Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 279 of 521.
- CVE-2024-43835 virtio_net: Fix napi_skb_cache_put warning
- CVE-2024-43834 xdp: fix invalid wait context of page_pool_destroy()
- CVE-2024-43833 media: v4l: async: Fix NULL pointer dereference in adding ancillary links
- CVE-2024-43832 s390/uv: Don't call folio_wait_writeback() without a folio reference
- CVE-2024-43831 media: mediatek: vcodec: Handle invalid decoder vsi
- CVE-2024-43830 leds: trigger: Unregister sysfs attributes before calling deactivate()
- CVE-2024-4383 Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-43829 drm/qxl: Add check for drm_cvt_mode
- CVE-2024-43828 ext4: fix infinite loop when replaying fast_commit
- CVE-2024-43827 drm/amd/display: Add null check before access structs
- CVE-2024-43826 nfs: pass explicit offset/count to trace events
- CVE-2024-43825 iio: Fix the sorting functionality in iio_gts_build_avail_time_table
- CVE-2024-43824 PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
- CVE-2024-43823 PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
- CVE-2024-43822 ASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe()
- CVE-2024-43821 scsi: lpfc: Fix a possible null pointer dereference
- CVE-2024-43820 dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
- CVE-2024-4382 CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF
- CVE-2024-43819 kvm: s390: Reject memory region operations for ucontrol VMs
- CVE-2024-43818 ASoC: amd: Adjust error handling in case of absent codec device
- CVE-2024-43817 net: missing check virtio
- CVE-2024-43816 scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages
- CVE-2024-43815 crypto: mxs-dcp - Ensure payload is zero when using key slot
- CVE-2024-43814 goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data
- CVE-2024-43813 IDOR when marking read a user's channel
- CVE-2024-43812 Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials
- CVE-2024-43810 Cross-site scripting in TeamCity
- CVE-2024-4381 CB (legacy) <= 0.9.4.18 - Admin+ Stored XSS
- CVE-2024-43809 Cross-site scripting in TeamCity
- CVE-2024-43808 Cross-site scripting in TeamCity
- CVE-2024-43807 Cross-site scripting in TeamCity
- CVE-2024-43806 `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion
- CVE-2024-43805 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
- CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI
- CVE-2024-43803 BMO can expose particularly named secrets from other namespaces via BMH CRD
- CVE-2024-43802 heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697
- CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin
- CVE-2024-43800 serve-static affected by template injection that can lead to XSS
- CVE-2024-43799 send vulnerable to template injection that can lead to XSS
- CVE-2024-43798 Chisel AUTH environment variable not respected in server entrypoint
- CVE-2024-43797 Path Traversal in audiobookshelf
- CVE-2024-43796 express vulnerable to XSS via response.redirect()
- CVE-2024-43795 OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)
- CVE-2024-43794 OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect
- CVE-2024-43793 Halo's editor has a stored XSS vulnerability
- CVE-2024-43792 Halo's editor has a stored Cross-Site Scripting vulnerability
- CVE-2024-43791 RequestStore has Incorrect Default Permissions
- CVE-2024-43790 heap-buffer-overflow in do_search() in Vim < 9.1.0689
- CVE-2024-4379 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2024-43789 Denial of service by the absence of restrictions on replies to posts in Discourse
- CVE-2024-43788 DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
- CVE-2024-43787 Hono CSRF middleware can be bypassed using crafted Content-Type header
- CVE-2024-43785 gitoxide-core does not neutralize special characters for terminals
- CVE-2024-43784 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion
- CVE-2024-43783 Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies
- CVE-2024-43782 openedx-translations's Atlas translations for Open edX missing validation
- CVE-2024-43781 Information disclosure in SINUMERIK 828D V4
- CVE-2024-43780 Unauthorized channel file upload
- CVE-2024-4378 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2024-43779 Information disclosure in ClearML
- CVE-2024-43778 Command injection in AHD04T-A
- CVE-2024-43776 Huachu Easytest Online Learning Test Platform - SQL Injection
- CVE-2024-43775 Huachu Easytest Online Learning Test Platform - SQL Injection
- CVE-2024-43774 Huachu Easytest Online Learning Test Platform - SQL Injection
- CVE-2024-43773 Huachu Easytest Online Learning Test Platform - SQL Injection
- CVE-2024-43772 Huachu Easytest Online Learning Test Platform - SQL Injection
- CVE-2024-43771 Memory corruption in Android
- CVE-2024-43770 Memory corruption in Android
- CVE-2024-4377 DOP Shortcodes <= 1.2 - Contributor+ Stored XSS via Shortcode
- CVE-2024-43769 Business logic in Android
- CVE-2024-43768 Integer overflow in Android
- CVE-2024-43767 Memory corruption in Android
- CVE-2024-43766 Information disclosure in Android
- CVE-2024-43765 Security feature bypass in Android
- CVE-2024-43764 Security feature bypass in Android
- CVE-2024-43763 Denial of service in Android
- CVE-2024-43762 Business logic in Android
- CVE-2024-43760 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2024-4376 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2024-43759 Illustrator | NULL Pointer Dereference (CWE-476)
- CVE-2024-43758 Illustrator | Use After Free (CWE-416)
- CVE-2024-43756 Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)
- CVE-2024-43755 Adobe Experience Manager | Improper Input Validation (CWE-20)
- CVE-2024-43754 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2024-43752 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43751 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43750 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-4375 Cross-site scripting in Master Slider – Responsive Touch Slider
- CVE-2024-43749 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43748 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43747 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43746 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43745 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2024-43744 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43743 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43742 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43740 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-4374 DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- CVE-2024-43739 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2024-43738 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)