# Vulnerabilities published in 2024


- [CVE-2024-43930](https://insights.sbomify.com/CVE-2024-43930/): WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-4393](https://insights.sbomify.com/CVE-2024-4393/): Social Connect <= 1.2 - Authentication Bypass (critical 9.8)
- [CVE-2024-43929](https://insights.sbomify.com/CVE-2024-43929/): WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43928](https://insights.sbomify.com/CVE-2024-43928/): WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-43927](https://insights.sbomify.com/CVE-2024-43927/): WordPress Email Address Encoder plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43926](https://insights.sbomify.com/CVE-2024-43926/): WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43925](https://insights.sbomify.com/CVE-2024-43925/): WordPress Envira Gallery Lite plugin <= 1.8.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43924](https://insights.sbomify.com/CVE-2024-43924/): WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43923](https://insights.sbomify.com/CVE-2024-43923/): WordPress Timetics plugin <= 1.0.23 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43922](https://insights.sbomify.com/CVE-2024-43922/): WordPress NitroPack plugin <= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability (medium 4.8)
- [CVE-2024-43921](https://insights.sbomify.com/CVE-2024-43921/): WordPress Generate Images – Magic Post Thumbnail plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43920](https://insights.sbomify.com/CVE-2024-43920/): Cross-site scripting in Gutenverse (medium 6.5)
- [CVE-2024-4392](https://insights.sbomify.com/CVE-2024-4392/): Cross-site scripting in Jetpack – WP Security, Backup, Speed, & Growth (medium 6.4)
- [CVE-2024-43919](https://insights.sbomify.com/CVE-2024-43919/): WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43918](https://insights.sbomify.com/CVE-2024-43918/): WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability (critical 10.0)
- [CVE-2024-43917](https://insights.sbomify.com/CVE-2024-43917/): WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-43916](https://insights.sbomify.com/CVE-2024-43916/): WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2024-43915](https://insights.sbomify.com/CVE-2024-43915/): WordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerability (medium 5.5)
- [CVE-2024-43914](https://insights.sbomify.com/CVE-2024-43914/): md/raid5: avoid BUG_ON() while continue reshape after reassembling (medium 5.5)
- [CVE-2024-43913](https://insights.sbomify.com/CVE-2024-43913/): nvme: apple: fix device reference counting (high 7.0)
- [CVE-2024-43912](https://insights.sbomify.com/CVE-2024-43912/): wifi: nl80211: disallow setting special AP channel widths (medium 5.5)
- [CVE-2024-43911](https://insights.sbomify.com/CVE-2024-43911/): wifi: mac80211: fix NULL dereference at band check in starting tx ba session (medium 5.5)
- [CVE-2024-43910](https://insights.sbomify.com/CVE-2024-43910/): bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses (high 7.8)
- [CVE-2024-4391](https://insights.sbomify.com/CVE-2024-4391/): Cross-site scripting in Happy Addons for Elementor (medium 6.4)
- [CVE-2024-43909](https://insights.sbomify.com/CVE-2024-43909/): drm/amdgpu/pm: Fix the null pointer dereference for smu7 (medium 5.5)
- [CVE-2024-43908](https://insights.sbomify.com/CVE-2024-43908/): drm/amdgpu: Fix the null pointer dereference to ras_manager (medium 5.5)
- [CVE-2024-43907](https://insights.sbomify.com/CVE-2024-43907/): drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules (medium 5.5)
- [CVE-2024-43906](https://insights.sbomify.com/CVE-2024-43906/): drm/admgpu: fix dereferencing null pointer context (medium 5.5)
- [CVE-2024-43905](https://insights.sbomify.com/CVE-2024-43905/): drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr (medium 5.5)
- [CVE-2024-43904](https://insights.sbomify.com/CVE-2024-43904/): drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing (medium 5.5)
- [CVE-2024-43902](https://insights.sbomify.com/CVE-2024-43902/): drm/amd/display: Add null checker before passing variables (medium 5.5)
- [CVE-2024-43901](https://insights.sbomify.com/CVE-2024-43901/): drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401 (medium 5.5)
- [CVE-2024-43900](https://insights.sbomify.com/CVE-2024-43900/): media: xc2028: avoid use-after-free in load_firmware_cb() (high 7.8)
- [CVE-2024-4390](https://insights.sbomify.com/CVE-2024-4390/): Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation (medium 6.5)
- [CVE-2024-43899](https://insights.sbomify.com/CVE-2024-43899/): drm/amd/display: Fix null pointer deref in dcn20_resource.c (medium 5.5)
- [CVE-2024-43897](https://insights.sbomify.com/CVE-2024-43897/): net: drop bad gso csum_start and offset in virtio_net_hdr (high 7.8)
- [CVE-2024-43896](https://insights.sbomify.com/CVE-2024-43896/): ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL (medium 5.5)
- [CVE-2024-43894](https://insights.sbomify.com/CVE-2024-43894/): drm/client: fix null pointer dereference in drm_client_modeset_probe (medium 5.5)
- [CVE-2024-43893](https://insights.sbomify.com/CVE-2024-43893/): serial: core: check uartclk for zero to avoid divide by zero (medium 5.5)
- [CVE-2024-43892](https://insights.sbomify.com/CVE-2024-43892/): memcg: protect concurrent access to mem_cgroup_idr (high 7.8)
- [CVE-2024-43891](https://insights.sbomify.com/CVE-2024-43891/): tracing: Have format file honor EVENT_FILE_FL_FREED (high 7.8)
- [CVE-2024-43890](https://insights.sbomify.com/CVE-2024-43890/): tracing: Fix overflow in get_free_elt() (medium 5.5)
- [CVE-2024-4389](https://insights.sbomify.com/CVE-2024-4389/): File upload in Depicter — Popup & Slider Builder (high 8.8)
- [CVE-2024-43889](https://insights.sbomify.com/CVE-2024-43889/): padata: Fix possible divide-by-0 panic in padata_mt_helper() (medium 5.5)
- [CVE-2024-43888](https://insights.sbomify.com/CVE-2024-43888/): mm: list_lru: fix UAF for memory cgroup (high 7.8)
- [CVE-2024-43887](https://insights.sbomify.com/CVE-2024-43887/): net/tcp: Disable TCP-AO static key after RCU grace period (medium 4.7)
- [CVE-2024-43886](https://insights.sbomify.com/CVE-2024-43886/): drm/amd/display: Add null check in resource_log_pipe_topology_update (medium 5.5)
- [CVE-2024-43884](https://insights.sbomify.com/CVE-2024-43884/): Bluetooth: MGMT: Add error handling to pair_device() (medium 5.5)
- [CVE-2024-43883](https://insights.sbomify.com/CVE-2024-43883/): usb: vhci-hcd: Do not drop references before new references are gained (critical 9.8)
- [CVE-2024-43882](https://insights.sbomify.com/CVE-2024-43882/): exec: Fix ToCToU between perm check and set-uid/gid usage (high 7.8)
- [CVE-2024-43881](https://insights.sbomify.com/CVE-2024-43881/): wifi: ath12k: change DMA direction while mapping reinjected packets (high 8.8)
- [CVE-2024-43880](https://insights.sbomify.com/CVE-2024-43880/): mlxsw: spectrum_acl_erp: Fix object nesting warning (high 7.8)
- [CVE-2024-4388](https://insights.sbomify.com/CVE-2024-4388/): CAS <= 1.0.0 - Unauthenticated Arbitrary File Access (high 7.5)
- [CVE-2024-43879](https://insights.sbomify.com/CVE-2024-43879/): wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (medium 5.5)
- [CVE-2024-43878](https://insights.sbomify.com/CVE-2024-43878/): xfrm: Fix input error path memory access (high 8.1)
- [CVE-2024-43877](https://insights.sbomify.com/CVE-2024-43877/): media: pci: ivtv: Add check for DMA map result (high 7.8)
- [CVE-2024-43876](https://insights.sbomify.com/CVE-2024-43876/): PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() (medium 5.5)
- [CVE-2024-43875](https://insights.sbomify.com/CVE-2024-43875/): PCI: endpoint: Clean up error handling in vpci_scan_bus() (medium 5.5)
- [CVE-2024-43874](https://insights.sbomify.com/CVE-2024-43874/): crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_locked (medium 5.5)
- [CVE-2024-43873](https://insights.sbomify.com/CVE-2024-43873/): vhost/vsock: always initialize seqpacket_allow (high 7.8)
- [CVE-2024-43872](https://insights.sbomify.com/CVE-2024-43872/): RDMA/hns: Fix soft lockup under heavy CEQE load (high 7.5)
- [CVE-2024-43871](https://insights.sbomify.com/CVE-2024-43871/): devres: Fix memory leakage caused by driver API devm_free_percpu() (medium 5.5)
- [CVE-2024-43870](https://insights.sbomify.com/CVE-2024-43870/): perf: Fix event leak upon exit (medium 5.5)
- [CVE-2024-43869](https://insights.sbomify.com/CVE-2024-43869/): perf: Fix event leak upon exec and file release (medium 5.5)
- [CVE-2024-43868](https://insights.sbomify.com/CVE-2024-43868/): riscv/purgatory: align riscv_kernel_entry (medium 5.5)
- [CVE-2024-43867](https://insights.sbomify.com/CVE-2024-43867/): drm/nouveau: prime: fix refcount underflow (medium 5.5)
- [CVE-2024-43866](https://insights.sbomify.com/CVE-2024-43866/): net/mlx5: Always drain health in shutdown callback (medium 4.7)
- [CVE-2024-43865](https://insights.sbomify.com/CVE-2024-43865/): s390/fpu: Re-add exception handling in load_fpu_state() (medium 5.5)
- [CVE-2024-43864](https://insights.sbomify.com/CVE-2024-43864/): net/mlx5e: Fix CT entry update leaks of modify header context (critical 9.8)
- [CVE-2024-43863](https://insights.sbomify.com/CVE-2024-43863/): drm/vmwgfx: Fix a deadlock in dma buf fence polling (medium 5.5)
- [CVE-2024-43862](https://insights.sbomify.com/CVE-2024-43862/): net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex (medium 5.5)
- [CVE-2024-43861](https://insights.sbomify.com/CVE-2024-43861/): net: usb: qmi_wwan: fix memory leak for not ip packets (medium 5.5)
- [CVE-2024-43860](https://insights.sbomify.com/CVE-2024-43860/): remoteproc: imx_rproc: Skip over memory region when node value is NULL (medium 5.5)
- [CVE-2024-4386](https://insights.sbomify.com/CVE-2024-4386/): Gallery Block (Meow Gallery) <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-43859](https://insights.sbomify.com/CVE-2024-43859/): f2fs: fix to truncate preallocated blocks in f2fs_file_open() (medium 5.5)
- [CVE-2024-43858](https://insights.sbomify.com/CVE-2024-43858/): jfs: Fix array-index-out-of-bounds in diFree (high 7.8)
- [CVE-2024-43857](https://insights.sbomify.com/CVE-2024-43857/): f2fs: fix null reference error when checking end of zone (medium 5.5)
- [CVE-2024-43856](https://insights.sbomify.com/CVE-2024-43856/): dma: fix call order in dmam_free_coherent (high 7.8)
- [CVE-2024-43855](https://insights.sbomify.com/CVE-2024-43855/): md: fix deadlock between mddev_suspend and flush bio (medium 5.5)
- [CVE-2024-43854](https://insights.sbomify.com/CVE-2024-43854/): block: initialize integrity buffer to zero before writing it to media (medium 5.5)
- [CVE-2024-43853](https://insights.sbomify.com/CVE-2024-43853/): cgroup/cpuset: Prevent UAF in proc_cpuset_show() (high 7.0)
- [CVE-2024-43852](https://insights.sbomify.com/CVE-2024-43852/): hwmon: (ltc2991) re-order conditions to fix off by one bug (high 7.8)
- [CVE-2024-43851](https://insights.sbomify.com/CVE-2024-43851/): soc: xilinx: rename cpu_number1 to dummy_cpu_number (medium 5.5)
- [CVE-2024-43850](https://insights.sbomify.com/CVE-2024-43850/): soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove (medium 5.5)
- [CVE-2024-4385](https://insights.sbomify.com/CVE-2024-4385/): Envo Extra <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting (medium 6.4)
- [CVE-2024-43849](https://insights.sbomify.com/CVE-2024-43849/): soc: qcom: pdr: protect locator_addr with the main mutex (medium 5.5)
- [CVE-2024-43848](https://insights.sbomify.com/CVE-2024-43848/): wifi: mac80211: fix TTLM teardown work (high 8.8)
- [CVE-2024-43847](https://insights.sbomify.com/CVE-2024-43847/): wifi: ath12k: fix invalid memory access while processing fragmented packets (high 8.8)
- [CVE-2024-43846](https://insights.sbomify.com/CVE-2024-43846/): lib: objagg: Fix general protection fault (high 7.8)
- [CVE-2024-43845](https://insights.sbomify.com/CVE-2024-43845/): udf: Fix bogus checksum computation in udf_rename() (high 7.8)
- [CVE-2024-43844](https://insights.sbomify.com/CVE-2024-43844/): wifi: rtw89: wow: fix GTK offload H2C skbuff issue (medium 5.5)
- [CVE-2024-43843](https://insights.sbomify.com/CVE-2024-43843/): riscv, bpf: Fix out-of-bounds issue when preparing trampoline image (high 7.8)
- [CVE-2024-43842](https://insights.sbomify.com/CVE-2024-43842/): wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (high 7.8)
- [CVE-2024-43841](https://insights.sbomify.com/CVE-2024-43841/): wifi: virt_wifi: avoid reporting connection success with wrong SSID (low 3.3)
- [CVE-2024-43840](https://insights.sbomify.com/CVE-2024-43840/): bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (high 7.8)
- [CVE-2024-4384](https://insights.sbomify.com/CVE-2024-4384/): CSSable Countdown <= 1.5 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-43839](https://insights.sbomify.com/CVE-2024-43839/): bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (high 7.8)
- [CVE-2024-43838](https://insights.sbomify.com/CVE-2024-43838/): bpf: fix overflow check in adjust_jmp_off() (medium 5.5)
- [CVE-2024-43837](https://insights.sbomify.com/CVE-2024-43837/): bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT (medium 5.5)
- [CVE-2024-43836](https://insights.sbomify.com/CVE-2024-43836/): net: ethtool: pse-pd: Fix possible null-deref (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/278/