Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 187 of 521.
- CVE-2024-5657 CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure
- CVE-2024-56569 ftrace: Fix regression with module command in stack_trace_filter
- CVE-2024-56568 iommu/arm-smmu: Defer probe of clients after smmu device bound
- CVE-2024-56567 ad7780: fix division by zero in ad7780_write_raw()
- CVE-2024-56566 mm/slub: Avoid list corruption when removing a slab from the full list
- CVE-2024-56565 f2fs: fix to drop all discards after creating snapshot on lvm device
- CVE-2024-56564 ceph: pass cred pointer to ceph_mds_auth_match()
- CVE-2024-56563 ceph: fix cred leak in ceph_mds_check_access()
- CVE-2024-56562 i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
- CVE-2024-56561 PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
- CVE-2024-56560 slab: Fix too strict alignment check in create_cache()
- CVE-2024-56559 mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
- CVE-2024-56558 nfsd: make sure exp active before svc_export_show
- CVE-2024-56557 iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
- CVE-2024-56556 binder: fix node UAF in binder_add_freeze_work()
- CVE-2024-56555 binder: fix OOB in binder_add_freeze_work()
- CVE-2024-56554 binder: fix freeze UAF in binder_release_work()
- CVE-2024-56553 binder: fix memleak of proc->delivered_freeze
- CVE-2024-56552 drm/xe/guc_submit: fix race around suspend_pending
- CVE-2024-56551 drm/amdgpu: fix usage slab after free
- CVE-2024-56550 s390/stacktrace: Use break instead of return statement
- CVE-2024-5655 Improper Access Control in GitLab
- CVE-2024-56549 cachefiles: Fix NULL pointer dereference in object->file
- CVE-2024-56548 hfsplus: don't query the device logical block size multiple times
- CVE-2024-56547 rcu/nocb: Fix missed RCU barrier on deoffloading
- CVE-2024-56546 drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
- CVE-2024-56545 HID: hyperv: streamline driver probe to avoid devres issues
- CVE-2024-56544 udmabuf: change folios array from kmalloc to kvmalloc
- CVE-2024-56543 wifi: ath12k: Skip Rx TID cleanup for self peer
- CVE-2024-56542 drm/amd/display: fix a memleak issue when driver is removed
- CVE-2024-56541 wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup()
- CVE-2024-56540 accel/ivpu: Prevent recovery invocation during probe and resume
- CVE-2024-5654 CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update
- CVE-2024-56539 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
- CVE-2024-56538 drm: zynqmp_kms: Unplug DRM device before removal
- CVE-2024-56537 drm: xlnx: zynqmp_disp: layer may be null while releasing
- CVE-2024-56536 wifi: cw1200: Fix potential NULL dereference
- CVE-2024-56535 wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
- CVE-2024-56534 isofs: avoid memory leak in iocharset
- CVE-2024-56533 ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
- CVE-2024-56532 ALSA: us122l: Use snd_card_free_when_closed() at disconnection
- CVE-2024-56531 ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
- CVE-2024-5653 Chanjet Smooth T+system keyEdit.aspx sql injection
- CVE-2024-56529 Mailcow through 2024-11b has a session fixation vulnerability in the web panel.
- CVE-2024-56528 Denial of service in snowplow:stream collector
- CVE-2024-56527 TCPDF missing character escape on error messages
- CVE-2024-56526 OXID eShop May Display User Information
- CVE-2024-56525 In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can c
- CVE-2024-56524 Security feature bypass in radware:cloud waf
- CVE-2024-56523 Security feature bypass in radware:cloud waf
- CVE-2024-56522 TCPDF has incorrect comparison
- CVE-2024-56521 TCPDF missing certificate validation
- CVE-2024-56520 tecnickcom/tc-lib-pdf-font mishandles fonts
- CVE-2024-5652 Denial of service in Docker Desktop
- CVE-2024-56519 TCPDF lacks SVG sanitization
- CVE-2024-56518 Code injection in hazelcast:management center
- CVE-2024-56517 LGSL has a reflected XSS at /lgsl_files/lgsl_list.php
- CVE-2024-56516 free-one-api uses md5 for password storage
- CVE-2024-56515 Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo
- CVE-2024-56514 Karmada Tar Slips in CRDs archive extraction
- CVE-2024-56513 Karmada PULL Mode Cluster Privilege Escalation
- CVE-2024-56512 Apache NiFi: Missing Complete Authorization for Parameter and Service References
- CVE-2024-56511 DataEase has an unauthorized vulnerability
- CVE-2024-56510 Marp Core allows XSS by improper neutralization of HTML sanitization
- CVE-2024-5651 Fence-agents-remediation: fence agent command line options leads to remote code execution
- CVE-2024-56509 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal
- CVE-2024-56508 File Upload Vulnerability Leading to XSS in LinkAce v1.15.5
- CVE-2024-56507 Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce
- CVE-2024-5650 Privilege escalation in CENTUM CS 3000
- CVE-2024-56497 Command injection in FortiMail
- CVE-2024-56496 IBM EntireX information disclosure
- CVE-2024-56495 IBM EntireX information disclosure
- CVE-2024-56494 IBM EntireX information disclosure
- CVE-2024-56493 IBM EntireX information disclosure
- CVE-2024-5649 Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-5648 LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update
- CVE-2024-56477 IBM Power Hardware Management Console directory traversal
- CVE-2024-56476 IBM TXSeries for Multiplatforms information disclosure
- CVE-2024-56475 IBM TXSeries for Multiplatforms cross-site scripting
- CVE-2024-56474 IBM TXSeries for Multiplatforms cross-site request forgery
- CVE-2024-56473 IBM Aspera Shares Data Manipulation
- CVE-2024-56472 IBM Aspera Shares Cross-Site Scripting
- CVE-2024-56471 IBM Aspera Shares Server-Side Request Forgery
- CVE-2024-56470 IBM Aspera Shares Server-Side Request Forgery
- CVE-2024-5647 Cross-site scripting in Betheme
- CVE-2024-56469 IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy missing authentication
- CVE-2024-56468 IBM InfoSphere Data Replication VSAM for z/OS Remote Source denial of service
- CVE-2024-56467 IBM EntireX information disclosure
- CVE-2024-56464 IBM QRadar SIEM is affected by an information disclosure vulnerability
- CVE-2024-56463 IBM QRadar SIEM cross-site scripting
- CVE-2024-56462 IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
- CVE-2024-5646 Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget
- CVE-2024-56456 Memory corruption in HarmonyOS
- CVE-2024-56455 Memory corruption in HarmonyOS
- CVE-2024-56454 Memory corruption in HarmonyOS
- CVE-2024-56453 Memory corruption in HarmonyOS
- CVE-2024-56452 Memory corruption in HarmonyOS
- CVE-2024-56451 Integer overflow in HarmonyOS
- CVE-2024-56450 Memory corruption in EMUI
- CVE-2024-5645 Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget