CVE Feed

    Dashboard / CVE / CVE-2024-3508

    CVE-2024-3508

    A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.

    Published:Apr 9, 2024
    Last Modified:Nov 20, 2025
    EPS:Apr 25, 2024
    EPSS Score:0.00273
    CVSS Score:4.3

    Affected Products

    Vendor
    Redhat
    Product
    Trusted Profile Analyzer

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-8556 (CVSS 3.7) — A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker …
    CVE-2025-4574 (CVSS 6.5) — In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could,…
    CVE-2025-3416 (CVSS 3.7) — A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can…
    CVE-2025-4432 (CVSS 5.3) — A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QU…
    CVE-2025-5791 (CVSS 7.1) — A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect gr…
    CVE-2025-21614 (CVSS 7.5) — go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnera…
    CVE-2025-21613 (CVSS 9.2) — go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerabili…
    CVE-2024-45338 (CVSS 5.3) — An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its…
    CVE-2024-45337 (CVSS 9.1) — Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicK…
    CVE-2024-21538 (CVSS 7.7) — Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expres…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High