# Vulnerabilities published in 2024


- [CVE-2024-49922](https://insights.sbomify.com/CVE-2024-49922/): drm/amd/display: Check null pointers before using them (medium 5.5)
- [CVE-2024-49921](https://insights.sbomify.com/CVE-2024-49921/): drm/amd/display: Check null pointers before used (medium 5.5)
- [CVE-2024-49920](https://insights.sbomify.com/CVE-2024-49920/): drm/amd/display: Check null pointers before multiple uses (medium 5.5)
- [CVE-2024-4992](https://insights.sbomify.com/CVE-2024-4992/): SQL injection vulnerability in SiAdmin (critical 9.8)
- [CVE-2024-49919](https://insights.sbomify.com/CVE-2024-49919/): drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer (medium 5.5)
- [CVE-2024-49918](https://insights.sbomify.com/CVE-2024-49918/): drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer (medium 5.5)
- [CVE-2024-49917](https://insights.sbomify.com/CVE-2024-49917/): drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw (medium 5.5)
- [CVE-2024-49916](https://insights.sbomify.com/CVE-2024-49916/): drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw (medium 5.5)
- [CVE-2024-49915](https://insights.sbomify.com/CVE-2024-49915/): drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw (medium 5.5)
- [CVE-2024-49914](https://insights.sbomify.com/CVE-2024-49914/): drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe (medium 5.5)
- [CVE-2024-49913](https://insights.sbomify.com/CVE-2024-49913/): drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream (medium 5.5)
- [CVE-2024-49912](https://insights.sbomify.com/CVE-2024-49912/): drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' (medium 5.5)
- [CVE-2024-49911](https://insights.sbomify.com/CVE-2024-49911/): drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func (medium 5.5)
- [CVE-2024-49910](https://insights.sbomify.com/CVE-2024-49910/): drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func (medium 5.5)
- [CVE-2024-4991](https://insights.sbomify.com/CVE-2024-4991/): SQL injection vulnerability in SiAdmin (critical 9.8)
- [CVE-2024-49909](https://insights.sbomify.com/CVE-2024-49909/): drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func (medium 5.5)
- [CVE-2024-49908](https://insights.sbomify.com/CVE-2024-49908/): drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2) (medium 5.5)
- [CVE-2024-49907](https://insights.sbomify.com/CVE-2024-49907/): drm/amd/display: Check null pointers before using dc->clk_mgr (medium 5.5)
- [CVE-2024-49906](https://insights.sbomify.com/CVE-2024-49906/): drm/amd/display: Check null pointer before try to access it (medium 5.5)
- [CVE-2024-49905](https://insights.sbomify.com/CVE-2024-49905/): drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) (medium 5.5)
- [CVE-2024-49904](https://insights.sbomify.com/CVE-2024-49904/): drm/amdgpu: add list empty check to avoid null pointer issue (medium 5.5)
- [CVE-2024-49903](https://insights.sbomify.com/CVE-2024-49903/): jfs: Fix uaf in dbFreeBits (high 7.0)
- [CVE-2024-49902](https://insights.sbomify.com/CVE-2024-49902/): jfs: check if leafidx greater than num leaves per dmap tree (high 7.8)
- [CVE-2024-49901](https://insights.sbomify.com/CVE-2024-49901/): drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (medium 5.5)
- [CVE-2024-49900](https://insights.sbomify.com/CVE-2024-49900/): jfs: Fix uninit-value access of new_ea in ea_buffer (high 7.1)
- [CVE-2024-4990](https://insights.sbomify.com/CVE-2024-4990/): Unsafe Reflection in base Component class in yiisoft/yii2 (high 8.1)
- [CVE-2024-49899](https://insights.sbomify.com/CVE-2024-49899/): drm/amd/display: Initialize denominators' default to 1 (medium 5.5)
- [CVE-2024-49898](https://insights.sbomify.com/CVE-2024-49898/): drm/amd/display: Check null-initialized variables (medium 5.5)
- [CVE-2024-49897](https://insights.sbomify.com/CVE-2024-49897/): drm/amd/display: Check phantom_stream before it is used (medium 5.5)
- [CVE-2024-49896](https://insights.sbomify.com/CVE-2024-49896/): drm/amd/display: Check stream before comparing them (medium 5.5)
- [CVE-2024-49895](https://insights.sbomify.com/CVE-2024-49895/): drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation (high 7.8)
- [CVE-2024-49894](https://insights.sbomify.com/CVE-2024-49894/): drm/amd/display: Fix index out of bounds in degamma hardware format translation (high 7.1)
- [CVE-2024-49893](https://insights.sbomify.com/CVE-2024-49893/): drm/amd/display: Check stream_status before it is used (medium 5.5)
- [CVE-2024-49892](https://insights.sbomify.com/CVE-2024-49892/): drm/amd/display: Initialize get_bytes_per_element's default to 1 (medium 5.5)
- [CVE-2024-49891](https://insights.sbomify.com/CVE-2024-49891/): scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (medium 5.5)
- [CVE-2024-49890](https://insights.sbomify.com/CVE-2024-49890/): drm/amd/pm: ensure the fw_info is not null before using it (medium 5.5)
- [CVE-2024-4989](https://insights.sbomify.com/CVE-2024-4989/): Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks (medium 5.4)
- [CVE-2024-49889](https://insights.sbomify.com/CVE-2024-49889/): ext4: avoid use-after-free in ext4_ext_show_leaf() (high 7.8)
- [CVE-2024-49888](https://insights.sbomify.com/CVE-2024-49888/): bpf: Fix a sdiv overflow issue (medium 5.5)
- [CVE-2024-49887](https://insights.sbomify.com/CVE-2024-49887/): f2fs: fix to don't panic system for no free segment fault injection (medium 5.5)
- [CVE-2024-49886](https://insights.sbomify.com/CVE-2024-49886/): platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (high 7.8)
- [CVE-2024-49885](https://insights.sbomify.com/CVE-2024-49885/): mm, slub: avoid zeroing kmalloc redzone (medium 5.5)
- [CVE-2024-49884](https://insights.sbomify.com/CVE-2024-49884/): ext4: fix slab-use-after-free in ext4_split_extent_at() (high 7.8)
- [CVE-2024-49883](https://insights.sbomify.com/CVE-2024-49883/): ext4: aovid use-after-free in ext4_ext_insert_extent() (high 7.8)
- [CVE-2024-49882](https://insights.sbomify.com/CVE-2024-49882/): ext4: fix double brelse() the buffer of the extents path (high 7.8)
- [CVE-2024-49881](https://insights.sbomify.com/CVE-2024-49881/): ext4: update orig_path in ext4_find_extent() (medium 5.5)
- [CVE-2024-49880](https://insights.sbomify.com/CVE-2024-49880/): ext4: fix off by one issue in alloc_flex_gd() (high 7.8)
- [CVE-2024-4988](https://insights.sbomify.com/CVE-2024-4988/): Improper permission control in com.transsion.videocallenhancer (high 7.5)
- [CVE-2024-49879](https://insights.sbomify.com/CVE-2024-49879/): drm: omapdrm: Add missing check for alloc_ordered_workqueue (medium 5.5)
- [CVE-2024-49878](https://insights.sbomify.com/CVE-2024-49878/): resource: fix region_intersects() vs add_memory_driver_managed() (medium 5.5)
- [CVE-2024-49877](https://insights.sbomify.com/CVE-2024-49877/): ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate (medium 5.5)
- [CVE-2024-49876](https://insights.sbomify.com/CVE-2024-49876/): drm/xe: fix UAF around queue destruction (high 7.8)
- [CVE-2024-49875](https://insights.sbomify.com/CVE-2024-49875/): nfsd: map the EBADMSG to nfserr_io to avoid warning (high 7.5)
- [CVE-2024-49874](https://insights.sbomify.com/CVE-2024-49874/): i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition (high 7.8)
- [CVE-2024-49873](https://insights.sbomify.com/CVE-2024-49873/): mm/filemap: fix filemap_get_folios_contig THP panic (medium 5.5)
- [CVE-2024-49872](https://insights.sbomify.com/CVE-2024-49872/): mm/gup: fix memfd_pin_folios alloc race panic (medium 4.7)
- [CVE-2024-49871](https://insights.sbomify.com/CVE-2024-49871/): Input: adp5589-keys - fix NULL pointer dereference (medium 5.5)
- [CVE-2024-49870](https://insights.sbomify.com/CVE-2024-49870/): cachefiles: fix dentry leak in cachefiles_open_file() (medium 5.5)
- [CVE-2024-49869](https://insights.sbomify.com/CVE-2024-49869/): btrfs: send: fix buffer overflow detection when copying path to cache entry (high 7.8)
- [CVE-2024-49868](https://insights.sbomify.com/CVE-2024-49868/): btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (medium 5.5)
- [CVE-2024-49867](https://insights.sbomify.com/CVE-2024-49867/): btrfs: wait for fixup workers before stopping cleaner kthread during umount (high 7.8)
- [CVE-2024-49866](https://insights.sbomify.com/CVE-2024-49866/): tracing/timerlat: Fix a race during cpuhp processing (high 7.8)
- [CVE-2024-49865](https://insights.sbomify.com/CVE-2024-49865/): drm/xe/vm: move xa_alloc to prevent UAF (high 7.8)
- [CVE-2024-49864](https://insights.sbomify.com/CVE-2024-49864/): rxrpc: Fix a race between socket set up and I/O thread creation (high 7.5)
- [CVE-2024-49863](https://insights.sbomify.com/CVE-2024-49863/): vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() (medium 5.5)
- [CVE-2024-49862](https://insights.sbomify.com/CVE-2024-49862/): powercap: intel_rapl: Fix off by one in get_rpi() (high 7.1)
- [CVE-2024-49861](https://insights.sbomify.com/CVE-2024-49861/): bpf: Fix helper writes to read-only maps (high 7.8)
- [CVE-2024-49860](https://insights.sbomify.com/CVE-2024-49860/): ACPI: sysfs: validate return type of _STR method (high 7.3)
- [CVE-2024-49859](https://insights.sbomify.com/CVE-2024-49859/): f2fs: fix to check atomic_file in f2fs ioctl interfaces (high 7.8)
- [CVE-2024-49858](https://insights.sbomify.com/CVE-2024-49858/): efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (medium 5.5)
- [CVE-2024-49857](https://insights.sbomify.com/CVE-2024-49857/): wifi: iwlwifi: mvm: set the cipher for secured NDP ranging (high 7.1)
- [CVE-2024-49856](https://insights.sbomify.com/CVE-2024-49856/): x86/sgx: Fix deadlock in SGX NUMA node search (medium 5.5)
- [CVE-2024-49855](https://insights.sbomify.com/CVE-2024-49855/): nbd: fix race between timeout and normal completion (critical 9.8)
- [CVE-2024-49854](https://insights.sbomify.com/CVE-2024-49854/): block, bfq: fix uaf for accessing waker_bfqq after splitting (high 7.8)
- [CVE-2024-49853](https://insights.sbomify.com/CVE-2024-49853/): firmware: arm_scmi: Fix double free in OPTEE transport (high 7.8)
- [CVE-2024-49852](https://insights.sbomify.com/CVE-2024-49852/): scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() (high 7.8)
- [CVE-2024-49851](https://insights.sbomify.com/CVE-2024-49851/): tpm: Clean up TPM space after command failure (medium 5.5)
- [CVE-2024-49850](https://insights.sbomify.com/CVE-2024-49850/): bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos (medium 5.5)
- [CVE-2024-4985](https://insights.sbomify.com/CVE-2024-4985/): Auth bypass in Enterprise Server (critical 10.0)
- [CVE-2024-49849](https://insights.sbomify.com/CVE-2024-49849/): Deserialization in SIMATIC S7-PLCSIM V16 (high 8.4)
- [CVE-2024-49848](https://insights.sbomify.com/CVE-2024-49848/): Use After Free in DSP Service (medium 6.7)
- [CVE-2024-49847](https://insights.sbomify.com/CVE-2024-49847/): Buffer Over-read in Multi-Mode Call Processor (high 7.5)
- [CVE-2024-49846](https://insights.sbomify.com/CVE-2024-49846/): Buffer Over-read in Multi-Mode Call Processor (high 8.2)
- [CVE-2024-49845](https://insights.sbomify.com/CVE-2024-49845/): Improper Input Validation in HLOS (high 7.8)
- [CVE-2024-49844](https://insights.sbomify.com/CVE-2024-49844/): Improper Input Validation in Automotive (high 7.8)
- [CVE-2024-49843](https://insights.sbomify.com/CVE-2024-49843/): Improper Validation of Array Index in Graphics_Linux (high 7.8)
- [CVE-2024-49842](https://insights.sbomify.com/CVE-2024-49842/): Improper Access Control in Hypervisor (high 7.8)
- [CVE-2024-49841](https://insights.sbomify.com/CVE-2024-49841/): Detection of Error Condition Without Action in Hypervisor (high 7.8)
- [CVE-2024-49840](https://insights.sbomify.com/CVE-2024-49840/): Use of Out-of-range Pointer Offset in WLAN Windows Host (high 7.8)
- [CVE-2024-4984](https://insights.sbomify.com/CVE-2024-4984/): Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-49839](https://insights.sbomify.com/CVE-2024-49839/): Buffer Over-read in WLAN Host Cmn (high 8.2)
- [CVE-2024-49838](https://insights.sbomify.com/CVE-2024-49838/): Buffer Over-read in WLAN HOST (high 8.2)
- [CVE-2024-49837](https://insights.sbomify.com/CVE-2024-49837/): Improper Validation of Array Index in Automotive OS Platform (high 7.8)
- [CVE-2024-49836](https://insights.sbomify.com/CVE-2024-49836/): Improper Validation of Array Index in Camera (high 7.8)
- [CVE-2024-49835](https://insights.sbomify.com/CVE-2024-49835/): Out-of-bounds Write in SPS Applications (high 7.8)
- [CVE-2024-49834](https://insights.sbomify.com/CVE-2024-49834/): Improper Validation of Array Index in Camera (high 7.8)
- [CVE-2024-49833](https://insights.sbomify.com/CVE-2024-49833/): Improper Validation of Array Index in Camera (high 7.8)
- [CVE-2024-49832](https://insights.sbomify.com/CVE-2024-49832/): Improper Validation of Array Index in Camera (high 7.8)
- [CVE-2024-49830](https://insights.sbomify.com/CVE-2024-49830/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio (medium 6.6)
- [CVE-2024-4983](https://insights.sbomify.com/CVE-2024-4983/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/234/