Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 135 of 521.
- GHSA-6wqp-7g94-f69j sensiolabs/connect has a Cross-Site Request Forgery Vulnerability
- GHSA-6wm4-3rjj-c8xx Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
- GHSA-6wjw-qf87-fv5v Laravel Encrypter Failure to decryption vulnerability
- GHSA-6v7p-5qcq-268c Zend-Navigation vulnerable to Cross-site Scripting
- GHSA-6q9v-4hq6-5m67 Doctrine SQL injection vulnerability
- GHSA-6pq8-67pw-j6hw Time-Based Information Disclosure Vulnerability in Flow
- GHSA-6mjq-9x4w-m3w9 FOSUserBundle Session Hijacking Vulnerability
- GHSA-6mgp-v5cm-ghg5 Drupal core Remote Code Execution
- GHSA-6jvx-8ch9-j2jr Laravel Cookie serialization vulnerability
- GHSA-6jrj-vc65-c983 unzip-stream allows Arbitrary File Write via artifact extraction
- GHSA-6hh6-59j2-qrxw Silverstripe History XSS Vulnerability
- GHSA-6gf6-24h2-66j4 Drupal core Open Redirect vulnerability
- GHSA-6fqw-j3vm-7f66 Zendframework1 Potential SQL injection in ORDER and GROUP functions
- GHSA-6fc6-cj2j-h22x TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend
- GHSA-6f9m-v7mp-7jjq Authentication Bypass in TYPO3 CMS
- GHSA-6cj3-rc4p-f38f Cross-site Scripting vulnerabilities in Neos
- GHSA-6ccv-8fgf-cjpw Drupal core Denial of Service vulnerability
- GHSA-69p4-j5v5-x234 Server/API for Vela Insecure Variable Substitution
- GHSA-68c2-4mpx-qh95 Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin
- GHSA-67wg-6j7r-mqh8 Arbitrary Code Execution in TYPO3 CMS
- GHSA-66fw-43h8-f8p3 XMP Toolkit's `XmpFile::close` can trigger undefined behavior
- GHSA-66c2-7g4p-wx4p TYPO3 Information Disclosure in Install Tool
- GHSA-65xh-hh78-6454 Denial of Service in extension "Code Highlight" (codehighlight)
- GHSA-65v7-wg35-2qpm Sylius Resource Bundle Cross-Site Request Forgery vulnerability
- GHSA-64vj-933f-6pm3 eZ Platform Object Injection in SiteAccessMatchListener
- GHSA-64gp-r758-8pfm Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment
- GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool
- GHSA-635v-pc42-fr74 AWS SageMaker Training Toolkit logs CodeArtifact Authorization token
- GHSA-62f6-h68r-3jpw Zendframework session validation vulnerability
- GHSA-5xr6-xhww-33m4 Artifact poisoning vulnerability in action-download-artifact v5 and earlier
- GHSA-5xgj-pmjj-gw49 RISC Zero zkVM notes on zero-knowledge
- GHSA-5x4g-q5rc-36jp Etcd pkg Insecure ciphers are allowed by default
- GHSA-5x28-3f32-x523 Drupal core Access control bypass
- GHSA-5wx6-xwxf-q8qj Cross-Site Scripting in TYPO3 Backend
- GHSA-5vv7-j593-mgjc Neos Flow Arbitrary file upload and XML External Entity processing
- GHSA-5r8w-66hq-rc39 silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
- GHSA-5pf6-cq2v-23ww WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service
- GHSA-5j86-5xvg-7q93 TYPO3 Cross-Site Scripting (XSS) in form component
- GHSA-5h5v-m596-r6rf TYPO3 Possible Insecure Deserialization in Extbase Request Handling
- GHSA-5grr-72f9-678v Malware package cipherbcrypt
- GHSA-5gr6-97fv-52cc Cross-Site Scripting in TYPO3 CMS
- GHSA-5gmh-85x8-5cx7 Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
- GHSA-5gmf-3c43-q73v ZendFramework vulnerable to Cross-site Scripting
- GHSA-5f5v-5c3v-gw5v Silverstripe IE requests not properly behaving with rewritehashlinks
- GHSA-5cxf-xx9j-54jc Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend
- GHSA-593m-55hh-j8gv Sentry SDK Prototype Pollution gadget in JavaScript SDKs
- GHSA-58xv-7h9r-mx3c Drupal Malicious file upload with filenames stating with dot
- GHSA-58j9-j2fj-v8f4 SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
- GHSA-564j-v29w-rqr6 Khoj Open Redirect Vulnerability in Login Page
- GHSA-55qg-6c4m-mw6g silverstripe/framework's URL parameters `isDev` and `isTest` unguarded
- GHSA-55pp-293f-3365 silverstripe/userforms file upload exposure on UserForms module
- GHSA-55p7-v223-x366 IdentityServer Open Redirect vulnerability
- GHSA-555p-m4v6-cqxv ASA-2024-004: Default configuration param for Evidence may limit window of validity
- GHSA-534c-hcr7-67jg Kimai has an XXE Leading to Local File Read
- GHSA-52xf-5p2m-9wrv s2n-tls has a potentially observable differences in RSA premaster secret handling
- GHSA-52cx-hpc5-cxwc silverstripe/framework missing ACL on reports
- GHSA-52cw-pvq9-9m5v Silverstripe uses TinyMCE which allows svg files linked in object tags
- GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed
- GHSA-4vf2-qfg3-7598 symfony/validator XML Entity Expansion vulnerability
- GHSA-4v5g-8pq2-32m2 By-passing Protection of PharStreamWrapper Interceptor
- GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`
- GHSA-4v52-7q2x-v4xj Parts of Report are dropped as the wrong type during downcast
- GHSA-4rr6-gf59-ggw5 namshi/jose - Verification bypass
- GHSA-4r76-xr68-w7m7 TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
- GHSA-4qx8-j9vh-2628 silverstripe/framework's User-Agent header not correctly invalidating user session
- GHSA-4qpj-gxxg-jqg4 Swiftmailer Sendmail transport arbitrary shell execution
- GHSA-4ppr-jw47-9qm5 TYPO3 Cross-Site Scripting in Link Handling
- GHSA-4mw5-2636-4535 op_panic in the base runtime can force a panic in the runtime's containing thread
- GHSA-4m3g-6r7g-jv4f Arbitrary JavaScript execution due to using outdated libraries
- GHSA-4jhj-3gv3-c3gr CLI for Vela Insecure Variable Substitution
- GHSA-4j9x-g4x8-vcmf ZendFramework potential XML eXternal Entity injection vectors
- GHSA-4j93-fm92-rp4m ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module
- GHSA-4h8f-c635-25p7 ibexa/post-install affected by Breach with Varnish VCL
- GHSA-4h5c-5g25-v7fh TYPO3 Cross-Site Scripting in Form Framework
- GHSA-4h54-vwx9-3vr3 Silverstripe XSS In FormAction
- GHSA-4g2x-vq5p-5vj6 Budibase affected by VM2 Constructor Escape Vulnerability
- GHSA-4cv2-xc5f-px8h Denial of Service in extension "Code Highlight" (codehighlight)
- GHSA-4c2w-v5rq-5mx7 eZ Platform Editor Cross-site Scripting (XSS)
- GHSA-486g-47cc-8wxf aiocpa contains credential harvesting code
- GHSA-468j-6jrc-2rjx silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`
- GHSA-45xg-4w5x-j429 TYPO3 Arbitrary Shell Execution in Swiftmailer library
- GHSA-45wj-jv2h-jwrf TYPO3 CMS Privilege Escalation and SQL Injection
- GHSA-45qm-j4m9-whv9 eZ Platform CSRF token in login form is disabled by default
- GHSA-4542-p56h-8xww Cross-Site Scripting (XSS) vulnerabilities in Neos
- GHSA-44pg-c29v-hp6r Laravel Guard bypass in Eloquent models
- GHSA-4459-qrcc-vfcf TYPO3 Cross-Site Scripting in Form Framework
- GHSA-43cf-7f3h-38rg Privilege Escalation in TYPO3 Neos
- GHSA-3x57-m5p4-rgh4 ZendOpenID potential security issue in login mechanism
- GHSA-3vwr-jj4f-h98x eZ Publish Remote code execution in file uploads
- GHSA-3vpc-4p9p-47hc curl_cffi bundles a version of libcurl affected by High Severity vulnerability
- GHSA-3vhm-q4w3-rw8q OroPlatform Forced Redirect to External Website
- GHSA-3v33-3wmw-3785 yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
- GHSA-3qx8-rv27-j6gp Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device`
- GHSA-3qwc-47jf-5rf7 eth-abi is vulnerable to recursive DoS
- GHSA-3pg4-qwc8-426r OpenRefine leaks Google API credentials in releases
- GHSA-3mm9-2p44-rw39 Silverstripe SiteTree Creation Permission Vulnerability
- GHSA-3jxq-5xhh-9jr3 Cross-Site Scripting (XSS) in TYPO3 component Backend
- GHSA-3hpf-ff72-j67p shared_preferences_android vulnerability
- GHSA-3gjh-29fv-8hr6 Nervos CKB Snappy decompress length can be very large and causes out of memory error
- GHSA-3g43-xfrw-pv5m eZ Platform User data disclosure