) (not scored)
- [GHSA-753p-wrj5-g8fj](https://insights.sbomify.com/GHSA-753p-wrj5-g8fj/): PQClean has a correctness error in HQC decapsulation (not scored)
- [GHSA-74r5-g7vc-j2v2](https://insights.sbomify.com/GHSA-74r5-g7vc-j2v2/): zerovec-derive incorrectly uses `#[repr(packed)]` (not scored)
- [GHSA-7336-ghhp-f2qj](https://insights.sbomify.com/GHSA-7336-ghhp-f2qj/): Shopware Remote Code Execution Vulnerability (not scored)
- [GHSA-7225-m954-23v7](https://insights.sbomify.com/GHSA-7225-m954-23v7/): ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic (not scored)
- [GHSA-6xwf-7rfm-4gwc](https://insights.sbomify.com/GHSA-6xwf-7rfm-4gwc/): TYPO3 Cross-Site Scripting in Filelist Module (not scored)
- [GHSA-6xh8-8pfv-53vx](https://insights.sbomify.com/GHSA-6xh8-8pfv-53vx/): Authentication Bypass in TYPO3 CMS (not scored)
- [GHSA-6xch-2vxx-5pvr](https://insights.sbomify.com/GHSA-6xch-2vxx-5pvr/): eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud) (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/134/