# Vulnerabilities published in 2024


- [CVE-2024-46737](https://insights.sbomify.com/CVE-2024-46737/): nvmet-tcp: fix kernel crash if commands allocation fails (high 7.5)
- [CVE-2024-46736](https://insights.sbomify.com/CVE-2024-46736/): smb: client: fix double put of @cfile in smb2_rename_path() (critical 9.8)
- [CVE-2024-46735](https://insights.sbomify.com/CVE-2024-46735/): ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery() (medium 5.5)
- [CVE-2024-46734](https://insights.sbomify.com/CVE-2024-46734/): btrfs: fix race between direct IO write and fsync when using same fd (high 7.8)
- [CVE-2024-46733](https://insights.sbomify.com/CVE-2024-46733/): btrfs: fix qgroup reserve leaks in cow_file_range (medium 5.5)
- [CVE-2024-46732](https://insights.sbomify.com/CVE-2024-46732/): drm/amd/display: Assign linear_pitch_alignment even for VM (medium 5.5)
- [CVE-2024-46731](https://insights.sbomify.com/CVE-2024-46731/): drm/amd/pm: fix the Out-of-bounds read warning (high 7.1)
- [CVE-2024-46730](https://insights.sbomify.com/CVE-2024-46730/): drm/amd/display: Ensure array index tg_inst won't be -1 (high 7.8)
- [CVE-2024-4673](https://insights.sbomify.com/CVE-2024-4673/): Campcodes Complete Web-Based School Management System show_student_grade_subject.php cross site scripting (medium 5.3)
- [CVE-2024-46729](https://insights.sbomify.com/CVE-2024-46729/): drm/amd/display: Fix incorrect size calculation for loop (high 7.8)
- [CVE-2024-46728](https://insights.sbomify.com/CVE-2024-46728/): drm/amd/display: Check index for aux_rd_interval before using (medium 5.5)
- [CVE-2024-46727](https://insights.sbomify.com/CVE-2024-46727/): drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update (medium 5.5)
- [CVE-2024-46726](https://insights.sbomify.com/CVE-2024-46726/): drm/amd/display: Ensure index calculation will not overflow (medium 5.5)
- [CVE-2024-46725](https://insights.sbomify.com/CVE-2024-46725/): drm/amdgpu: Fix out-of-bounds write warning (high 7.8)
- [CVE-2024-46724](https://insights.sbomify.com/CVE-2024-46724/): drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (high 7.1)
- [CVE-2024-46723](https://insights.sbomify.com/CVE-2024-46723/): drm/amdgpu: fix ucode out-of-bounds read warning (high 7.1)
- [CVE-2024-46722](https://insights.sbomify.com/CVE-2024-46722/): drm/amdgpu: fix mc_data out-of-bounds read warning (high 7.1)
- [CVE-2024-46721](https://insights.sbomify.com/CVE-2024-46721/): apparmor: fix possible NULL pointer dereference (medium 5.5)
- [CVE-2024-46720](https://insights.sbomify.com/CVE-2024-46720/): drm/amdgpu: fix dereference after null check (medium 5.5)
- [CVE-2024-4672](https://insights.sbomify.com/CVE-2024-4672/): Campcodes Complete Web-Based School Management System show_student_subject.php cross site scripting (medium 5.3)
- [CVE-2024-46719](https://insights.sbomify.com/CVE-2024-46719/): usb: typec: ucsi: Fix null pointer dereference in trace (medium 5.5)
- [CVE-2024-46718](https://insights.sbomify.com/CVE-2024-46718/): drm/xe: Don't overmap identity VRAM mapping (medium 5.5)
- [CVE-2024-46717](https://insights.sbomify.com/CVE-2024-46717/): net/mlx5e: SHAMPO, Fix incorrect page release (critical 9.8)
- [CVE-2024-46716](https://insights.sbomify.com/CVE-2024-46716/): dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (high 7.8)
- [CVE-2024-46715](https://insights.sbomify.com/CVE-2024-46715/): driver: iio: add missing checks on iio_info's callback access (medium 5.5)
- [CVE-2024-46714](https://insights.sbomify.com/CVE-2024-46714/): drm/amd/display: Skip wbscl_set_scaler_filter if filter is null (medium 5.5)
- [CVE-2024-46713](https://insights.sbomify.com/CVE-2024-46713/): perf/aux: Fix AUX buffer serialization (high 7.8)
- [CVE-2024-46712](https://insights.sbomify.com/CVE-2024-46712/): drm/vmwgfx: Disable coherent dumb buffers without 3d (medium 5.5)
- [CVE-2024-46711](https://insights.sbomify.com/CVE-2024-46711/): mptcp: pm: fix ID 0 endp usage after multiple re-creations (medium 4.7)
- [CVE-2024-46710](https://insights.sbomify.com/CVE-2024-46710/): drm/vmwgfx: Prevent unmapping active read buffers (high 7.8)
- [CVE-2024-4671](https://insights.sbomify.com/CVE-2024-4671/): Google Chromium Visuals Use-After-Free (critical 9.6, exploited in the wild)
- [CVE-2024-46709](https://insights.sbomify.com/CVE-2024-46709/): drm/vmwgfx: Fix prime with external buffers (high 7.8)
- [CVE-2024-46708](https://insights.sbomify.com/CVE-2024-46708/): pinctrl: qcom: x1e80100: Fix special pin offsets (medium 5.5)
- [CVE-2024-46707](https://insights.sbomify.com/CVE-2024-46707/): KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 (medium 5.5)
- [CVE-2024-46706](https://insights.sbomify.com/CVE-2024-46706/): tty: serial: fsl_lpuart: mark last busy before uart_add_one_port (medium 5.5)
- [CVE-2024-46705](https://insights.sbomify.com/CVE-2024-46705/): drm/xe: reset mmio mappings with devm (high 7.8)
- [CVE-2024-46704](https://insights.sbomify.com/CVE-2024-46704/): workqueue: Fix spruious data race in __flush_work() (medium 4.7)
- [CVE-2024-46703](https://insights.sbomify.com/CVE-2024-46703/): Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" (medium 5.5)
- [CVE-2024-46702](https://insights.sbomify.com/CVE-2024-46702/): thunderbolt: Mark XDomain as unplugged when router is removed (medium 5.5)
- [CVE-2024-46701](https://insights.sbomify.com/CVE-2024-46701/): libfs: fix infinite directory reads for offset dir (medium 5.5)
- [CVE-2024-4670](https://insights.sbomify.com/CVE-2024-4670/): All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode (high 8.8)
- [CVE-2024-46699](https://insights.sbomify.com/CVE-2024-46699/): drm/v3d: Disable preemption while updating GPU stats (high 7.8)
- [CVE-2024-46698](https://insights.sbomify.com/CVE-2024-46698/): video/aperture: optionally match the device in sysfb_disable() (medium 5.5)
- [CVE-2024-46697](https://insights.sbomify.com/CVE-2024-46697/): nfsd: ensure that nfsd4_fattr_args.context is zeroed out (critical 9.8)
- [CVE-2024-46696](https://insights.sbomify.com/CVE-2024-46696/): nfsd: fix potential UAF in nfsd4_cb_getattr_release (critical 9.8)
- [CVE-2024-46695](https://insights.sbomify.com/CVE-2024-46695/): selinux,smack: don't bypass permissions check in inode_setsecctx hook (critical 9.8)
- [CVE-2024-46694](https://insights.sbomify.com/CVE-2024-46694/): drm/amd/display: avoid using null object of framebuffer (medium 5.5)
- [CVE-2024-46693](https://insights.sbomify.com/CVE-2024-46693/): soc: qcom: pmic_glink: Fix race during initialization (medium 4.7)
- [CVE-2024-46692](https://insights.sbomify.com/CVE-2024-46692/): firmware: qcom: scm: Mark get_wq_ctx() as atomic call (medium 5.5)
- [CVE-2024-46691](https://insights.sbomify.com/CVE-2024-46691/): usb: typec: ucsi: Move unregister out of atomic section (medium 5.5)
- [CVE-2024-46690](https://insights.sbomify.com/CVE-2024-46690/): nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease (critical 9.8)
- [CVE-2024-4669](https://insights.sbomify.com/CVE-2024-4669/): Events Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-46689](https://insights.sbomify.com/CVE-2024-46689/): soc: qcom: cmd-db: Map shared memory as WC, not WB (medium 5.5)
- [CVE-2024-46688](https://insights.sbomify.com/CVE-2024-46688/): erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails (medium 5.5)
- [CVE-2024-46687](https://insights.sbomify.com/CVE-2024-46687/): btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() (high 7.8)
- [CVE-2024-46686](https://insights.sbomify.com/CVE-2024-46686/): smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() (medium 5.5)
- [CVE-2024-46685](https://insights.sbomify.com/CVE-2024-46685/): pinctrl: single: fix potential NULL dereference in pcs_get_function() (medium 5.5)
- [CVE-2024-46684](https://insights.sbomify.com/CVE-2024-46684/): binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined (medium 5.5)
- [CVE-2024-46683](https://insights.sbomify.com/CVE-2024-46683/): drm/xe: prevent UAF around preempt fence (high 7.8)
- [CVE-2024-46682](https://insights.sbomify.com/CVE-2024-46682/): nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open (medium 5.5)
- [CVE-2024-46681](https://insights.sbomify.com/CVE-2024-46681/): pktgen: use cpus_read_lock() in pg_net_init() (medium 5.5)
- [CVE-2024-46680](https://insights.sbomify.com/CVE-2024-46680/): Bluetooth: btnxpuart: Fix random crash seen while removing driver (high 7.8)
- [CVE-2024-4668](https://insights.sbomify.com/CVE-2024-4668/): Cross-site scripting in Gum Addon for Elementor (medium 6.4)
- [CVE-2024-46679](https://insights.sbomify.com/CVE-2024-46679/): ethtool: check device is present when getting link settings (medium 4.7)
- [CVE-2024-46678](https://insights.sbomify.com/CVE-2024-46678/): bonding: change ipsec_lock from spin lock to mutex (high 7.8)
- [CVE-2024-46677](https://insights.sbomify.com/CVE-2024-46677/): gtp: fix a potential NULL pointer dereference (medium 5.5)
- [CVE-2024-46676](https://insights.sbomify.com/CVE-2024-46676/): nfc: pn533: Add poll mod list filling check (medium 5.5)
- [CVE-2024-46675](https://insights.sbomify.com/CVE-2024-46675/): usb: dwc3: core: Prevent USB core invalid event buffer address access (medium 5.5)
- [CVE-2024-46674](https://insights.sbomify.com/CVE-2024-46674/): usb: dwc3: st: fix probed platform device ref count on probe error path (high 7.8)
- [CVE-2024-46673](https://insights.sbomify.com/CVE-2024-46673/): scsi: aacraid: Fix double-free on probe failure (high 7.8)
- [CVE-2024-46672](https://insights.sbomify.com/CVE-2024-46672/): wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion (medium 5.5)
- [CVE-2024-46671](https://insights.sbomify.com/CVE-2024-46671/): Missing authorization in FortiWeb (medium 5.6)
- [CVE-2024-46670](https://insights.sbomify.com/CVE-2024-46670/): Denial of service in FortiOS (high 7.5)
- [CVE-2024-4667](https://insights.sbomify.com/CVE-2024-4667/): Cross-site scripting in Blog, Posts and Category Filter for Elementor (medium 6.4)
- [CVE-2024-46669](https://insights.sbomify.com/CVE-2024-46669/): Integer overflow in FortiOS (low 3.2)
- [CVE-2024-46668](https://insights.sbomify.com/CVE-2024-46668/): Denial of service in FortiOS (high 7.1)
- [CVE-2024-46667](https://insights.sbomify.com/CVE-2024-46667/): Denial of service in FortiSIEM (medium 6.9)
- [CVE-2024-46666](https://insights.sbomify.com/CVE-2024-46666/): Denial of service in FortiOS (medium 4.8)
- [CVE-2024-46665](https://insights.sbomify.com/CVE-2024-46665/): Information disclosure in FortiOS (low 3.5)
- [CVE-2024-46664](https://insights.sbomify.com/CVE-2024-46664/): Path traversal in FortiRecorder (medium 5.2)
- [CVE-2024-46663](https://insights.sbomify.com/CVE-2024-46663/): Memory corruption in FortiMail (medium 6.5)
- [CVE-2024-46662](https://insights.sbomify.com/CVE-2024-46662/): Command injection in FortiManager (high 8.3)
- [CVE-2024-4666](https://insights.sbomify.com/CVE-2024-4666/): Cross-site scripting in Borderless – Addons and Templates for Elementor (medium 6.4)
- [CVE-2024-46658](https://insights.sbomify.com/CVE-2024-46658/): Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability. (high 8.0)
- [CVE-2024-46657](https://insights.sbomify.com/CVE-2024-46657/): Memory corruption in artifex:mupdf (medium 5.5)
- [CVE-2024-46655](https://insights.sbomify.com/CVE-2024-46655/): Cross-site scripting in ellevo:ellevo (medium 6.1)
- [CVE-2024-46654](https://insights.sbomify.com/CVE-2024-46654/): Cross-site scripting in maccms:maccms (medium 4.8)
- [CVE-2024-46652](https://insights.sbomify.com/CVE-2024-46652/): Memory corruption in tenda:ac8 firmware (critical 9.8)
- [CVE-2024-4665](https://insights.sbomify.com/CVE-2024-4665/): EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update (medium 6.4)
- [CVE-2024-46649](https://insights.sbomify.com/CVE-2024-46649/): Path traversal in enms:enms (high 7.5)
- [CVE-2024-46648](https://insights.sbomify.com/CVE-2024-46648/): Path traversal in enms:enms (high 7.5)
- [CVE-2024-46647](https://insights.sbomify.com/CVE-2024-46647/): Path traversal in enms:enms (medium 6.5)
- [CVE-2024-46646](https://insights.sbomify.com/CVE-2024-46646/): Path traversal in enms:enms (medium 6.5)
- [CVE-2024-46645](https://insights.sbomify.com/CVE-2024-46645/): Path traversal in enms:enms (high 7.5)
- [CVE-2024-46644](https://insights.sbomify.com/CVE-2024-46644/): Path traversal in enms:enms (medium 6.5)
- [CVE-2024-46640](https://insights.sbomify.com/CVE-2024-46640/): Code injection in seacms:seacms (critical 9.8)
- [CVE-2024-4664](https://insights.sbomify.com/CVE-2024-4664/): WP Chat App < 3.6.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-46639](https://insights.sbomify.com/CVE-2024-46639/): A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo (high 7.6)
- [CVE-2024-46636](https://insights.sbomify.com/CVE-2024-46636/): NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the (critical 9.4)
- [CVE-2024-46635](https://insights.sbomify.com/CVE-2024-46635/): An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/259/