# Vulnerabilities published in 2024


- [CVE-2024-5657](https://insights.sbomify.com/CVE-2024-5657/): CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure (low 3.7)
- [CVE-2024-56569](https://insights.sbomify.com/CVE-2024-56569/): ftrace: Fix regression with module command in stack_trace_filter (medium 5.5)
- [CVE-2024-56568](https://insights.sbomify.com/CVE-2024-56568/): iommu/arm-smmu: Defer probe of clients after smmu device bound (medium 4.7)
- [CVE-2024-56567](https://insights.sbomify.com/CVE-2024-56567/): ad7780: fix division by zero in ad7780_write_raw() (medium 5.5)
- [CVE-2024-56566](https://insights.sbomify.com/CVE-2024-56566/): mm/slub: Avoid list corruption when removing a slab from the full list (medium 5.5)
- [CVE-2024-56565](https://insights.sbomify.com/CVE-2024-56565/): f2fs: fix to drop all discards after creating snapshot on lvm device (medium 5.5)
- [CVE-2024-56564](https://insights.sbomify.com/CVE-2024-56564/): ceph: pass cred pointer to ceph_mds_auth_match() (medium 5.5)
- [CVE-2024-56563](https://insights.sbomify.com/CVE-2024-56563/): ceph: fix cred leak in ceph_mds_check_access() (high 7.8)
- [CVE-2024-56562](https://insights.sbomify.com/CVE-2024-56562/): i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() (medium 5.5)
- [CVE-2024-56561](https://insights.sbomify.com/CVE-2024-56561/): PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy() (high 7.8)
- [CVE-2024-56560](https://insights.sbomify.com/CVE-2024-56560/): slab: Fix too strict alignment check in create_cache() (medium 5.5)
- [CVE-2024-56559](https://insights.sbomify.com/CVE-2024-56559/): mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation (medium 5.5)
- [CVE-2024-56558](https://insights.sbomify.com/CVE-2024-56558/): nfsd: make sure exp active before svc_export_show (high 7.8)
- [CVE-2024-56557](https://insights.sbomify.com/CVE-2024-56557/): iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer (high 7.8)
- [CVE-2024-56556](https://insights.sbomify.com/CVE-2024-56556/): binder: fix node UAF in binder_add_freeze_work() (high 7.8)
- [CVE-2024-56555](https://insights.sbomify.com/CVE-2024-56555/): binder: fix OOB in binder_add_freeze_work() (high 7.8)
- [CVE-2024-56554](https://insights.sbomify.com/CVE-2024-56554/): binder: fix freeze UAF in binder_release_work() (high 7.8)
- [CVE-2024-56553](https://insights.sbomify.com/CVE-2024-56553/): binder: fix memleak of proc->delivered_freeze (low 3.3)
- [CVE-2024-56552](https://insights.sbomify.com/CVE-2024-56552/): drm/xe/guc_submit: fix race around suspend_pending (high 7.8)
- [CVE-2024-56551](https://insights.sbomify.com/CVE-2024-56551/): drm/amdgpu: fix usage slab after free (high 7.8)
- [CVE-2024-56550](https://insights.sbomify.com/CVE-2024-56550/): s390/stacktrace: Use break instead of return statement (medium 5.5)
- [CVE-2024-5655](https://insights.sbomify.com/CVE-2024-5655/): Improper Access Control in GitLab (critical 9.6)
- [CVE-2024-56549](https://insights.sbomify.com/CVE-2024-56549/): cachefiles: Fix NULL pointer dereference in object->file (high 7.8)
- [CVE-2024-56548](https://insights.sbomify.com/CVE-2024-56548/): hfsplus: don't query the device logical block size multiple times (high 7.8)
- [CVE-2024-56547](https://insights.sbomify.com/CVE-2024-56547/): rcu/nocb: Fix missed RCU barrier on deoffloading (medium 4.7)
- [CVE-2024-56546](https://insights.sbomify.com/CVE-2024-56546/): drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend() (medium 5.5)
- [CVE-2024-56545](https://insights.sbomify.com/CVE-2024-56545/): HID: hyperv: streamline driver probe to avoid devres issues (medium 5.5)
- [CVE-2024-56544](https://insights.sbomify.com/CVE-2024-56544/): udmabuf: change folios array from kmalloc to kvmalloc (medium 5.5)
- [CVE-2024-56543](https://insights.sbomify.com/CVE-2024-56543/): wifi: ath12k: Skip Rx TID cleanup for self peer (medium 5.5)
- [CVE-2024-56542](https://insights.sbomify.com/CVE-2024-56542/): drm/amd/display: fix a memleak issue when driver is removed (medium 5.5)
- [CVE-2024-56541](https://insights.sbomify.com/CVE-2024-56541/): wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup() (high 7.8)
- [CVE-2024-56540](https://insights.sbomify.com/CVE-2024-56540/): accel/ivpu: Prevent recovery invocation during probe and resume (high 7.8)
- [CVE-2024-5654](https://insights.sbomify.com/CVE-2024-5654/): CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update (medium 6.5)
- [CVE-2024-56539](https://insights.sbomify.com/CVE-2024-56539/): wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() (medium 5.5)
- [CVE-2024-56538](https://insights.sbomify.com/CVE-2024-56538/): drm: zynqmp_kms: Unplug DRM device before removal (high 7.8)
- [CVE-2024-56537](https://insights.sbomify.com/CVE-2024-56537/): drm: xlnx: zynqmp_disp: layer may be null while releasing (medium 5.5)
- [CVE-2024-56536](https://insights.sbomify.com/CVE-2024-56536/): wifi: cw1200: Fix potential NULL dereference (medium 5.5)
- [CVE-2024-56535](https://insights.sbomify.com/CVE-2024-56535/): wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() (medium 5.5)
- [CVE-2024-56534](https://insights.sbomify.com/CVE-2024-56534/): isofs: avoid memory leak in iocharset (medium 5.5)
- [CVE-2024-56533](https://insights.sbomify.com/CVE-2024-56533/): ALSA: usx2y: Use snd_card_free_when_closed() at disconnection (medium 5.5)
- [CVE-2024-56532](https://insights.sbomify.com/CVE-2024-56532/): ALSA: us122l: Use snd_card_free_when_closed() at disconnection (medium 5.5)
- [CVE-2024-56531](https://insights.sbomify.com/CVE-2024-56531/): ALSA: caiaq: Use snd_card_free_when_closed() at disconnection (high 7.8)
- [CVE-2024-5653](https://insights.sbomify.com/CVE-2024-5653/): Chanjet Smooth T+system keyEdit.aspx sql injection (medium 6.9)
- [CVE-2024-56529](https://insights.sbomify.com/CVE-2024-56529/): Mailcow through 2024-11b has a session fixation vulnerability in the web panel. (high 7.1)
- [CVE-2024-56528](https://insights.sbomify.com/CVE-2024-56528/): Denial of service in snowplow:stream collector (high 7.5)
- [CVE-2024-56527](https://insights.sbomify.com/CVE-2024-56527/): TCPDF missing character escape on error messages (high 7.5)
- [CVE-2024-56526](https://insights.sbomify.com/CVE-2024-56526/): OXID eShop May Display User Information (high 7.5)
- [CVE-2024-56525](https://insights.sbomify.com/CVE-2024-56525/): In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can c (critical 9.8)
- [CVE-2024-56524](https://insights.sbomify.com/CVE-2024-56524/): Security feature bypass in radware:cloud waf (critical 9.1)
- [CVE-2024-56523](https://insights.sbomify.com/CVE-2024-56523/): Security feature bypass in radware:cloud waf (critical 9.1)
- [CVE-2024-56522](https://insights.sbomify.com/CVE-2024-56522/): TCPDF has incorrect comparison (high 7.5)
- [CVE-2024-56521](https://insights.sbomify.com/CVE-2024-56521/): TCPDF missing certificate validation (critical 9.8)
- [CVE-2024-56520](https://insights.sbomify.com/CVE-2024-56520/): tecnickcom/tc-lib-pdf-font mishandles fonts (high 7.3)
- [CVE-2024-5652](https://insights.sbomify.com/CVE-2024-5652/): Denial of service in Docker Desktop (medium 6.1)
- [CVE-2024-56519](https://insights.sbomify.com/CVE-2024-56519/): TCPDF lacks SVG sanitization (high 7.5)
- [CVE-2024-56518](https://insights.sbomify.com/CVE-2024-56518/): Code injection in hazelcast:management center (critical 9.8)
- [CVE-2024-56517](https://insights.sbomify.com/CVE-2024-56517/): LGSL has a reflected XSS at /lgsl_files/lgsl_list.php (medium 5.3)
- [CVE-2024-56516](https://insights.sbomify.com/CVE-2024-56516/): free-one-api uses md5 for password storage (medium 6.9)
- [CVE-2024-56515](https://insights.sbomify.com/CVE-2024-56515/): Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo (medium 6.8)
- [CVE-2024-56514](https://insights.sbomify.com/CVE-2024-56514/): Karmada Tar Slips in CRDs archive extraction (medium 5.3)
- [CVE-2024-56513](https://insights.sbomify.com/CVE-2024-56513/): Karmada PULL Mode Cluster Privilege Escalation (high 8.7)
- [CVE-2024-56512](https://insights.sbomify.com/CVE-2024-56512/): Apache NiFi: Missing Complete Authorization for Parameter and Service References (low 2.1)
- [CVE-2024-56511](https://insights.sbomify.com/CVE-2024-56511/): DataEase has an unauthorized vulnerability (critical 9.3)
- [CVE-2024-56510](https://insights.sbomify.com/CVE-2024-56510/): Marp Core allows XSS by improper neutralization of HTML sanitization (medium 5.3)
- [CVE-2024-5651](https://insights.sbomify.com/CVE-2024-5651/): Fence-agents-remediation: fence agent command line options leads to remote code execution (high 8.8)
- [CVE-2024-56509](https://insights.sbomify.com/CVE-2024-56509/): changedetection.io has Improper Input Validation Leading to LFR/Path Traversal (high 8.6)
- [CVE-2024-56508](https://insights.sbomify.com/CVE-2024-56508/): File Upload Vulnerability Leading to XSS in LinkAce v1.15.5 (high 7.6)
- [CVE-2024-56507](https://insights.sbomify.com/CVE-2024-56507/): Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce (medium 4.6)
- [CVE-2024-5650](https://insights.sbomify.com/CVE-2024-5650/): Privilege escalation in CENTUM CS 3000 (high 8.5)
- [CVE-2024-56497](https://insights.sbomify.com/CVE-2024-56497/): Command injection in FortiMail (medium 6.5)
- [CVE-2024-56496](https://insights.sbomify.com/CVE-2024-56496/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-56495](https://insights.sbomify.com/CVE-2024-56495/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-56494](https://insights.sbomify.com/CVE-2024-56494/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-56493](https://insights.sbomify.com/CVE-2024-56493/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-5649](https://insights.sbomify.com/CVE-2024-5649/): Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection (medium 5.4)
- [CVE-2024-5648](https://insights.sbomify.com/CVE-2024-5648/): LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update (medium 5.4)
- [CVE-2024-56477](https://insights.sbomify.com/CVE-2024-56477/): IBM Power Hardware Management Console directory traversal (medium 6.5)
- [CVE-2024-56476](https://insights.sbomify.com/CVE-2024-56476/): IBM TXSeries for Multiplatforms information disclosure (medium 5.3)
- [CVE-2024-56475](https://insights.sbomify.com/CVE-2024-56475/): IBM TXSeries for Multiplatforms cross-site scripting (medium 5.4)
- [CVE-2024-56474](https://insights.sbomify.com/CVE-2024-56474/): IBM TXSeries for Multiplatforms cross-site request forgery (medium 4.3)
- [CVE-2024-56473](https://insights.sbomify.com/CVE-2024-56473/): IBM Aspera Shares Data Manipulation (medium 5.3)
- [CVE-2024-56472](https://insights.sbomify.com/CVE-2024-56472/): IBM Aspera Shares Cross-Site Scripting (medium 6.4)
- [CVE-2024-56471](https://insights.sbomify.com/CVE-2024-56471/): IBM Aspera Shares Server-Side Request Forgery (medium 5.4)
- [CVE-2024-56470](https://insights.sbomify.com/CVE-2024-56470/): IBM Aspera Shares Server-Side Request Forgery (medium 5.4)
- [CVE-2024-5647](https://insights.sbomify.com/CVE-2024-5647/): Cross-site scripting in Betheme (medium 6.4)
- [CVE-2024-56469](https://insights.sbomify.com/CVE-2024-56469/): IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy missing authentication (medium 6.3)
- [CVE-2024-56468](https://insights.sbomify.com/CVE-2024-56468/): IBM InfoSphere Data Replication VSAM for z/OS Remote Source denial of service (high 7.5)
- [CVE-2024-56467](https://insights.sbomify.com/CVE-2024-56467/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-56464](https://insights.sbomify.com/CVE-2024-56464/): IBM QRadar SIEM is affected by an information disclosure vulnerability (low 2.7)
- [CVE-2024-56463](https://insights.sbomify.com/CVE-2024-56463/): IBM QRadar SIEM cross-site scripting (medium 4.8)
- [CVE-2024-56462](https://insights.sbomify.com/CVE-2024-56462/): IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (high 7.2)
- [CVE-2024-5646](https://insights.sbomify.com/CVE-2024-5646/): Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget (medium 6.4)
- [CVE-2024-56456](https://insights.sbomify.com/CVE-2024-56456/): Memory corruption in HarmonyOS (medium 6.8)
- [CVE-2024-56455](https://insights.sbomify.com/CVE-2024-56455/): Memory corruption in HarmonyOS (medium 5.5)
- [CVE-2024-56454](https://insights.sbomify.com/CVE-2024-56454/): Memory corruption in HarmonyOS (medium 5.5)
- [CVE-2024-56453](https://insights.sbomify.com/CVE-2024-56453/): Memory corruption in HarmonyOS (medium 6.8)
- [CVE-2024-56452](https://insights.sbomify.com/CVE-2024-56452/): Memory corruption in HarmonyOS (medium 5.5)
- [CVE-2024-56451](https://insights.sbomify.com/CVE-2024-56451/): Integer overflow in HarmonyOS (high 7.3)
- [CVE-2024-56450](https://insights.sbomify.com/CVE-2024-56450/): Memory corruption in EMUI (medium 6.3)
- [CVE-2024-5645](https://insights.sbomify.com/CVE-2024-5645/): Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/187/