CVE-2024-32874

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-328756.1Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images CVE-2024-328768.5NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move theirCVE-2024-328774.7Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site ScriptinCVE-2024-328788.8Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free CVE-2024-328794.9Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MCVE-2024-32885.4The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attriCVE-2024-328807.2pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted CVE-2024-328819.8Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack CVE-2024-328822.7Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing thrCVE-2024-328837.7MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV (tag-length-value) structure to represent the meta data assoCVE-2024-328846.4gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` prCVE-2024-328864.9Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into
CVE-2024-32874: Medium severity, CVSS 6.8 | Vulnix