# Vulnerabilities published in 2024


- [CVE-2024-4501](https://insights.sbomify.com/CVE-2024-4501/): Ruijie RG-UAC commit.php os command injection (medium 4.7)
- [CVE-2024-45009](https://insights.sbomify.com/CVE-2024-45009/): mptcp: pm: only decrement add_addr_accepted for MPJ req (high 8.2)
- [CVE-2024-45008](https://insights.sbomify.com/CVE-2024-45008/): Input: MT - limit max slots (medium 5.5)
- [CVE-2024-45007](https://insights.sbomify.com/CVE-2024-45007/): char: xillybus: Don't destroy workqueue from work item running on it (medium 5.5)
- [CVE-2024-45006](https://insights.sbomify.com/CVE-2024-45006/): xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (medium 5.5)
- [CVE-2024-45005](https://insights.sbomify.com/CVE-2024-45005/): KVM: s390: fix validity interception issue when gisa is switched off (medium 5.5)
- [CVE-2024-45004](https://insights.sbomify.com/CVE-2024-45004/): KEYS: trusted: dcp: fix leak of blob encryption key (medium 5.5)
- [CVE-2024-45003](https://insights.sbomify.com/CVE-2024-45003/): vfs: Don't evict inode under the inode lru traversing context (medium 4.7)
- [CVE-2024-45002](https://insights.sbomify.com/CVE-2024-45002/): rtla/osnoise: Prevent NULL dereference in error handling (medium 5.5)
- [CVE-2024-45001](https://insights.sbomify.com/CVE-2024-45001/): net: mana: Fix RX buf alloc_size alignment and atomic op panic (high 7.5)
- [CVE-2024-45000](https://insights.sbomify.com/CVE-2024-45000/): fs/netfs/fscache_cookie: add missing "n_accesses" check (high 7.8)
- [CVE-2024-4500](https://insights.sbomify.com/CVE-2024-4500/): SourceCodester Prison Management System edit-photo.php unrestricted upload (medium 6.3)
- [CVE-2024-44999](https://insights.sbomify.com/CVE-2024-44999/): gtp: pull network headers in gtp_dev_xmit() (high 7.1)
- [CVE-2024-44998](https://insights.sbomify.com/CVE-2024-44998/): atm: idt77252: prevent use after free in dequeue_rx() (critical 9.8)
- [CVE-2024-44997](https://insights.sbomify.com/CVE-2024-44997/): net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() (high 7.8)
- [CVE-2024-44996](https://insights.sbomify.com/CVE-2024-44996/): vsock: fix recursive ->recvmsg calls (medium 5.5)
- [CVE-2024-44995](https://insights.sbomify.com/CVE-2024-44995/): net: hns3: fix a deadlock problem when config TC during resetting (high 7.8)
- [CVE-2024-44994](https://insights.sbomify.com/CVE-2024-44994/): iommu: Restore lost return in iommu_report_device_fault() (high 8.8)
- [CVE-2024-44993](https://insights.sbomify.com/CVE-2024-44993/): drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()` (high 7.1)
- [CVE-2024-44992](https://insights.sbomify.com/CVE-2024-44992/): smb/client: avoid possible NULL dereference in cifs_free_subrequest() (high 7.5)
- [CVE-2024-44991](https://insights.sbomify.com/CVE-2024-44991/): tcp: prevent concurrent execution of tcp_sk_exit_batch (medium 5.5)
- [CVE-2024-44990](https://insights.sbomify.com/CVE-2024-44990/): bonding: fix null pointer deref in bond_ipsec_offload_ok (medium 5.5)
- [CVE-2024-4499](https://insights.sbomify.com/CVE-2024-4499/): CSRF Vulnerability in parisneo/lollms XTTS Server (high 7.6)
- [CVE-2024-44989](https://insights.sbomify.com/CVE-2024-44989/): bonding: fix xfrm real_dev null pointer dereference (medium 5.5)
- [CVE-2024-44988](https://insights.sbomify.com/CVE-2024-44988/): net: dsa: mv88e6xxx: Fix out-of-bound access (high 8.8)
- [CVE-2024-44987](https://insights.sbomify.com/CVE-2024-44987/): ipv6: prevent UAF in ip6_send_skb() (high 7.8)
- [CVE-2024-44986](https://insights.sbomify.com/CVE-2024-44986/): ipv6: fix possible UAF in ip6_finish_output2() (high 8.1)
- [CVE-2024-44985](https://insights.sbomify.com/CVE-2024-44985/): ipv6: prevent possible UAF in ip6_xmit() (critical 9.8)
- [CVE-2024-44984](https://insights.sbomify.com/CVE-2024-44984/): bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (critical 10.0)
- [CVE-2024-44983](https://insights.sbomify.com/CVE-2024-44983/): netfilter: flowtable: validate vlan header (high 7.1)
- [CVE-2024-44982](https://insights.sbomify.com/CVE-2024-44982/): drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (medium 5.5)
- [CVE-2024-44981](https://insights.sbomify.com/CVE-2024-44981/): workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (medium 5.5)
- [CVE-2024-44980](https://insights.sbomify.com/CVE-2024-44980/): drm/xe: Fix opregion leak (medium 5.5)
- [CVE-2024-4498](https://insights.sbomify.com/CVE-2024-4498/): Path Traversal and RFI Vulnerability in parisneo/lollms-webui (high 7.7)
- [CVE-2024-44979](https://insights.sbomify.com/CVE-2024-44979/): drm/xe: Fix missing workqueue destroy in xe_gt_pagefault (medium 5.5)
- [CVE-2024-44978](https://insights.sbomify.com/CVE-2024-44978/): drm/xe: Free job before xe_exec_queue_put (high 7.8)
- [CVE-2024-44977](https://insights.sbomify.com/CVE-2024-44977/): drm/amdgpu: Validate TA binary size (high 7.8)
- [CVE-2024-44976](https://insights.sbomify.com/CVE-2024-44976/): ata: pata_macio: Fix DMA table overflow (medium 5.5)
- [CVE-2024-44975](https://insights.sbomify.com/CVE-2024-44975/): cgroup/cpuset: fix panic caused by partcmd_update (medium 5.5)
- [CVE-2024-44974](https://insights.sbomify.com/CVE-2024-44974/): mptcp: pm: avoid possible UaF when selecting endp (high 7.8)
- [CVE-2024-44973](https://insights.sbomify.com/CVE-2024-44973/): mm, slub: do not call do_slab_free for kfence object (high 8.1)
- [CVE-2024-44971](https://insights.sbomify.com/CVE-2024-44971/): net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (medium 5.5)
- [CVE-2024-44970](https://insights.sbomify.com/CVE-2024-44970/): net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (critical 9.8)
- [CVE-2024-4497](https://insights.sbomify.com/CVE-2024-4497/): Tenda i21 formexeCommand stack-based overflow (high 8.8)
- [CVE-2024-44969](https://insights.sbomify.com/CVE-2024-44969/): s390/sclp: Prevent release of buffer in I/O (medium 5.5)
- [CVE-2024-44968](https://insights.sbomify.com/CVE-2024-44968/): tick/broadcast: Move per CPU pointer access into the atomic section (medium 5.5)
- [CVE-2024-44967](https://insights.sbomify.com/CVE-2024-44967/): drm/mgag200: Bind I2C lifetime to DRM device (high 7.8)
- [CVE-2024-44966](https://insights.sbomify.com/CVE-2024-44966/): binfmt_flat: Fix corruption when not offsetting data start (high 7.8)
- [CVE-2024-44965](https://insights.sbomify.com/CVE-2024-44965/): x86/mm: Fix pti_clone_pgtable() alignment assumption (medium 5.5)
- [CVE-2024-44964](https://insights.sbomify.com/CVE-2024-44964/): idpf: fix memory leaks and crashes while performing a soft reset (high 7.8)
- [CVE-2024-44963](https://insights.sbomify.com/CVE-2024-44963/): btrfs: do not BUG_ON() when freeing tree block after error (medium 5.5)
- [CVE-2024-44962](https://insights.sbomify.com/CVE-2024-44962/): Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading (medium 5.5)
- [CVE-2024-44961](https://insights.sbomify.com/CVE-2024-44961/): drm/amdgpu: Forward soft recovery errors to userspace (medium 5.5)
- [CVE-2024-44960](https://insights.sbomify.com/CVE-2024-44960/): usb: gadget: core: Check for unset descriptor (medium 5.5)
- [CVE-2024-4496](https://insights.sbomify.com/CVE-2024-4496/): Tenda i21 formWifiMacFilterSet stack-based overflow (high 8.8)
- [CVE-2024-44959](https://insights.sbomify.com/CVE-2024-44959/): tracefs: Use generic inode RCU for synchronizing freeing (high 7.8)
- [CVE-2024-44958](https://insights.sbomify.com/CVE-2024-44958/): sched/smt: Fix unbalance sched_smt_present dec/inc (medium 5.5)
- [CVE-2024-44957](https://insights.sbomify.com/CVE-2024-44957/): xen: privcmd: Switch from mutex to spinlock for irqfds (medium 5.5)
- [CVE-2024-44956](https://insights.sbomify.com/CVE-2024-44956/): drm/xe/preempt_fence: enlarge the fence critical section (medium 5.5)
- [CVE-2024-44954](https://insights.sbomify.com/CVE-2024-44954/): ALSA: line6: Fix racy access to midibuf (high 7.8)
- [CVE-2024-44953](https://insights.sbomify.com/CVE-2024-44953/): scsi: ufs: core: Fix deadlock during RTC update (medium 5.5)
- [CVE-2024-44951](https://insights.sbomify.com/CVE-2024-44951/): serial: sc16is7xx: fix TX fifo corruption (high 7.8)
- [CVE-2024-44950](https://insights.sbomify.com/CVE-2024-44950/): serial: sc16is7xx: fix invalid FIFO access with special register set (high 7.1)
- [CVE-2024-4495](https://insights.sbomify.com/CVE-2024-4495/): Tenda i21 formWifiMacFilterGet stack-based overflow (high 8.8)
- [CVE-2024-44949](https://insights.sbomify.com/CVE-2024-44949/): parisc: fix a possible DMA corruption (high 7.8)
- [CVE-2024-44948](https://insights.sbomify.com/CVE-2024-44948/): x86/mtrr: Check if fixed MTRRs exist before saving them (medium 5.5)
- [CVE-2024-44947](https://insights.sbomify.com/CVE-2024-44947/): fuse: Initialize beyond-EOF page contents before setting uptodate (medium 5.5)
- [CVE-2024-44946](https://insights.sbomify.com/CVE-2024-44946/): kcm: Serialise kcm_sendmsg() for the same socket. (high 7.8)
- [CVE-2024-44945](https://insights.sbomify.com/CVE-2024-44945/): netfilter: nfnetlink: Initialise extack before use in ACKs (high 7.1)
- [CVE-2024-44944](https://insights.sbomify.com/CVE-2024-44944/): netfilter: ctnetlink: use helper function to calculate expect ID (medium 5.5)
- [CVE-2024-44943](https://insights.sbomify.com/CVE-2024-44943/): mm: gup: stop abusing try_grab_folio (medium 5.5)
- [CVE-2024-44942](https://insights.sbomify.com/CVE-2024-44942/): f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC (high 7.8)
- [CVE-2024-44941](https://insights.sbomify.com/CVE-2024-44941/): f2fs: fix to cover read extent cache access with lock (high 7.8)
- [CVE-2024-44940](https://insights.sbomify.com/CVE-2024-44940/): fou: remove warn in gue_gro_receive on unsupported protocol (high 7.5)
- [CVE-2024-4494](https://insights.sbomify.com/CVE-2024-4494/): Tenda i21 setUplinkInfo formSetUplinkInfo stack-based overflow (high 8.8)
- [CVE-2024-44939](https://insights.sbomify.com/CVE-2024-44939/): jfs: fix null ptr deref in dtInsertEntry (high 7.8)
- [CVE-2024-44938](https://insights.sbomify.com/CVE-2024-44938/): jfs: Fix shift-out-of-bounds in dbDiscardAG (medium 5.5)
- [CVE-2024-44937](https://insights.sbomify.com/CVE-2024-44937/): platform/x86: intel-vbtn: Protect ACPI notify handler against recursion (medium 5.5)
- [CVE-2024-44936](https://insights.sbomify.com/CVE-2024-44936/): power: supply: rt5033: Bring back i2c_set_clientdata (medium 5.5)
- [CVE-2024-44935](https://insights.sbomify.com/CVE-2024-44935/): sctp: Fix null-ptr-deref in reuseport_add_sock(). (medium 5.5)
- [CVE-2024-44934](https://insights.sbomify.com/CVE-2024-44934/): net: bridge: mcast: wait for previous gc cycles when removing port (high 7.8)
- [CVE-2024-44933](https://insights.sbomify.com/CVE-2024-44933/): bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() (high 7.3)
- [CVE-2024-44932](https://insights.sbomify.com/CVE-2024-44932/): idpf: fix UAFs when destroying the queues (high 7.8)
- [CVE-2024-44931](https://insights.sbomify.com/CVE-2024-44931/): gpio: prevent potential speculation leaks in gpio_device_get_desc() (medium 5.5)
- [CVE-2024-44930](https://insights.sbomify.com/CVE-2024-44930/): Serilog Client IP Spoofing vulnerability (medium 6.5)
- [CVE-2024-4493](https://insights.sbomify.com/CVE-2024-4493/): Tenda i21 formSetAutoPing stack-based overflow (high 8.8)
- [CVE-2024-44921](https://insights.sbomify.com/CVE-2024-44921/): SQL injection in seacms:seacms (critical 9.8)
- [CVE-2024-44920](https://insights.sbomify.com/CVE-2024-44920/): Cross-site scripting in seacms:seacms (medium 6.1)
- [CVE-2024-4492](https://insights.sbomify.com/CVE-2024-4492/): Tenda i21 setStaOffline formOfflineSet stack-based overflow (high 8.8)
- [CVE-2024-44919](https://insights.sbomify.com/CVE-2024-44919/): Cross-site scripting in seacms:seacms (medium 5.4)
- [CVE-2024-44918](https://insights.sbomify.com/CVE-2024-44918/): Cross-site scripting in seacms:seacms (low 3.5)
- [CVE-2024-44916](https://insights.sbomify.com/CVE-2024-44916/): Command injection in seacms:seacms (high 7.2)
- [CVE-2024-44915](https://insights.sbomify.com/CVE-2024-44915/): Memory corruption in irfanview:exr (medium 5.5)
- [CVE-2024-44914](https://insights.sbomify.com/CVE-2024-44914/): Memory corruption in irfanview:exr (medium 5.5)
- [CVE-2024-44913](https://insights.sbomify.com/CVE-2024-44913/): Memory corruption in irfanview:exr (medium 5.5)
- [CVE-2024-44912](https://insights.sbomify.com/CVE-2024-44912/): Memory corruption in nasa:cryptolib (high 7.5)
- [CVE-2024-44911](https://insights.sbomify.com/CVE-2024-44911/): Memory corruption in nasa:cryptolib (high 7.5)
- [CVE-2024-44910](https://insights.sbomify.com/CVE-2024-44910/): Memory corruption in nasa:cryptolib (high 7.5)
- [CVE-2024-4491](https://insights.sbomify.com/CVE-2024-4491/): Tenda i21 formGetDiagnoseInfo stack-based overflow (high 8.8)
- [CVE-2024-44906](https://insights.sbomify.com/CVE-2024-44906/): uptrace pgdriver SQL injection vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/271/