# Vulnerabilities published in 2024


- [CVE-2024-56755](https://insights.sbomify.com/CVE-2024-56755/): netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING (medium 5.5)
- [CVE-2024-56754](https://insights.sbomify.com/CVE-2024-56754/): crypto: caam - Fix the pointer passed to caam_qi_shutdown() (medium 5.5)
- [CVE-2024-56753](https://insights.sbomify.com/CVE-2024-56753/): drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module (medium 5.5)
- [CVE-2024-56752](https://insights.sbomify.com/CVE-2024-56752/): drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() (medium 5.5)
- [CVE-2024-56751](https://insights.sbomify.com/CVE-2024-56751/): ipv6: release nexthop on device removal (medium 5.5)
- [CVE-2024-56750](https://insights.sbomify.com/CVE-2024-56750/): erofs: fix blksize < PAGE_SIZE for file-backed mounts (medium 5.5)
- [CVE-2024-5675](https://insights.sbomify.com/CVE-2024-5675/): Unreliable data deserialization vulnerability in Mentor (critical 10.0)
- [CVE-2024-56749](https://insights.sbomify.com/CVE-2024-56749/): dlm: fix dlm_recover_members refcount on error (high 7.5)
- [CVE-2024-56748](https://insights.sbomify.com/CVE-2024-56748/): scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (low 3.3)
- [CVE-2024-56747](https://insights.sbomify.com/CVE-2024-56747/): scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (low 3.3)
- [CVE-2024-56746](https://insights.sbomify.com/CVE-2024-56746/): fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() (low 3.3)
- [CVE-2024-56745](https://insights.sbomify.com/CVE-2024-56745/): PCI: Fix reset_method_store() memory leak (low 3.3)
- [CVE-2024-56744](https://insights.sbomify.com/CVE-2024-56744/): f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() (medium 5.5)
- [CVE-2024-56743](https://insights.sbomify.com/CVE-2024-56743/): nfs_common: must not hold RCU while calling nfsd_file_put_local (medium 5.5)
- [CVE-2024-56742](https://insights.sbomify.com/CVE-2024-56742/): vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (low 3.3)
- [CVE-2024-56740](https://insights.sbomify.com/CVE-2024-56740/): nfs/localio: must clear res.replen in nfs_local_read_done (high 7.8)
- [CVE-2024-5674](https://insights.sbomify.com/CVE-2024-5674/): Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers Management (medium 6.5)
- [CVE-2024-56739](https://insights.sbomify.com/CVE-2024-56739/): rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (medium 5.5)
- [CVE-2024-56738](https://insights.sbomify.com/CVE-2024-56738/): Weak cryptography in GRUB2 (medium 5.3)
- [CVE-2024-56737](https://insights.sbomify.com/CVE-2024-56737/): Memory corruption in GRUB2 (high 8.8)
- [CVE-2024-56736](https://insights.sbomify.com/CVE-2024-56736/): Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss (medium 6.5)
- [CVE-2024-56734](https://insights.sbomify.com/CVE-2024-56734/): Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint (high 7.9)
- [CVE-2024-56733](https://insights.sbomify.com/CVE-2024-56733/): Password Pusher Allows Session Token Interception Leading to Potential Hijacking (medium 5.7)
- [CVE-2024-56732](https://insights.sbomify.com/CVE-2024-56732/): HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer (critical 9.3)
- [CVE-2024-56731](https://insights.sbomify.com/CVE-2024-56731/): Gogs deletion of internal files allows remote command execution (critical 10.0)
- [CVE-2024-56730](https://insights.sbomify.com/CVE-2024-56730/): net/9p/usbg: fix handling of the failed kzalloc() memory allocation (medium 5.5)
- [CVE-2024-5673](https://insights.sbomify.com/CVE-2024-5673/): Cross-Site Scripting in PHP File Manager by Dulldusk (medium 6.1)
- [CVE-2024-56729](https://insights.sbomify.com/CVE-2024-56729/): smb: Initialize cfid->tcon before performing network ops (medium 4.7)
- [CVE-2024-56728](https://insights.sbomify.com/CVE-2024-56728/): octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c (medium 5.5)
- [CVE-2024-56727](https://insights.sbomify.com/CVE-2024-56727/): octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (medium 5.5)
- [CVE-2024-56726](https://insights.sbomify.com/CVE-2024-56726/): octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c (medium 5.5)
- [CVE-2024-56725](https://insights.sbomify.com/CVE-2024-56725/): octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c (medium 5.5)
- [CVE-2024-56724](https://insights.sbomify.com/CVE-2024-56724/): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (medium 5.5)
- [CVE-2024-56723](https://insights.sbomify.com/CVE-2024-56723/): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (medium 5.5)
- [CVE-2024-56722](https://insights.sbomify.com/CVE-2024-56722/): RDMA/hns: Fix cpu stuck caused by printings during reset (medium 5.5)
- [CVE-2024-56721](https://insights.sbomify.com/CVE-2024-56721/): x86/CPU/AMD: Terminate the erratum_1386_microcode array (high 7.1)
- [CVE-2024-56720](https://insights.sbomify.com/CVE-2024-56720/): bpf, sockmap: Several fixes to bpf_msg_pop_data (high 7.8)
- [CVE-2024-5672](https://insights.sbomify.com/CVE-2024-5672/): Red Lion Europe: mbNET.mini vulnerable to OS command injection (high 7.2)
- [CVE-2024-56719](https://insights.sbomify.com/CVE-2024-56719/): net: stmmac: fix TSO DMA API usage causing oops (critical 10.0)
- [CVE-2024-56718](https://insights.sbomify.com/CVE-2024-56718/): net/smc: protect link down work from execute after lgr freed (critical 9.8)
- [CVE-2024-56717](https://insights.sbomify.com/CVE-2024-56717/): net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic() (high 7.5)
- [CVE-2024-56716](https://insights.sbomify.com/CVE-2024-56716/): netdevsim: prevent bad user input in nsim_dev_health_break_write() (medium 5.5)
- [CVE-2024-56715](https://insights.sbomify.com/CVE-2024-56715/): ionic: Fix netdev notifier unregister on failure (high 7.8)
- [CVE-2024-56714](https://insights.sbomify.com/CVE-2024-56714/): ionic: no double destroy workqueue (medium 5.5)
- [CVE-2024-56713](https://insights.sbomify.com/CVE-2024-56713/): net: netdevsim: fix nsim_pp_hold_write() (medium 5.5)
- [CVE-2024-56712](https://insights.sbomify.com/CVE-2024-56712/): udmabuf: fix memory leak on last export_udmabuf() error path (low 3.3)
- [CVE-2024-56711](https://insights.sbomify.com/CVE-2024-56711/): drm/panel: himax-hx83102: Add a check to prevent NULL pointer dereference (medium 5.5)
- [CVE-2024-56710](https://insights.sbomify.com/CVE-2024-56710/): ceph: fix memory leak in ceph_direct_read_write() (low 3.3)
- [CVE-2024-5671](https://insights.sbomify.com/CVE-2024-5671/): Deserialization in Intrusion Prevention System (IPS) Manager (critical 9.8)
- [CVE-2024-56709](https://insights.sbomify.com/CVE-2024-56709/): io_uring: check if iowq is killed before queuing (high 7.8)
- [CVE-2024-56708](https://insights.sbomify.com/CVE-2024-56708/): EDAC/igen6: Avoid segmentation fault on module unload (high 7.8)
- [CVE-2024-56707](https://insights.sbomify.com/CVE-2024-56707/): octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c (medium 5.5)
- [CVE-2024-56706](https://insights.sbomify.com/CVE-2024-56706/): s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex (high 7.8)
- [CVE-2024-56705](https://insights.sbomify.com/CVE-2024-56705/): media: atomisp: Add check for rgby_data memory allocation failure (medium 5.5)
- [CVE-2024-56704](https://insights.sbomify.com/CVE-2024-56704/): 9p/xen: fix release of IRQ (high 8.4)
- [CVE-2024-56703](https://insights.sbomify.com/CVE-2024-56703/): ipv6: Fix soft lockups in fib6_select_path under high next hop churn (high 7.5)
- [CVE-2024-56702](https://insights.sbomify.com/CVE-2024-56702/): bpf: Mark raw_tp arguments with PTR_MAYBE_NULL (medium 5.5)
- [CVE-2024-56701](https://insights.sbomify.com/CVE-2024-56701/): powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (medium 5.5)
- [CVE-2024-56700](https://insights.sbomify.com/CVE-2024-56700/): media: wl128x: Fix atomicity violation in fmc_send_cmd() (medium 5.5)
- [CVE-2024-5670](https://insights.sbomify.com/CVE-2024-5670/): Softnext Mail SQR Expert and Mail Archiving Expert - OS Command Injection (critical 9.8)
- [CVE-2024-56699](https://insights.sbomify.com/CVE-2024-56699/): s390/pci: Fix potential double remove of hotplug slot (high 7.8)
- [CVE-2024-56698](https://insights.sbomify.com/CVE-2024-56698/): usb: dwc3: gadget: Fix looping of queued SG entries (medium 5.5)
- [CVE-2024-56697](https://insights.sbomify.com/CVE-2024-56697/): drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info() (medium 5.5)
- [CVE-2024-56696](https://insights.sbomify.com/CVE-2024-56696/): ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc() (medium 5.5)
- [CVE-2024-56695](https://insights.sbomify.com/CVE-2024-56695/): drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()' (high 7.8)
- [CVE-2024-56694](https://insights.sbomify.com/CVE-2024-56694/): bpf: fix recursive lock when verdict program return SK_PASS (high 7.5)
- [CVE-2024-56693](https://insights.sbomify.com/CVE-2024-56693/): brd: defer automatic disk creation until module initialization succeeds (high 7.8)
- [CVE-2024-56692](https://insights.sbomify.com/CVE-2024-56692/): f2fs: fix to do sanity check on node blkaddr in truncate_node() (high 7.8)
- [CVE-2024-56691](https://insights.sbomify.com/CVE-2024-56691/): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (medium 5.5)
- [CVE-2024-56690](https://insights.sbomify.com/CVE-2024-56690/): crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (medium 5.5)
- [CVE-2024-5669](https://insights.sbomify.com/CVE-2024-5669/): Missing authorization in Happy WooCommerce FAQs – Ultimate Product FAQ Plugin (medium 6.4)
- [CVE-2024-56689](https://insights.sbomify.com/CVE-2024-56689/): PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' (medium 5.5)
- [CVE-2024-56688](https://insights.sbomify.com/CVE-2024-56688/): sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (high 7.5)
- [CVE-2024-56687](https://insights.sbomify.com/CVE-2024-56687/): usb: musb: Fix hardware lockup on first Rx endpoint request (medium 5.5)
- [CVE-2024-56685](https://insights.sbomify.com/CVE-2024-56685/): ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe (medium 5.5)
- [CVE-2024-56684](https://insights.sbomify.com/CVE-2024-56684/): mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() (high 8.4)
- [CVE-2024-56683](https://insights.sbomify.com/CVE-2024-56683/): drm/vc4: hdmi: Avoid hang with debug registers when suspended (medium 5.5)
- [CVE-2024-56682](https://insights.sbomify.com/CVE-2024-56682/): irqchip/riscv-aplic: Prevent crash when MSI domain is missing (medium 5.5)
- [CVE-2024-56681](https://insights.sbomify.com/CVE-2024-56681/): crypto: bcm - add error check in the ahash_hmac_init function (high 7.8)
- [CVE-2024-56680](https://insights.sbomify.com/CVE-2024-56680/): media: intel/ipu6: do not handle interrupts when device is disabled (medium 5.5)
- [CVE-2024-5668](https://insights.sbomify.com/CVE-2024-5668/): Cross-site scripting in Lightbox & Modal Popup WordPress Plugin – FooBox (medium 6.4)
- [CVE-2024-56679](https://insights.sbomify.com/CVE-2024-56679/): octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c (medium 5.5)
- [CVE-2024-56678](https://insights.sbomify.com/CVE-2024-56678/): powerpc/mm/fault: Fix kfence page fault reporting (high 7.8)
- [CVE-2024-56677](https://insights.sbomify.com/CVE-2024-56677/): powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() (high 7.8)
- [CVE-2024-56676](https://insights.sbomify.com/CVE-2024-56676/): thermal: testing: Initialize some variables annoteded with _free() (medium 5.5)
- [CVE-2024-56675](https://insights.sbomify.com/CVE-2024-56675/): bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (high 7.8)
- [CVE-2024-56674](https://insights.sbomify.com/CVE-2024-56674/): virtio_net: correct netdev_tx_reset_queue() invocation point (medium 5.5)
- [CVE-2024-56673](https://insights.sbomify.com/CVE-2024-56673/): riscv: mm: Do not call pmd dtor on vmemmap page table teardown (medium 5.5)
- [CVE-2024-56672](https://insights.sbomify.com/CVE-2024-56672/): blk-cgroup: Fix UAF in blkcg_unpin_online() (high 7.8)
- [CVE-2024-56671](https://insights.sbomify.com/CVE-2024-56671/): gpio: graniterapids: Fix vGPIO driver crash (medium 5.5)
- [CVE-2024-56670](https://insights.sbomify.com/CVE-2024-56670/): usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (medium 5.5)
- [CVE-2024-5667](https://insights.sbomify.com/CVE-2024-5667/): Cross-site scripting in Responsive Lightbox & Gallery (medium 6.4)
- [CVE-2024-56669](https://insights.sbomify.com/CVE-2024-56669/): iommu/vt-d: Remove cache tags before disabling ATS (high 8.8)
- [CVE-2024-56668](https://insights.sbomify.com/CVE-2024-56668/): iommu/vt-d: Fix qi_batch NULL pointer with nested parent domain (medium 5.5)
- [CVE-2024-56667](https://insights.sbomify.com/CVE-2024-56667/): drm/i915: Fix NULL pointer dereference in capture_engine (medium 5.5)
- [CVE-2024-56666](https://insights.sbomify.com/CVE-2024-56666/): drm/amdkfd: Dereference null return value (medium 5.5)
- [CVE-2024-56665](https://insights.sbomify.com/CVE-2024-56665/): bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog (medium 5.5)
- [CVE-2024-56664](https://insights.sbomify.com/CVE-2024-56664/): bpf, sockmap: Fix race between element replace and close() (high 7.8)
- [CVE-2024-56663](https://insights.sbomify.com/CVE-2024-56663/): wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (high 7.8)
- [CVE-2024-56662](https://insights.sbomify.com/CVE-2024-56662/): acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/185/