# Vulnerabilities published in 2024


- [GHSA-6wqp-7g94-f69j](https://insights.sbomify.com/GHSA-6wqp-7g94-f69j/): sensiolabs/connect has a Cross-Site Request Forgery Vulnerability (not scored)
- [GHSA-6wm4-3rjj-c8xx](https://insights.sbomify.com/GHSA-6wm4-3rjj-c8xx/): Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities (not scored)
- [GHSA-6wjw-qf87-fv5v](https://insights.sbomify.com/GHSA-6wjw-qf87-fv5v/): Laravel Encrypter Failure to decryption vulnerability (not scored)
- [GHSA-6v7p-5qcq-268c](https://insights.sbomify.com/GHSA-6v7p-5qcq-268c/): Zend-Navigation vulnerable to Cross-site Scripting (not scored)
- [GHSA-6q9v-4hq6-5m67](https://insights.sbomify.com/GHSA-6q9v-4hq6-5m67/): Doctrine SQL injection vulnerability (not scored)
- [GHSA-6pq8-67pw-j6hw](https://insights.sbomify.com/GHSA-6pq8-67pw-j6hw/): Time-Based Information Disclosure Vulnerability in Flow (not scored)
- [GHSA-6mjq-9x4w-m3w9](https://insights.sbomify.com/GHSA-6mjq-9x4w-m3w9/): FOSUserBundle Session Hijacking Vulnerability (not scored)
- [GHSA-6mgp-v5cm-ghg5](https://insights.sbomify.com/GHSA-6mgp-v5cm-ghg5/): Drupal core Remote Code Execution (not scored)
- [GHSA-6jvx-8ch9-j2jr](https://insights.sbomify.com/GHSA-6jvx-8ch9-j2jr/): Laravel Cookie serialization vulnerability (not scored)
- [GHSA-6jrj-vc65-c983](https://insights.sbomify.com/GHSA-6jrj-vc65-c983/): unzip-stream allows Arbitrary File Write via artifact extraction (not scored)
- [GHSA-6hh6-59j2-qrxw](https://insights.sbomify.com/GHSA-6hh6-59j2-qrxw/): Silverstripe History XSS Vulnerability (not scored)
- [GHSA-6gf6-24h2-66j4](https://insights.sbomify.com/GHSA-6gf6-24h2-66j4/): Drupal core Open Redirect vulnerability (not scored)
- [GHSA-6fqw-j3vm-7f66](https://insights.sbomify.com/GHSA-6fqw-j3vm-7f66/): Zendframework1 Potential SQL injection in ORDER and GROUP functions (not scored)
- [GHSA-6fc6-cj2j-h22x](https://insights.sbomify.com/GHSA-6fc6-cj2j-h22x/): TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend (not scored)
- [GHSA-6f9m-v7mp-7jjq](https://insights.sbomify.com/GHSA-6f9m-v7mp-7jjq/): Authentication Bypass in TYPO3 CMS (not scored)
- [GHSA-6cj3-rc4p-f38f](https://insights.sbomify.com/GHSA-6cj3-rc4p-f38f/): Cross-site Scripting vulnerabilities in Neos (not scored)
- [GHSA-6ccv-8fgf-cjpw](https://insights.sbomify.com/GHSA-6ccv-8fgf-cjpw/): Drupal core Denial of Service vulnerability (not scored)
- [GHSA-69p4-j5v5-x234](https://insights.sbomify.com/GHSA-69p4-j5v5-x234/): Server/API for Vela Insecure Variable Substitution (not scored)
- [GHSA-68c2-4mpx-qh95](https://insights.sbomify.com/GHSA-68c2-4mpx-qh95/): Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin (not scored)
- [GHSA-67wg-6j7r-mqh8](https://insights.sbomify.com/GHSA-67wg-6j7r-mqh8/): Arbitrary Code Execution in TYPO3 CMS (not scored)
- [GHSA-66fw-43h8-f8p3](https://insights.sbomify.com/GHSA-66fw-43h8-f8p3/): XMP Toolkit's `XmpFile::close` can trigger undefined behavior (not scored)
- [GHSA-66c2-7g4p-wx4p](https://insights.sbomify.com/GHSA-66c2-7g4p-wx4p/): TYPO3 Information Disclosure in Install Tool (not scored)
- [GHSA-65xh-hh78-6454](https://insights.sbomify.com/GHSA-65xh-hh78-6454/): Denial of Service in extension "Code Highlight" (codehighlight) (not scored)
- [GHSA-65v7-wg35-2qpm](https://insights.sbomify.com/GHSA-65v7-wg35-2qpm/): Sylius Resource Bundle Cross-Site Request Forgery vulnerability (not scored)
- [GHSA-64vj-933f-6pm3](https://insights.sbomify.com/GHSA-64vj-933f-6pm3/): eZ Platform Object Injection in SiteAccessMatchListener (not scored)
- [GHSA-64gp-r758-8pfm](https://insights.sbomify.com/GHSA-64gp-r758-8pfm/): Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment (not scored)
- [GHSA-6487-3qvg-8px9](https://insights.sbomify.com/GHSA-6487-3qvg-8px9/): TYPO3 Information Disclosure in Install Tool (not scored)
- [GHSA-635v-pc42-fr74](https://insights.sbomify.com/GHSA-635v-pc42-fr74/): AWS SageMaker Training Toolkit logs CodeArtifact Authorization token (not scored)
- [GHSA-62f6-h68r-3jpw](https://insights.sbomify.com/GHSA-62f6-h68r-3jpw/): Zendframework session validation vulnerability (not scored)
- [GHSA-5xr6-xhww-33m4](https://insights.sbomify.com/GHSA-5xr6-xhww-33m4/): Artifact poisoning vulnerability in action-download-artifact v5 and earlier (not scored)
- [GHSA-5xgj-pmjj-gw49](https://insights.sbomify.com/GHSA-5xgj-pmjj-gw49/): RISC Zero zkVM notes on zero-knowledge (not scored)
- [GHSA-5x4g-q5rc-36jp](https://insights.sbomify.com/GHSA-5x4g-q5rc-36jp/): Etcd pkg Insecure ciphers are allowed by default (not scored)
- [GHSA-5x28-3f32-x523](https://insights.sbomify.com/GHSA-5x28-3f32-x523/): Drupal core Access control bypass (not scored)
- [GHSA-5wx6-xwxf-q8qj](https://insights.sbomify.com/GHSA-5wx6-xwxf-q8qj/): Cross-Site Scripting in TYPO3 Backend (not scored)
- [GHSA-5vv7-j593-mgjc](https://insights.sbomify.com/GHSA-5vv7-j593-mgjc/): Neos Flow Arbitrary file upload and XML External Entity processing (not scored)
- [GHSA-5r8w-66hq-rc39](https://insights.sbomify.com/GHSA-5r8w-66hq-rc39/): silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled (not scored)
- [GHSA-5pf6-cq2v-23ww](https://insights.sbomify.com/GHSA-5pf6-cq2v-23ww/): WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service (not scored)
- [GHSA-5j86-5xvg-7q93](https://insights.sbomify.com/GHSA-5j86-5xvg-7q93/): TYPO3 Cross-Site Scripting (XSS) in form component (not scored)
- [GHSA-5h5v-m596-r6rf](https://insights.sbomify.com/GHSA-5h5v-m596-r6rf/): TYPO3 Possible Insecure Deserialization in Extbase Request Handling (not scored)
- [GHSA-5grr-72f9-678v](https://insights.sbomify.com/GHSA-5grr-72f9-678v/): Malware package cipherbcrypt (not scored)
- [GHSA-5gr6-97fv-52cc](https://insights.sbomify.com/GHSA-5gr6-97fv-52cc/): Cross-Site Scripting in TYPO3 CMS (not scored)
- [GHSA-5gmh-85x8-5cx7](https://insights.sbomify.com/GHSA-5gmh-85x8-5cx7/): Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities (not scored)
- [GHSA-5gmf-3c43-q73v](https://insights.sbomify.com/GHSA-5gmf-3c43-q73v/): ZendFramework vulnerable to Cross-site Scripting (not scored)
- [GHSA-5f5v-5c3v-gw5v](https://insights.sbomify.com/GHSA-5f5v-5c3v-gw5v/): Silverstripe IE requests not properly behaving with rewritehashlinks (not scored)
- [GHSA-5cxf-xx9j-54jc](https://insights.sbomify.com/GHSA-5cxf-xx9j-54jc/): Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend (not scored)
- [GHSA-593m-55hh-j8gv](https://insights.sbomify.com/GHSA-593m-55hh-j8gv/): Sentry SDK Prototype Pollution gadget in JavaScript SDKs (not scored)
- [GHSA-58xv-7h9r-mx3c](https://insights.sbomify.com/GHSA-58xv-7h9r-mx3c/): Drupal Malicious file upload with filenames stating with dot (not scored)
- [GHSA-58j9-j2fj-v8f4](https://insights.sbomify.com/GHSA-58j9-j2fj-v8f4/): SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface (not scored)
- [GHSA-564j-v29w-rqr6](https://insights.sbomify.com/GHSA-564j-v29w-rqr6/): Khoj Open Redirect Vulnerability in Login Page (not scored)
- [GHSA-55qg-6c4m-mw6g](https://insights.sbomify.com/GHSA-55qg-6c4m-mw6g/): silverstripe/framework's URL parameters `isDev` and `isTest` unguarded (not scored)
- [GHSA-55pp-293f-3365](https://insights.sbomify.com/GHSA-55pp-293f-3365/): silverstripe/userforms file upload exposure on UserForms module (not scored)
- [GHSA-55p7-v223-x366](https://insights.sbomify.com/GHSA-55p7-v223-x366/): IdentityServer Open Redirect vulnerability (not scored)
- [GHSA-555p-m4v6-cqxv](https://insights.sbomify.com/GHSA-555p-m4v6-cqxv/): ASA-2024-004: Default configuration param for Evidence may limit window of validity (not scored)
- [GHSA-534c-hcr7-67jg](https://insights.sbomify.com/GHSA-534c-hcr7-67jg/): Kimai has an XXE Leading to Local File Read (not scored)
- [GHSA-52xf-5p2m-9wrv](https://insights.sbomify.com/GHSA-52xf-5p2m-9wrv/): s2n-tls has a potentially observable differences in RSA premaster secret handling (not scored)
- [GHSA-52cx-hpc5-cxwc](https://insights.sbomify.com/GHSA-52cx-hpc5-cxwc/): silverstripe/framework missing ACL on reports (not scored)
- [GHSA-52cw-pvq9-9m5v](https://insights.sbomify.com/GHSA-52cw-pvq9-9m5v/): Silverstripe uses TinyMCE which allows svg files linked in object tags (not scored)
- [GHSA-4vf6-mq7w-3hp6](https://insights.sbomify.com/GHSA-4vf6-mq7w-3hp6/): Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed (not scored)
- [GHSA-4vf2-qfg3-7598](https://insights.sbomify.com/GHSA-4vf2-qfg3-7598/): symfony/validator XML Entity Expansion vulnerability (not scored)
- [GHSA-4v5g-8pq2-32m2](https://insights.sbomify.com/GHSA-4v5g-8pq2-32m2/): By-passing Protection of PharStreamWrapper Interceptor (not scored)
- [GHSA-4v57-pwvf-x35j](https://insights.sbomify.com/GHSA-4v57-pwvf-x35j/): Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` (not scored)
- [GHSA-4v52-7q2x-v4xj](https://insights.sbomify.com/GHSA-4v52-7q2x-v4xj/): Parts of Report are dropped as the wrong type during downcast (not scored)
- [GHSA-4rr6-gf59-ggw5](https://insights.sbomify.com/GHSA-4rr6-gf59-ggw5/): namshi/jose - Verification bypass (not scored)
- [GHSA-4r76-xr68-w7m7](https://insights.sbomify.com/GHSA-4r76-xr68-w7m7/): TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts (not scored)
- [GHSA-4qx8-j9vh-2628](https://insights.sbomify.com/GHSA-4qx8-j9vh-2628/): silverstripe/framework's User-Agent header not correctly invalidating user session (not scored)
- [GHSA-4qpj-gxxg-jqg4](https://insights.sbomify.com/GHSA-4qpj-gxxg-jqg4/): Swiftmailer Sendmail transport arbitrary shell execution (not scored)
- [GHSA-4ppr-jw47-9qm5](https://insights.sbomify.com/GHSA-4ppr-jw47-9qm5/): TYPO3 Cross-Site Scripting in Link Handling (not scored)
- [GHSA-4mw5-2636-4535](https://insights.sbomify.com/GHSA-4mw5-2636-4535/): op_panic in the base runtime can force a panic in the runtime's containing thread (not scored)
- [GHSA-4m3g-6r7g-jv4f](https://insights.sbomify.com/GHSA-4m3g-6r7g-jv4f/): Arbitrary JavaScript execution due to using outdated libraries (not scored)
- [GHSA-4jhj-3gv3-c3gr](https://insights.sbomify.com/GHSA-4jhj-3gv3-c3gr/): CLI for Vela Insecure Variable Substitution (not scored)
- [GHSA-4j9x-g4x8-vcmf](https://insights.sbomify.com/GHSA-4j9x-g4x8-vcmf/): ZendFramework potential XML eXternal Entity injection vectors (not scored)
- [GHSA-4j93-fm92-rp4m](https://insights.sbomify.com/GHSA-4j93-fm92-rp4m/): ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module (not scored)
- [GHSA-4h8f-c635-25p7](https://insights.sbomify.com/GHSA-4h8f-c635-25p7/): ibexa/post-install affected by Breach with Varnish VCL (not scored)
- [GHSA-4h5c-5g25-v7fh](https://insights.sbomify.com/GHSA-4h5c-5g25-v7fh/): TYPO3 Cross-Site Scripting in Form Framework (not scored)
- [GHSA-4h54-vwx9-3vr3](https://insights.sbomify.com/GHSA-4h54-vwx9-3vr3/): Silverstripe XSS In FormAction (not scored)
- [GHSA-4g2x-vq5p-5vj6](https://insights.sbomify.com/GHSA-4g2x-vq5p-5vj6/): Budibase affected by VM2 Constructor Escape Vulnerability (not scored)
- [GHSA-4cv2-xc5f-px8h](https://insights.sbomify.com/GHSA-4cv2-xc5f-px8h/): Denial of Service in extension "Code Highlight" (codehighlight) (not scored)
- [GHSA-4c2w-v5rq-5mx7](https://insights.sbomify.com/GHSA-4c2w-v5rq-5mx7/): eZ Platform Editor Cross-site Scripting (XSS) (not scored)
- [GHSA-486g-47cc-8wxf](https://insights.sbomify.com/GHSA-486g-47cc-8wxf/): aiocpa contains credential harvesting code (not scored)
- [GHSA-468j-6jrc-2rjx](https://insights.sbomify.com/GHSA-468j-6jrc-2rjx/): silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` (not scored)
- [GHSA-45xg-4w5x-j429](https://insights.sbomify.com/GHSA-45xg-4w5x-j429/): TYPO3 Arbitrary Shell Execution in Swiftmailer library (not scored)
- [GHSA-45wj-jv2h-jwrf](https://insights.sbomify.com/GHSA-45wj-jv2h-jwrf/): TYPO3 CMS Privilege Escalation and SQL Injection (not scored)
- [GHSA-45qm-j4m9-whv9](https://insights.sbomify.com/GHSA-45qm-j4m9-whv9/): eZ Platform CSRF token in login form is disabled by default (not scored)
- [GHSA-4542-p56h-8xww](https://insights.sbomify.com/GHSA-4542-p56h-8xww/): Cross-Site Scripting (XSS) vulnerabilities in Neos (not scored)
- [GHSA-44pg-c29v-hp6r](https://insights.sbomify.com/GHSA-44pg-c29v-hp6r/): Laravel Guard bypass in Eloquent models (not scored)
- [GHSA-4459-qrcc-vfcf](https://insights.sbomify.com/GHSA-4459-qrcc-vfcf/): TYPO3 Cross-Site Scripting in Form Framework (not scored)
- [GHSA-43cf-7f3h-38rg](https://insights.sbomify.com/GHSA-43cf-7f3h-38rg/): Privilege Escalation in TYPO3 Neos (not scored)
- [GHSA-3x57-m5p4-rgh4](https://insights.sbomify.com/GHSA-3x57-m5p4-rgh4/): ZendOpenID potential security issue in login mechanism (not scored)
- [GHSA-3vwr-jj4f-h98x](https://insights.sbomify.com/GHSA-3vwr-jj4f-h98x/): eZ Publish Remote code execution in file uploads (not scored)
- [GHSA-3vpc-4p9p-47hc](https://insights.sbomify.com/GHSA-3vpc-4p9p-47hc/): curl_cffi bundles a version of libcurl affected by High Severity vulnerability (not scored)
- [GHSA-3vhm-q4w3-rw8q](https://insights.sbomify.com/GHSA-3vhm-q4w3-rw8q/): OroPlatform Forced Redirect to External Website (not scored)
- [GHSA-3v33-3wmw-3785](https://insights.sbomify.com/GHSA-3v33-3wmw-3785/): yt-dlp has dependency on potentially malicious third-party code in Douyu extractors (not scored)
- [GHSA-3qx8-rv27-j6gp](https://insights.sbomify.com/GHSA-3qx8-rv27-j6gp/): Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device` (not scored)
- [GHSA-3qwc-47jf-5rf7](https://insights.sbomify.com/GHSA-3qwc-47jf-5rf7/): eth-abi is vulnerable to recursive DoS (not scored)
- [GHSA-3pg4-qwc8-426r](https://insights.sbomify.com/GHSA-3pg4-qwc8-426r/): OpenRefine leaks Google API credentials in releases (not scored)
- [GHSA-3mm9-2p44-rw39](https://insights.sbomify.com/GHSA-3mm9-2p44-rw39/): Silverstripe SiteTree Creation Permission Vulnerability (not scored)
- [GHSA-3jxq-5xhh-9jr3](https://insights.sbomify.com/GHSA-3jxq-5xhh-9jr3/): Cross-Site Scripting (XSS) in TYPO3 component Backend (not scored)
- [GHSA-3hpf-ff72-j67p](https://insights.sbomify.com/GHSA-3hpf-ff72-j67p/): shared_preferences_android vulnerability (not scored)
- [GHSA-3gjh-29fv-8hr6](https://insights.sbomify.com/GHSA-3gjh-29fv-8hr6/): Nervos CKB Snappy decompress length can be very large and causes out of memory error (not scored)
- [GHSA-3g43-xfrw-pv5m](https://insights.sbomify.com/GHSA-3g43-xfrw-pv5m/): eZ Platform User data disclosure (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/135/