Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 207 of 521.
- CVE-2024-53303 A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated a
- CVE-2024-5330 Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-53299 Apache Wicket: An attacker can intentionally trigger a memory leak
- CVE-2024-53298 Missing authorization in PowerScale OneFS
- CVE-2024-53296 Memory corruption in PowerProtect DD
- CVE-2024-53295 Privilege escalation in PowerProtect DD
- CVE-2024-53292 Information disclosure in Dell VxRail HCI
- CVE-2024-53291 Information disclosure in NativeEdge
- CVE-2024-53290 Command injection in Wyse Proprietary OS (Modern ThinOS)
- CVE-2024-5329 SQL injection in Unlimited Elements For Elementor
- CVE-2024-53289 Race condition in Wyse Proprietary OS (Modern ThinOS)
- CVE-2024-53288 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53287 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53286 Command injection in Synology Router Manager (SRM)
- CVE-2024-53285 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53284 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53283 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53282 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53281 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53280 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-5328 SSRF Vulnerability in lunary-ai/lunary
- CVE-2024-53279 Cross-site scripting in Synology Router Manager (SRM)
- CVE-2024-53278 Cross-site scripting in WP Admin UI Customize
- CVE-2024-53277 Cross-site Scripting in form messages in silverstripe framework
- CVE-2024-53276 GHSL-2024-092: Open CORS policy in home-gallery
- CVE-2024-53275 GHSL-2024-091: DNS rebinding attack in home-gallery
- CVE-2024-53274 GHSL-2024-111: Reflected XSS in /home in habitica
- CVE-2024-53273 GHSL-2024-110: Reflected XSS in /register in habitica
- CVE-2024-53272 GHSL-2024-109: Reflected XSS in /login in habitica
- CVE-2024-53271 HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy
- CVE-2024-53270 HTTP/1: sending overload crashes when the request is reset beforehand in envoy
- CVE-2024-5327 Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
- CVE-2024-53269 Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy
- CVE-2024-53268 Lack of validation on openExternal allows 1 click remote code execution in joplin
- CVE-2024-53267 Vulnerability with bundle verification in sigstore-java
- CVE-2024-53266 Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse
- CVE-2024-53264 Open Redirect Vulnerability in Loading Page in bunkerweb
- CVE-2024-53263 Git LFS permits exfiltration of credentials via crafted HTTP URLs
- CVE-2024-53262 Unescaped error message included on error page in SvelteKit
- CVE-2024-53261 Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit
- CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab
- CVE-2024-5326 Missing authorization in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
- CVE-2024-53259 quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
- CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab
- CVE-2024-53257 Vitess allows HTML injection in /debug/querylogz & /debug/env
- CVE-2024-53256 Rizin has a command injection via RzBinInfo bclass due legacy code
- CVE-2024-53255 Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
- CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret
- CVE-2024-5325 Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data
- CVE-2024-53247 Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app
- CVE-2024-53246 Sensitive Information Disclosure through SPL commands
- CVE-2024-53245 Information Disclosure due to Username Collision with a Role that has the same Name as the User
- CVE-2024-53244 Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameter
- CVE-2024-53243 Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway
- CVE-2024-53242 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-53241 x86/xen: don't do PV iret hypercall through hypercall page
- CVE-2024-53240 xen/netfront: fix crash when removing device
- CVE-2024-5324 XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
- CVE-2024-53239 ALSA: 6fire: Release resources at card release
- CVE-2024-53238 Bluetooth: btmtk: adjust the position to init iso data anchor
- CVE-2024-53237 Bluetooth: fix use-after-free in device_for_each_child()
- CVE-2024-53236 xsk: Free skb when TX metadata options are invalid
- CVE-2024-53235 erofs: fix file-backed mounts over FUSE
- CVE-2024-53234 erofs: handle NONHEAD !delta[1] lclusters gracefully
- CVE-2024-53233 unicode: Fix utf8_load() error path
- CVE-2024-53232 iommu/s390: Implement blocking domain
- CVE-2024-53231 cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
- CVE-2024-53230 cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
- CVE-2024-53229 RDMA/rxe: Fix the qp flush warnings in req
- CVE-2024-53228 riscv: kvm: Fix out-of-bounds array access
- CVE-2024-53227 scsi: bfa: Fix use-after-free in bfad_im_module_exit()
- CVE-2024-53226 RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
- CVE-2024-53225 iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
- CVE-2024-53224 RDMA/mlx5: Move events notifier registration to be after device registration
- CVE-2024-53223 clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
- CVE-2024-53222 zram: fix NULL pointer in comp_algorithm_show()
- CVE-2024-53221 f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
- CVE-2024-53220 f2fs: fix to account dirty data in __get_secs_required()
- CVE-2024-5322 N-central Authentication Bypass via Session Rebinding
- CVE-2024-53219 virtiofs: use pages instead of pointer for kernel direct IO
- CVE-2024-53218 f2fs: fix race in concurrent f2fs_stop_gc_thread
- CVE-2024-53217 NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
- CVE-2024-53216 nfsd: release svc_expkey/svc_export with rcu_work
- CVE-2024-53215 svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
- CVE-2024-53214 vfio/pci: Properly hide first-in-list PCIe extended capability
- CVE-2024-53213 net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
- CVE-2024-53212 netlink: fix false positive warning in extack during dumps
- CVE-2024-53211 net/l2tp: fix warning in l2tp_exit_net found by syzbot
- CVE-2024-53210 s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
- CVE-2024-5321 Incorrect permissions on Windows containers logs
- CVE-2024-53209 bnxt_en: Fix receive ring space parameters when XDP is active
- CVE-2024-53208 Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
- CVE-2024-53207 Bluetooth: MGMT: Fix possible deadlocks
- CVE-2024-53206 tcp: Fix use-after-free of nreq in reqsk_timer_handler().
- CVE-2024-53205 phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe
- CVE-2024-53204 phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe
- CVE-2024-53203 usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
- CVE-2024-53202 firmware_loader: Fix possible resource leak in fw_log_firmware_info()
- CVE-2024-53201 drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
- CVE-2024-53200 drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp