# Vulnerabilities published in 2024


- [CVE-2024-47690](https://insights.sbomify.com/CVE-2024-47690/): f2fs: get rid of online repaire on corrupted directory (high 7.8)
- [CVE-2024-4769](https://insights.sbomify.com/CVE-2024-4769/): Information disclosure in Firefox (medium 5.9)
- [CVE-2024-47689](https://insights.sbomify.com/CVE-2024-47689/): f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error() (medium 5.3)
- [CVE-2024-47688](https://insights.sbomify.com/CVE-2024-47688/): driver core: Fix a potential null-ptr-deref in module_add_driver() (medium 5.5)
- [CVE-2024-47687](https://insights.sbomify.com/CVE-2024-47687/): vdpa/mlx5: Fix invalid mr resource destroy (medium 5.5)
- [CVE-2024-47686](https://insights.sbomify.com/CVE-2024-47686/): ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate() (high 7.1)
- [CVE-2024-47685](https://insights.sbomify.com/CVE-2024-47685/): netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (critical 9.1)
- [CVE-2024-47684](https://insights.sbomify.com/CVE-2024-47684/): tcp: check skb is non-NULL in tcp_rto_delta_us() (medium 5.5)
- [CVE-2024-47683](https://insights.sbomify.com/CVE-2024-47683/): drm/amd/display: Skip Recompute DSC Params if no Stream on Link (medium 5.5)
- [CVE-2024-47682](https://insights.sbomify.com/CVE-2024-47682/): scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (high 8.6)
- [CVE-2024-47681](https://insights.sbomify.com/CVE-2024-47681/): wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he (medium 5.5)
- [CVE-2024-47680](https://insights.sbomify.com/CVE-2024-47680/): f2fs: check discard support for conventional zones (medium 5.5)
- [CVE-2024-4768](https://insights.sbomify.com/CVE-2024-4768/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-47679](https://insights.sbomify.com/CVE-2024-47679/): vfs: fix race between evice_inodes() and find_inode()&iput() (high 7.8)
- [CVE-2024-47678](https://insights.sbomify.com/CVE-2024-47678/): icmp: change the order of rate limits (critical 9.4)
- [CVE-2024-47677](https://insights.sbomify.com/CVE-2024-47677/): exfat: resolve memory leak from exfat_create_upcase_table() (medium 5.5)
- [CVE-2024-47676](https://insights.sbomify.com/CVE-2024-47676/): mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway (high 7.8)
- [CVE-2024-47675](https://insights.sbomify.com/CVE-2024-47675/): bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (high 7.8)
- [CVE-2024-47674](https://insights.sbomify.com/CVE-2024-47674/): mm: avoid leaving partial pfn mappings around in error case (high 7.8)
- [CVE-2024-47673](https://insights.sbomify.com/CVE-2024-47673/): wifi: iwlwifi: mvm: pause TCM when the firmware is stopped (medium 5.5)
- [CVE-2024-47671](https://insights.sbomify.com/CVE-2024-47671/): USB: usbtmc: prevent kernel-usb-infoleak (medium 5.5)
- [CVE-2024-47670](https://insights.sbomify.com/CVE-2024-47670/): ocfs2: add bounds checking to ocfs2_xattr_find_entry() (high 7.8)
- [CVE-2024-4767](https://insights.sbomify.com/CVE-2024-4767/): Information disclosure in Firefox (medium 4.3)
- [CVE-2024-47669](https://insights.sbomify.com/CVE-2024-47669/): nilfs2: fix state management in error path of log writing function (high 7.3)
- [CVE-2024-47668](https://insights.sbomify.com/CVE-2024-47668/): lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (high 7.8)
- [CVE-2024-47667](https://insights.sbomify.com/CVE-2024-47667/): PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) (high 7.3)
- [CVE-2024-47666](https://insights.sbomify.com/CVE-2024-47666/): scsi: pm80xx: Set phy->enable_completion only when we wait for it (medium 5.5)
- [CVE-2024-47665](https://insights.sbomify.com/CVE-2024-47665/): i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup (medium 5.5)
- [CVE-2024-47664](https://insights.sbomify.com/CVE-2024-47664/): spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware (medium 5.5)
- [CVE-2024-47663](https://insights.sbomify.com/CVE-2024-47663/): staging: iio: frequency: ad9834: Validate frequency parameter value (medium 5.5)
- [CVE-2024-47662](https://insights.sbomify.com/CVE-2024-47662/): drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection (medium 5.5)
- [CVE-2024-47661](https://insights.sbomify.com/CVE-2024-47661/): drm/amd/display: Avoid overflow from uint32_t to uint8_t (medium 5.5)
- [CVE-2024-47660](https://insights.sbomify.com/CVE-2024-47660/): fsnotify: clear PARENT_WATCHED flags lazily (medium 4.7)
- [CVE-2024-4766](https://insights.sbomify.com/CVE-2024-4766/): Other in Firefox (medium 4.3)
- [CVE-2024-47659](https://insights.sbomify.com/CVE-2024-47659/): smack: tcp: ipv4, fix incorrect labeling (critical 9.1)
- [CVE-2024-47658](https://insights.sbomify.com/CVE-2024-47658/): crypto: stm32/cryp - call finalize with bh disabled (high 7.5)
- [CVE-2024-47657](https://insights.sbomify.com/CVE-2024-47657/): Improper Access Control Vulnerability (high 7.1)
- [CVE-2024-47656](https://insights.sbomify.com/CVE-2024-47656/): User Enumeration vulnerability (critical 9.3)
- [CVE-2024-47655](https://insights.sbomify.com/CVE-2024-47655/): Unrestricted File Upload Vulnerability (high 8.6)
- [CVE-2024-47654](https://insights.sbomify.com/CVE-2024-47654/): No Rate Limiting vulnerability (high 7.1)
- [CVE-2024-47653](https://insights.sbomify.com/CVE-2024-47653/): Missing Authorization Vulnerability (high 7.1)
- [CVE-2024-47652](https://insights.sbomify.com/CVE-2024-47652/): Insecure Authentication Vulnerability (high 7.6)
- [CVE-2024-47651](https://insights.sbomify.com/CVE-2024-47651/): Parameter Pollution Vulnerability (high 7.1)
- [CVE-2024-47650](https://insights.sbomify.com/CVE-2024-47650/): WordPress WP-WebAuthn plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4765](https://insights.sbomify.com/CVE-2024-4765/): Weak cryptography in Firefox (high 8.1)
- [CVE-2024-47649](https://insights.sbomify.com/CVE-2024-47649/): WordPress Iconize plugin <= 1.2.4 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-47648](https://insights.sbomify.com/CVE-2024-47648/): WordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-47647](https://insights.sbomify.com/CVE-2024-47647/): Cross-site scripting in Helpie FAQ (medium 5.9)
- [CVE-2024-47646](https://insights.sbomify.com/CVE-2024-47646/): WordPress Payflex Payment Gateway plugin <= 2.6.1 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-47645](https://insights.sbomify.com/CVE-2024-47645/): WordPress WPOptin plugin <= 2.0.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-47644](https://insights.sbomify.com/CVE-2024-47644/): WordPress Copyscape Premium plugin <= 1.3.9 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-47643](https://insights.sbomify.com/CVE-2024-47643/): WordPress Include Fussball.de Widgets plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47642](https://insights.sbomify.com/CVE-2024-47642/): WordPress Keap Official Opt-in Forms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47641](https://insights.sbomify.com/CVE-2024-47641/): WordPress Confetti Fall Animation plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47640](https://insights.sbomify.com/CVE-2024-47640/): WordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4764](https://insights.sbomify.com/CVE-2024-4764/): Use after free in Firefox (critical 9.8)
- [CVE-2024-47639](https://insights.sbomify.com/CVE-2024-47639/): WordPress VdoCipher plugin <= 1.29 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47638](https://insights.sbomify.com/CVE-2024-47638/): Cross-site scripting in Online Booking & Scheduling Calendar for WordPress by vcita (high 7.1)
- [CVE-2024-47637](https://insights.sbomify.com/CVE-2024-47637/): WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability (high 8.8)
- [CVE-2024-47636](https://insights.sbomify.com/CVE-2024-47636/): WordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-47635](https://insights.sbomify.com/CVE-2024-47635/): WordPress TinyPNG plugin <= 3.4.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-47634](https://insights.sbomify.com/CVE-2024-47634/): WordPress CartBounty plugin <= 8.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-47633](https://insights.sbomify.com/CVE-2024-47633/): WordPress Zoho forms plugin <= 4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47632](https://insights.sbomify.com/CVE-2024-47632/): WordPress DethemeKit For Elementor plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47631](https://insights.sbomify.com/CVE-2024-47631/): WordPress Logo Carousel – Clients logo carousel for WP plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47630](https://insights.sbomify.com/CVE-2024-47630/): WordPress ElementInvader Addons for Elementor plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4763](https://insights.sbomify.com/CVE-2024-4763/): Privilege escalation in Accessories and Display Manager (high 7.8)
- [CVE-2024-47629](https://insights.sbomify.com/CVE-2024-47629/): WordPress Ultimate Store Kit Elementor Addons plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47628](https://insights.sbomify.com/CVE-2024-47628/): WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.9.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47627](https://insights.sbomify.com/CVE-2024-47627/): WordPress WP Travel Gutenberg Blocks plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47626](https://insights.sbomify.com/CVE-2024-47626/): WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47625](https://insights.sbomify.com/CVE-2024-47625/): Cross-site scripting in Enter Addons (medium 6.5)
- [CVE-2024-47624](https://insights.sbomify.com/CVE-2024-47624/): WordPress BSK Forms Blacklist plugin <= 3.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47623](https://insights.sbomify.com/CVE-2024-47623/): WordPress Gallery Lightbox plugin <= 1.0.0.39 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47622](https://insights.sbomify.com/CVE-2024-47622/): WordPress Advanced Woo Labels plugin <= 2.01 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47621](https://insights.sbomify.com/CVE-2024-47621/): WordPress Zotpress plugin <= 7.3.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4762](https://insights.sbomify.com/CVE-2024-4762/): Security feature bypass in Accessories and Display Manager (high 7.8)
- [CVE-2024-47619](https://insights.sbomify.com/CVE-2024-47619/): tranport: TLS host name wildcard matching too lax (high 7.5)
- [CVE-2024-47618](https://insights.sbomify.com/CVE-2024-47618/): Sulu vulnerable to XSS via uploaded SVG (medium 5.1)
- [CVE-2024-47617](https://insights.sbomify.com/CVE-2024-47617/): Reflected XSS Vulnerability in Sulu Media Bundle (medium 6.1)
- [CVE-2024-47616](https://insights.sbomify.com/CVE-2024-47616/): Pomerium's service account access token may grant unintended access to databroker API (medium 6.8)
- [CVE-2024-47615](https://insights.sbomify.com/CVE-2024-47615/): GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer (high 8.6)
- [CVE-2024-47614](https://insights.sbomify.com/CVE-2024-47614/): async-graphql vulnerable to Directive Overload (high 7.5)
- [CVE-2024-47613](https://insights.sbomify.com/CVE-2024-47613/): GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush (high 8.6)
- [CVE-2024-47612](https://insights.sbomify.com/CVE-2024-47612/): XSS in Special:DataDump when displaying dump status (low 3.5)
- [CVE-2024-47611](https://insights.sbomify.com/CVE-2024-47611/): XZ Utils on Microsoft Windows platform are vulnerable to argument injection (medium 6.3)
- [CVE-2024-47610](https://insights.sbomify.com/CVE-2024-47610/): Stored Cross-site Scripting Vulnerability in Markdown Editor (high 7.3)
- [CVE-2024-4761](https://insights.sbomify.com/CVE-2024-4761/): Google Chromium V8 Out-of-Bounds Memory Write (high 8.3, exploited in the wild)
- [CVE-2024-47609](https://insights.sbomify.com/CVE-2024-47609/): Remotely exploitable DoS in Tonic `<=v0.12.2` (medium 6.9)
- [CVE-2024-47608](https://insights.sbomify.com/CVE-2024-47608/): Logicytics vulnerable to shell injections (medium 6.9)
- [CVE-2024-47607](https://insights.sbomify.com/CVE-2024-47607/): GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header (high 8.6)
- [CVE-2024-47606](https://insights.sbomify.com/CVE-2024-47606/): Integer overflow in gstreamer (high 8.6)
- [CVE-2024-47605](https://insights.sbomify.com/CVE-2024-47605/): Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin (medium 5.4)
- [CVE-2024-47604](https://insights.sbomify.com/CVE-2024-47604/): XSS vulnerability in NuGetGallery HTML attributes handling (high 8.2)
- [CVE-2024-47603](https://insights.sbomify.com/CVE-2024-47603/): GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer (medium 6.8)
- [CVE-2024-47602](https://insights.sbomify.com/CVE-2024-47602/): GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (medium 6.8)
- [CVE-2024-47601](https://insights.sbomify.com/CVE-2024-47601/): GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer (medium 6.8)
- [CVE-2024-47600](https://insights.sbomify.com/CVE-2024-47600/): GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask (medium 5.1)
- [CVE-2024-4760](https://insights.sbomify.com/CVE-2024-4760/): Voltage glitch during startup of the EEFC NVM controller can bypass the security bit (medium 6.3)
- [CVE-2024-47599](https://insights.sbomify.com/CVE-2024-47599/): GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/250/