Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 233 of 521.
- CVE-2024-50019 kthread: unpark only parked kthread
- CVE-2024-50017 x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
- CVE-2024-50015 ext4: dax: fix overflowing extents beyond inode size when partially writing
- CVE-2024-50014 ext4: fix access to uninitialised lock in fc replay path
- CVE-2024-50013 exfat: fix memory leak in exfat_load_bitmap()
- CVE-2024-50012 cpufreq: Avoid a bad reference count on CPU node
- CVE-2024-50011 ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item
- CVE-2024-50010 exec: don't WARN for racy path_noexec check
- CVE-2024-5001 Cross-site scripting in Image Hover Effects for Elementor with Lightbox and Flipbox
- CVE-2024-50009 cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
- CVE-2024-50008 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
- CVE-2024-50007 ALSA: asihpi: Fix potential OOB array access
- CVE-2024-50006 ext4: fix i_data_sem unlock order in ext4_ind_migrate()
- CVE-2024-50005 mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
- CVE-2024-50004 drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35
- CVE-2024-50003 drm/amd/display: Fix system hang while resume with TBT monitor
- CVE-2024-50002 static_call: Handle module init failure correctly in static_call_del_module()
- CVE-2024-50001 net/mlx5: Fix error path in multi-packet WQE transmit
- CVE-2024-50000 net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
- CVE-2024-5000 CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products
- CVE-2024-49999 afs: Fix the setting of the server responding flag
- CVE-2024-49998 net: dsa: improve shutdown sequence
- CVE-2024-49997 net: ethernet: lantiq_etop: fix memory disclosure
- CVE-2024-49996 cifs: Fix buffer overflow when parsing NFS reparse points
- CVE-2024-49994 block: fix integer overflow in BLKSECDISCARD
- CVE-2024-49992 drm/stm: Avoid use-after-free issues with crtc and plane
- CVE-2024-49991 drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
- CVE-2024-49990 drm/xe/hdcp: Check GSC structure validity
- CVE-2024-4999 Ligowave Unity/Pro/Mimo/APC Arbitrary Command Injection
- CVE-2024-49989 drm/amd/display: fix double free issue during amdgpu module unload
- CVE-2024-49988 ksmbd: add refcnt to ksmbd_conn struct
- CVE-2024-49987 bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
- CVE-2024-49986 platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors
- CVE-2024-49985 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
- CVE-2024-49984 drm/v3d: Prevent out of bounds access in performance query extensions
- CVE-2024-49983 ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
- CVE-2024-49982 aoe: fix the potential use-after-free problem in more places
- CVE-2024-49981 media: venus: fix use after free bug in venus_remove due to race condition
- CVE-2024-49980 vrf: revert "vrf: Remove unnecessary RCU-bh critical section"
- CVE-2024-49979 net: gso: fix tcp fraglist segmentation after pull from frag_list
- CVE-2024-49978 gso: fix udp gso fraglist segmentation after pull from frag_list
- CVE-2024-49977 net: stmmac: Fix zero-division error when disabling tc cbs
- CVE-2024-49976 tracing/timerlat: Drop interface_lock in stop_kthread()
- CVE-2024-49975 uprobes: fix kernel info leak via "[uprobes]" vma
- CVE-2024-49974 NFSD: Limit the number of concurrent async COPY operations
- CVE-2024-49973 r8169: add tally counter fields added with RTL8125
- CVE-2024-49972 drm/amd/display: Deallocate DML memory if allocation fails
- CVE-2024-49971 drm/amd/display: Increase array size of dummy_boolean
- CVE-2024-49970 drm/amd/display: Implement bounds check for stream encoder creation in DCN401
- CVE-2024-4997 WPUpper Share Buttons <= 3.43 - Missing Authorization
- CVE-2024-49969 drm/amd/display: Fix index out of bounds in DCN30 color transformation
- CVE-2024-49968 ext4: filesystems without casefold feature cannot be mounted with siphash
- CVE-2024-49966 ocfs2: cancel dqi_sync_work before freeing oinfo
- CVE-2024-49965 ocfs2: remove unreasonable unlock in ocfs2_read_blocks
- CVE-2024-49964 mm/hugetlb: fix memfd_pin_folios free_huge_pages leak
- CVE-2024-49963 mailbox: bcm2835: Fix timeout during suspend mode
- CVE-2024-49962 ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
- CVE-2024-49961 media: i2c: ar0521: Use cansleep version of gpiod_set_value()
- CVE-2024-49960 ext4: fix timer use-after-free on failed mount
- CVE-2024-4996 Hardcoded Password in Wapro ERP Desktop
- CVE-2024-49959 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
- CVE-2024-49958 ocfs2: reserve space for inline xattr before attaching reflink tree
- CVE-2024-49957 ocfs2: fix null-ptr-deref when journal load failed.
- CVE-2024-49956 gfs2: fix double destroy_workqueue error
- CVE-2024-49955 ACPI: battery: Fix possible crash when unregistering a battery hook
- CVE-2024-49954 static_call: Replace pointless WARN_ON() in static_call_module_notify()
- CVE-2024-49953 net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
- CVE-2024-49952 netfilter: nf_tables: prevent nf_skb_duplicated corruption
- CVE-2024-49951 Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
- CVE-2024-49950 Bluetooth: L2CAP: Fix uaf in l2cap_connect
- CVE-2024-4995 Protocol Downgrade in Wapro ERP Desktop
- CVE-2024-49949 net: avoid potential underflow in qdisc_pkt_len_init() with UFO
- CVE-2024-49948 net: add more sanity checks to qdisc_pkt_len_init()
- CVE-2024-49947 net: test for not too small csum_start in virtio_net_hdr_to_skb()
- CVE-2024-49946 ppp: do not assume bh is held in ppp_channel_bridge_input()
- CVE-2024-49945 net/ncsi: Disable the ncsi work before freeing the associated structure
- CVE-2024-49944 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
- CVE-2024-49943 drm/xe/guc_submit: add missing locking in wedged_fini
- CVE-2024-49942 drm/xe: Prevent null pointer access in xe_migrate_copy
- CVE-2024-49941 gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
- CVE-2024-49940 l2tp: prevent possible tunnel refcount underflow
- CVE-2024-4994 Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2024-49939 wifi: rtw89: avoid to add interface to list twice when SER
- CVE-2024-49938 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
- CVE-2024-49937 wifi: cfg80211: Set correct chandef when starting CAC
- CVE-2024-49936 net/xen-netback: prevent UAF in xenvif_flush_hash()
- CVE-2024-49935 ACPI: PAD: fix crash in exit_round_robin()
- CVE-2024-49934 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
- CVE-2024-49933 blk_iocost: fix more out of bound shifts
- CVE-2024-49932 btrfs: don't readahead the relocation inode on RST
- CVE-2024-49931 wifi: ath12k: fix array out-of-bound access in SoC stats
- CVE-2024-49930 wifi: ath11k: fix array out-of-bound access in SoC stats
- CVE-2024-4993 SQL injection vulnerability in SiAdmin
- CVE-2024-49929 wifi: iwlwifi: mvm: avoid NULL pointer dereference
- CVE-2024-49928 wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
- CVE-2024-49927 x86/ioapic: Handle allocation failures gracefully
- CVE-2024-49926 rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
- CVE-2024-49925 fbdev: efifb: Register sysfs groups through driver core
- CVE-2024-49924 fbdev: pxafb: Fix possible use after free in pxafb_task()
- CVE-2024-49923 drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags