Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 259 of 521.
- CVE-2024-46737 nvmet-tcp: fix kernel crash if commands allocation fails
- CVE-2024-46736 smb: client: fix double put of @cfile in smb2_rename_path()
- CVE-2024-46735 ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
- CVE-2024-46734 btrfs: fix race between direct IO write and fsync when using same fd
- CVE-2024-46733 btrfs: fix qgroup reserve leaks in cow_file_range
- CVE-2024-46732 drm/amd/display: Assign linear_pitch_alignment even for VM
- CVE-2024-46731 drm/amd/pm: fix the Out-of-bounds read warning
- CVE-2024-46730 drm/amd/display: Ensure array index tg_inst won't be -1
- CVE-2024-4673 Campcodes Complete Web-Based School Management System show_student_grade_subject.php cross site scripting
- CVE-2024-46729 drm/amd/display: Fix incorrect size calculation for loop
- CVE-2024-46728 drm/amd/display: Check index for aux_rd_interval before using
- CVE-2024-46727 drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update
- CVE-2024-46726 drm/amd/display: Ensure index calculation will not overflow
- CVE-2024-46725 drm/amdgpu: Fix out-of-bounds write warning
- CVE-2024-46724 drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
- CVE-2024-46723 drm/amdgpu: fix ucode out-of-bounds read warning
- CVE-2024-46722 drm/amdgpu: fix mc_data out-of-bounds read warning
- CVE-2024-46721 apparmor: fix possible NULL pointer dereference
- CVE-2024-46720 drm/amdgpu: fix dereference after null check
- CVE-2024-4672 Campcodes Complete Web-Based School Management System show_student_subject.php cross site scripting
- CVE-2024-46719 usb: typec: ucsi: Fix null pointer dereference in trace
- CVE-2024-46718 drm/xe: Don't overmap identity VRAM mapping
- CVE-2024-46717 net/mlx5e: SHAMPO, Fix incorrect page release
- CVE-2024-46716 dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
- CVE-2024-46715 driver: iio: add missing checks on iio_info's callback access
- CVE-2024-46714 drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
- CVE-2024-46713 perf/aux: Fix AUX buffer serialization
- CVE-2024-46712 drm/vmwgfx: Disable coherent dumb buffers without 3d
- CVE-2024-46711 mptcp: pm: fix ID 0 endp usage after multiple re-creations
- CVE-2024-46710 drm/vmwgfx: Prevent unmapping active read buffers
- CVE-2024-4671 Google Chromium Visuals Use-After-Free
- CVE-2024-46709 drm/vmwgfx: Fix prime with external buffers
- CVE-2024-46708 pinctrl: qcom: x1e80100: Fix special pin offsets
- CVE-2024-46707 KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
- CVE-2024-46706 tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
- CVE-2024-46705 drm/xe: reset mmio mappings with devm
- CVE-2024-46704 workqueue: Fix spruious data race in __flush_work()
- CVE-2024-46703 Revert "serial: 8250_omap: Set the console genpd always on if no console suspend"
- CVE-2024-46702 thunderbolt: Mark XDomain as unplugged when router is removed
- CVE-2024-46701 libfs: fix infinite directory reads for offset dir
- CVE-2024-4670 All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode
- CVE-2024-46699 drm/v3d: Disable preemption while updating GPU stats
- CVE-2024-46698 video/aperture: optionally match the device in sysfb_disable()
- CVE-2024-46697 nfsd: ensure that nfsd4_fattr_args.context is zeroed out
- CVE-2024-46696 nfsd: fix potential UAF in nfsd4_cb_getattr_release
- CVE-2024-46695 selinux,smack: don't bypass permissions check in inode_setsecctx hook
- CVE-2024-46694 drm/amd/display: avoid using null object of framebuffer
- CVE-2024-46693 soc: qcom: pmic_glink: Fix race during initialization
- CVE-2024-46692 firmware: qcom: scm: Mark get_wq_ctx() as atomic call
- CVE-2024-46691 usb: typec: ucsi: Move unregister out of atomic section
- CVE-2024-46690 nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease
- CVE-2024-4669 Events Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- CVE-2024-46689 soc: qcom: cmd-db: Map shared memory as WC, not WB
- CVE-2024-46688 erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
- CVE-2024-46687 btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
- CVE-2024-46686 smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
- CVE-2024-46685 pinctrl: single: fix potential NULL dereference in pcs_get_function()
- CVE-2024-46684 binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined
- CVE-2024-46683 drm/xe: prevent UAF around preempt fence
- CVE-2024-46682 nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open
- CVE-2024-46681 pktgen: use cpus_read_lock() in pg_net_init()
- CVE-2024-46680 Bluetooth: btnxpuart: Fix random crash seen while removing driver
- CVE-2024-4668 Cross-site scripting in Gum Addon for Elementor
- CVE-2024-46679 ethtool: check device is present when getting link settings
- CVE-2024-46678 bonding: change ipsec_lock from spin lock to mutex
- CVE-2024-46677 gtp: fix a potential NULL pointer dereference
- CVE-2024-46676 nfc: pn533: Add poll mod list filling check
- CVE-2024-46675 usb: dwc3: core: Prevent USB core invalid event buffer address access
- CVE-2024-46674 usb: dwc3: st: fix probed platform device ref count on probe error path
- CVE-2024-46673 scsi: aacraid: Fix double-free on probe failure
- CVE-2024-46672 wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
- CVE-2024-46671 Missing authorization in FortiWeb
- CVE-2024-46670 Denial of service in FortiOS
- CVE-2024-4667 Cross-site scripting in Blog, Posts and Category Filter for Elementor
- CVE-2024-46669 Integer overflow in FortiOS
- CVE-2024-46668 Denial of service in FortiOS
- CVE-2024-46667 Denial of service in FortiSIEM
- CVE-2024-46666 Denial of service in FortiOS
- CVE-2024-46665 Information disclosure in FortiOS
- CVE-2024-46664 Path traversal in FortiRecorder
- CVE-2024-46663 Memory corruption in FortiMail
- CVE-2024-46662 Command injection in FortiManager
- CVE-2024-4666 Cross-site scripting in Borderless – Addons and Templates for Elementor
- CVE-2024-46658 Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.
- CVE-2024-46657 Memory corruption in artifex:mupdf
- CVE-2024-46655 Cross-site scripting in ellevo:ellevo
- CVE-2024-46654 Cross-site scripting in maccms:maccms
- CVE-2024-46652 Memory corruption in tenda:ac8 firmware
- CVE-2024-4665 EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update
- CVE-2024-46649 Path traversal in enms:enms
- CVE-2024-46648 Path traversal in enms:enms
- CVE-2024-46647 Path traversal in enms:enms
- CVE-2024-46646 Path traversal in enms:enms
- CVE-2024-46645 Path traversal in enms:enms
- CVE-2024-46644 Path traversal in enms:enms
- CVE-2024-46640 Code injection in seacms:seacms
- CVE-2024-4664 WP Chat App < 3.6.5 - Admin+ Stored XSS
- CVE-2024-46639 A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo
- CVE-2024-46636 NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the
- CVE-2024-46635 An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information