# Vulnerabilities published in 2024


- [CVE-2024-57907](https://insights.sbomify.com/CVE-2024-57907/): iio: adc: rockchip_saradc: fix information leak in triggered buffer (high 7.1)
- [CVE-2024-57906](https://insights.sbomify.com/CVE-2024-57906/): iio: adc: ti-ads8688: fix information leak in triggered buffer (high 7.1)
- [CVE-2024-57905](https://insights.sbomify.com/CVE-2024-57905/): iio: adc: ti-ads1119: fix information leak in triggered buffer (high 7.1)
- [CVE-2024-57904](https://insights.sbomify.com/CVE-2024-57904/): iio: adc: at91: call input_free_device() on allocated iio_dev (high 7.8)
- [CVE-2024-57903](https://insights.sbomify.com/CVE-2024-57903/): net: restrict SO_REUSEPORT to inet sockets (medium 5.5)
- [CVE-2024-57902](https://insights.sbomify.com/CVE-2024-57902/): af_packet: fix vlan_get_tci() vs MSG_PEEK (high 7.3)
- [CVE-2024-57901](https://insights.sbomify.com/CVE-2024-57901/): af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (high 7.3)
- [CVE-2024-57900](https://insights.sbomify.com/CVE-2024-57900/): ila: serialize calls to nf_register_net_hooks() (high 7.8)
- [CVE-2024-5790](https://insights.sbomify.com/CVE-2024-5790/): Cross-site scripting in Happy Addons for Elementor (medium 6.4)
- [CVE-2024-57899](https://insights.sbomify.com/CVE-2024-57899/): wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (high 7.6)
- [CVE-2024-57898](https://insights.sbomify.com/CVE-2024-57898/): wifi: cfg80211: clear link ID from bitmap during link delete after clean up (low 3.3)
- [CVE-2024-57897](https://insights.sbomify.com/CVE-2024-57897/): drm/amdkfd: Correct the migration DMA map direction (medium 5.5)
- [CVE-2024-57896](https://insights.sbomify.com/CVE-2024-57896/): btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (high 7.8)
- [CVE-2024-57895](https://insights.sbomify.com/CVE-2024-57895/): ksmbd: set ATTR_CTIME flags when setting mtime (high 7.1)
- [CVE-2024-57893](https://insights.sbomify.com/CVE-2024-57893/): ALSA: seq: oss: Fix races at processing SysEx messages (high 7.8)
- [CVE-2024-57892](https://insights.sbomify.com/CVE-2024-57892/): ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (high 7.8)
- [CVE-2024-57891](https://insights.sbomify.com/CVE-2024-57891/): sched_ext: Fix invalid irq restore in scx_ops_bypass() (medium 5.5)
- [CVE-2024-57890](https://insights.sbomify.com/CVE-2024-57890/): RDMA/uverbs: Prevent integer overflow issue (medium 5.5)
- [CVE-2024-5789](https://insights.sbomify.com/CVE-2024-5789/): Triton Lite <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-57889](https://insights.sbomify.com/CVE-2024-57889/): pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (medium 5.5)
- [CVE-2024-57888](https://insights.sbomify.com/CVE-2024-57888/): workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (medium 5.5)
- [CVE-2024-57887](https://insights.sbomify.com/CVE-2024-57887/): drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (high 7.8)
- [CVE-2024-57886](https://insights.sbomify.com/CVE-2024-57886/): mm/damon/core: fix new damon_target objects leaks on damon_commit_targets() (medium 5.5)
- [CVE-2024-57885](https://insights.sbomify.com/CVE-2024-57885/): mm/kmemleak: fix sleeping function called from invalid context at print message (medium 5.5)
- [CVE-2024-57884](https://insights.sbomify.com/CVE-2024-57884/): mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (medium 5.5)
- [CVE-2024-57883](https://insights.sbomify.com/CVE-2024-57883/): mm: hugetlb: independent PMD page table shared count (high 7.8)
- [CVE-2024-57882](https://insights.sbomify.com/CVE-2024-57882/): mptcp: fix TCP options overflow. (critical 9.8)
- [CVE-2024-57881](https://insights.sbomify.com/CVE-2024-57881/): mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() (medium 5.5)
- [CVE-2024-57880](https://insights.sbomify.com/CVE-2024-57880/): ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array (medium 5.5)
- [CVE-2024-5788](https://insights.sbomify.com/CVE-2024-5788/): Silesia <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-57879](https://insights.sbomify.com/CVE-2024-57879/): Bluetooth: iso: Always release hdev at the end of iso_listen_bis (medium 5.5)
- [CVE-2024-57878](https://insights.sbomify.com/CVE-2024-57878/): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR (medium 6.1)
- [CVE-2024-57877](https://insights.sbomify.com/CVE-2024-57877/): arm64: ptrace: fix partial SETREGSET for NT_ARM_POE (medium 6.1)
- [CVE-2024-57876](https://insights.sbomify.com/CVE-2024-57876/): drm/dp_mst: Fix resetting msg rx state after topology removal (high 7.0)
- [CVE-2024-57875](https://insights.sbomify.com/CVE-2024-57875/): block: RCU protect disk->conv_zones_bitmap (high 7.8)
- [CVE-2024-57874](https://insights.sbomify.com/CVE-2024-57874/): arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL (medium 6.1)
- [CVE-2024-57872](https://insights.sbomify.com/CVE-2024-57872/): scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() (medium 5.5)
- [CVE-2024-5787](https://insights.sbomify.com/CVE-2024-5787/): Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (medium 6.4)
- [CVE-2024-57868](https://insights.sbomify.com/CVE-2024-57868/): Web::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions (medium 5.5)
- [CVE-2024-5786](https://insights.sbomify.com/CVE-2024-5786/): Cross-Site Request Forgery vulnerability in Comtrend router (medium 6.5)
- [CVE-2024-57857](https://insights.sbomify.com/CVE-2024-57857/): RDMA/siw: Remove direct link to net_device (high 7.8)
- [CVE-2024-57854](https://insights.sbomify.com/CVE-2024-57854/): Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator (critical 9.1)
- [CVE-2024-57852](https://insights.sbomify.com/CVE-2024-57852/): firmware: qcom: scm: smc: Handle missing SCM device (medium 5.5)
- [CVE-2024-57850](https://insights.sbomify.com/CVE-2024-57850/): jffs2: Prevent rtime decompress memory corruption (high 7.8)
- [CVE-2024-5785](https://insights.sbomify.com/CVE-2024-5785/): Command injection vulnerability in Comtrend router (high 8.0)
- [CVE-2024-57849](https://insights.sbomify.com/CVE-2024-57849/): s390/cpum_sf: Handle CPU hotplug remove during sampling (high 7.8)
- [CVE-2024-57844](https://insights.sbomify.com/CVE-2024-57844/): drm/xe: Fix fault on fd close after unbind (medium 5.5)
- [CVE-2024-57843](https://insights.sbomify.com/CVE-2024-57843/): virtio-net: fix overflow inside virtnet_rq_alloc (critical 9.8)
- [CVE-2024-57841](https://insights.sbomify.com/CVE-2024-57841/): net: fix memory leak in tcp_conn_request() (medium 5.5)
- [CVE-2024-5784](https://insights.sbomify.com/CVE-2024-5784/): Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference (high 7.1)
- [CVE-2024-57839](https://insights.sbomify.com/CVE-2024-57839/): Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" (medium 5.5)
- [CVE-2024-57838](https://insights.sbomify.com/CVE-2024-57838/): s390/entry: Mark IRQ entries to fix stack depot warnings (high 7.1)
- [CVE-2024-57835](https://insights.sbomify.com/CVE-2024-57835/): Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions (medium 5.5)
- [CVE-2024-57834](https://insights.sbomify.com/CVE-2024-57834/): media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread (medium 5.5)
- [CVE-2024-57823](https://insights.sbomify.com/CVE-2024-57823/): Integer overflow in Raptor RDF Syntax Library (critical 9.3)
- [CVE-2024-57822](https://insights.sbomify.com/CVE-2024-57822/): Memory corruption in Raptor RDF Syntax Library (medium 4.0)
- [CVE-2024-57811](https://insights.sbomify.com/CVE-2024-57811/): In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. (critical 9.1)
- [CVE-2024-57809](https://insights.sbomify.com/CVE-2024-57809/): PCI: imx6: Fix suspend/resume support on i.MX6QDL (medium 5.5)
- [CVE-2024-57807](https://insights.sbomify.com/CVE-2024-57807/): scsi: megaraid_sas: Fix for a potential deadlock (medium 5.5)
- [CVE-2024-57806](https://insights.sbomify.com/CVE-2024-57806/): btrfs: fix transaction atomicity bug when enabling simple quotas (medium 5.5)
- [CVE-2024-57805](https://insights.sbomify.com/CVE-2024-57805/): ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP (medium 5.5)
- [CVE-2024-57804](https://insights.sbomify.com/CVE-2024-57804/): scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (high 7.3)
- [CVE-2024-57802](https://insights.sbomify.com/CVE-2024-57802/): netrom: check buffer length before accessing it (critical 9.4)
- [CVE-2024-57801](https://insights.sbomify.com/CVE-2024-57801/): net/mlx5e: Skip restore TC rules for vport rep without loaded flag (high 7.8)
- [CVE-2024-57800](https://insights.sbomify.com/CVE-2024-57800/): ALSA: memalloc: prefer dma_mapping_error() over explicit address checking (medium 5.5)
- [CVE-2024-57799](https://insights.sbomify.com/CVE-2024-57799/): phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM (medium 5.5)
- [CVE-2024-57798](https://insights.sbomify.com/CVE-2024-57798/): drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (high 7.8)
- [CVE-2024-57795](https://insights.sbomify.com/CVE-2024-57795/): RDMA/rxe: Remove the direct link to net_device (high 7.8)
- [CVE-2024-57793](https://insights.sbomify.com/CVE-2024-57793/): virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (critical 9.3)
- [CVE-2024-57792](https://insights.sbomify.com/CVE-2024-57792/): power: supply: gpio-charger: Fix set charge current limits (high 7.3)
- [CVE-2024-57791](https://insights.sbomify.com/CVE-2024-57791/): net/smc: check return value of sock_recvmsg when draining clc data (high 7.5)
- [CVE-2024-57790](https://insights.sbomify.com/CVE-2024-57790/): IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. (medium 5.4)
- [CVE-2024-57785](https://insights.sbomify.com/CVE-2024-57785/): Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php. (medium 4.9)
- [CVE-2024-57784](https://insights.sbomify.com/CVE-2024-57784/): An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal. (medium 5.5)
- [CVE-2024-57783](https://insights.sbomify.com/CVE-2024-57783/): Cross-site scripting in Dot (high 8.1)
- [CVE-2024-57782](https://insights.sbomify.com/CVE-2024-57782/): An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service. (medium 6.8)
- [CVE-2024-57778](https://insights.sbomify.com/CVE-2024-57778/): An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from st (high 8.8)
- [CVE-2024-57777](https://insights.sbomify.com/CVE-2024-57777/): Path traversal in lanproxy project:lanproxy (medium 5.1)
- [CVE-2024-57776](https://insights.sbomify.com/CVE-2024-57776/): Cross-site scripting in jfinaloa project:jfinaloa (medium 4.6)
- [CVE-2024-57775](https://insights.sbomify.com/CVE-2024-57775/): SQL injection in jfinaloa project:jfinaloa (high 8.8)
- [CVE-2024-57774](https://insights.sbomify.com/CVE-2024-57774/): Cross-site scripting in jfinaloa project:jfinaloa (medium 4.8)
- [CVE-2024-57773](https://insights.sbomify.com/CVE-2024-57773/): Cross-site scripting in jfinaloa project:jfinaloa (medium 4.8)
- [CVE-2024-57772](https://insights.sbomify.com/CVE-2024-57772/): Cross-site scripting in jfinaloa project:jfinaloa (medium 4.8)
- [CVE-2024-57771](https://insights.sbomify.com/CVE-2024-57771/): Cross-site scripting in jfinaloa project:jfinaloa (medium 4.8)
- [CVE-2024-57770](https://insights.sbomify.com/CVE-2024-57770/): SQL injection in jfinaloa project:jfinaloa (high 8.8)
- [CVE-2024-57769](https://insights.sbomify.com/CVE-2024-57769/): SQL injection in jfinaloa project:jfinaloa (high 8.8)
- [CVE-2024-57768](https://insights.sbomify.com/CVE-2024-57768/): SQL injection in jfinaloa project:jfinaloa (critical 9.8)
- [CVE-2024-57767](https://insights.sbomify.com/CVE-2024-57767/): Server-side request forgery in wangl1989:mysiteforme (high 8.6)
- [CVE-2024-57766](https://insights.sbomify.com/CVE-2024-57766/): Deserialization in wangl1989:mysiteforme (critical 9.1)
- [CVE-2024-57765](https://insights.sbomify.com/CVE-2024-57765/): SQL injection in wangl1989:mysiteforme (high 7.5)
- [CVE-2024-57764](https://insights.sbomify.com/CVE-2024-57764/): Deserialization in wangl1989:mysiteforme (critical 9.1)
- [CVE-2024-57763](https://insights.sbomify.com/CVE-2024-57763/): Deserialization in wangl1989:mysiteforme (critical 9.1)
- [CVE-2024-57762](https://insights.sbomify.com/CVE-2024-57762/): Deserialization in wangl1989:mysiteforme (high 7.5)
- [CVE-2024-57761](https://insights.sbomify.com/CVE-2024-57761/): File upload in huayi-tec:jeewms (high 8.1)
- [CVE-2024-57760](https://insights.sbomify.com/CVE-2024-57760/): SQL injection in jeewms:jeewms (medium 6.5)
- [CVE-2024-57757](https://insights.sbomify.com/CVE-2024-57757/): Auth bypass in jeewms:jeewms (high 7.5)
- [CVE-2024-5775](https://insights.sbomify.com/CVE-2024-5775/): SourceCodester Vehicle Management System updatebill.php sql injection (medium 6.9)
- [CVE-2024-5774](https://insights.sbomify.com/CVE-2024-5774/): SourceCodester Stock Management System Login index.php sql injection (medium 6.9)
- [CVE-2024-5773](https://insights.sbomify.com/CVE-2024-5773/): Netentsec NS-ASG Application Security Gateway deletemacbind.php sql injection (medium 5.3)
- [CVE-2024-57728](https://insights.sbomify.com/CVE-2024-57728/): SimpleHelp Path Traversal (high 7.2, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/179/