# Vulnerabilities published in 2024


- [CVE-2024-43835](https://insights.sbomify.com/CVE-2024-43835/): virtio_net: Fix napi_skb_cache_put warning (medium 5.5)
- [CVE-2024-43834](https://insights.sbomify.com/CVE-2024-43834/): xdp: fix invalid wait context of page_pool_destroy() (medium 5.5)
- [CVE-2024-43833](https://insights.sbomify.com/CVE-2024-43833/): media: v4l: async: Fix NULL pointer dereference in adding ancillary links (medium 5.5)
- [CVE-2024-43832](https://insights.sbomify.com/CVE-2024-43832/): s390/uv: Don't call folio_wait_writeback() without a folio reference (high 7.8)
- [CVE-2024-43831](https://insights.sbomify.com/CVE-2024-43831/): media: mediatek: vcodec: Handle invalid decoder vsi (medium 5.5)
- [CVE-2024-43830](https://insights.sbomify.com/CVE-2024-43830/): leds: trigger: Unregister sysfs attributes before calling deactivate() (high 7.8)
- [CVE-2024-4383](https://insights.sbomify.com/CVE-2024-4383/): Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-43829](https://insights.sbomify.com/CVE-2024-43829/): drm/qxl: Add check for drm_cvt_mode (medium 5.5)
- [CVE-2024-43828](https://insights.sbomify.com/CVE-2024-43828/): ext4: fix infinite loop when replaying fast_commit (medium 5.5)
- [CVE-2024-43827](https://insights.sbomify.com/CVE-2024-43827/): drm/amd/display: Add null check before access structs (medium 5.5)
- [CVE-2024-43826](https://insights.sbomify.com/CVE-2024-43826/): nfs: pass explicit offset/count to trace events (medium 5.5)
- [CVE-2024-43825](https://insights.sbomify.com/CVE-2024-43825/): iio: Fix the sorting functionality in iio_gts_build_avail_time_table (high 7.8)
- [CVE-2024-43824](https://insights.sbomify.com/CVE-2024-43824/): PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() (medium 5.5)
- [CVE-2024-43823](https://insights.sbomify.com/CVE-2024-43823/): PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() (medium 5.5)
- [CVE-2024-43822](https://insights.sbomify.com/CVE-2024-43822/): ASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe() (medium 5.5)
- [CVE-2024-43821](https://insights.sbomify.com/CVE-2024-43821/): scsi: lpfc: Fix a possible null pointer dereference (medium 5.5)
- [CVE-2024-43820](https://insights.sbomify.com/CVE-2024-43820/): dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume (medium 5.5)
- [CVE-2024-4382](https://insights.sbomify.com/CVE-2024-4382/): CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF (medium 4.3)
- [CVE-2024-43819](https://insights.sbomify.com/CVE-2024-43819/): kvm: s390: Reject memory region operations for ucontrol VMs (medium 5.5)
- [CVE-2024-43818](https://insights.sbomify.com/CVE-2024-43818/): ASoC: amd: Adjust error handling in case of absent codec device (medium 5.5)
- [CVE-2024-43817](https://insights.sbomify.com/CVE-2024-43817/): net: missing check virtio (medium 5.5)
- [CVE-2024-43816](https://insights.sbomify.com/CVE-2024-43816/): scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (high 7.8)
- [CVE-2024-43815](https://insights.sbomify.com/CVE-2024-43815/): crypto: mxs-dcp - Ensure payload is zero when using key slot (high 7.1)
- [CVE-2024-43814](https://insights.sbomify.com/CVE-2024-43814/): goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data (medium 5.3)
- [CVE-2024-43813](https://insights.sbomify.com/CVE-2024-43813/): IDOR when marking read a user's channel (medium 4.3)
- [CVE-2024-43812](https://insights.sbomify.com/CVE-2024-43812/): Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials (high 8.6)
- [CVE-2024-43810](https://insights.sbomify.com/CVE-2024-43810/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-4381](https://insights.sbomify.com/CVE-2024-4381/): CB (legacy) <= 0.9.4.18 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-43809](https://insights.sbomify.com/CVE-2024-43809/): Cross-site scripting in TeamCity (low 3.5)
- [CVE-2024-43808](https://insights.sbomify.com/CVE-2024-43808/): Cross-site scripting in TeamCity (low 3.7)
- [CVE-2024-43807](https://insights.sbomify.com/CVE-2024-43807/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-43806](https://insights.sbomify.com/CVE-2024-43806/): `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion (medium 6.5)
- [CVE-2024-43805](https://insights.sbomify.com/CVE-2024-43805/): HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering (high 7.6)
- [CVE-2024-43804](https://insights.sbomify.com/CVE-2024-43804/): OS Command Injection via Port Scan Functionality in Roxy-WI (high 8.8)
- [CVE-2024-43803](https://insights.sbomify.com/CVE-2024-43803/): BMO can expose particularly named secrets from other namespaces via BMH CRD (medium 4.9)
- [CVE-2024-43802](https://insights.sbomify.com/CVE-2024-43802/): heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697 (medium 4.5)
- [CVE-2024-43801](https://insights.sbomify.com/CVE-2024-43801/): Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin (medium 4.6)
- [CVE-2024-43800](https://insights.sbomify.com/CVE-2024-43800/): serve-static affected by template injection that can lead to XSS (medium 5.0)
- [CVE-2024-43799](https://insights.sbomify.com/CVE-2024-43799/): send vulnerable to template injection that can lead to XSS (medium 5.0)
- [CVE-2024-43798](https://insights.sbomify.com/CVE-2024-43798/): Chisel AUTH environment variable not respected in server entrypoint (high 8.6)
- [CVE-2024-43797](https://insights.sbomify.com/CVE-2024-43797/): Path Traversal in audiobookshelf (medium 6.3)
- [CVE-2024-43796](https://insights.sbomify.com/CVE-2024-43796/): express vulnerable to XSS via response.redirect() (medium 5.0)
- [CVE-2024-43795](https://insights.sbomify.com/CVE-2024-43795/): OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`) (medium 5.1)
- [CVE-2024-43794](https://insights.sbomify.com/CVE-2024-43794/): OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect (medium 6.1)
- [CVE-2024-43793](https://insights.sbomify.com/CVE-2024-43793/): Halo's editor has a stored XSS vulnerability (medium 6.3)
- [CVE-2024-43792](https://insights.sbomify.com/CVE-2024-43792/): Halo's editor has a stored Cross-Site Scripting vulnerability (medium 6.3)
- [CVE-2024-43791](https://insights.sbomify.com/CVE-2024-43791/): RequestStore has Incorrect Default Permissions (high 7.8)
- [CVE-2024-43790](https://insights.sbomify.com/CVE-2024-43790/): heap-buffer-overflow in do_search() in Vim < 9.1.0689 (medium 4.5)
- [CVE-2024-4379](https://insights.sbomify.com/CVE-2024-4379/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 5.4)
- [CVE-2024-43789](https://insights.sbomify.com/CVE-2024-43789/): Denial of service by the absence of restrictions on replies to posts in Discourse (high 7.5)
- [CVE-2024-43788](https://insights.sbomify.com/CVE-2024-43788/): DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) (medium 6.4)
- [CVE-2024-43787](https://insights.sbomify.com/CVE-2024-43787/): Hono CSRF middleware can be bypassed using crafted Content-Type header (medium 5.0)
- [CVE-2024-43785](https://insights.sbomify.com/CVE-2024-43785/): gitoxide-core does not neutralize special characters for terminals (low 2.5)
- [CVE-2024-43784](https://insights.sbomify.com/CVE-2024-43784/): Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion (medium 5.7)
- [CVE-2024-43783](https://insights.sbomify.com/CVE-2024-43783/): Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies (high 7.5)
- [CVE-2024-43782](https://insights.sbomify.com/CVE-2024-43782/): openedx-translations's Atlas translations for Open edX missing validation (high 7.7)
- [CVE-2024-43781](https://insights.sbomify.com/CVE-2024-43781/): Information disclosure in SINUMERIK 828D V4 (medium 6.8)
- [CVE-2024-43780](https://insights.sbomify.com/CVE-2024-43780/): Unauthorized channel file upload (medium 4.3)
- [CVE-2024-4378](https://insights.sbomify.com/CVE-2024-4378/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-43779](https://insights.sbomify.com/CVE-2024-43779/): Information disclosure in ClearML (high 7.7)
- [CVE-2024-43778](https://insights.sbomify.com/CVE-2024-43778/): Command injection in AHD04T-A (high 8.8)
- [CVE-2024-43776](https://insights.sbomify.com/CVE-2024-43776/): Huachu Easytest Online Learning Test Platform - SQL Injection (high 8.7)
- [CVE-2024-43775](https://insights.sbomify.com/CVE-2024-43775/): Huachu Easytest Online Learning Test Platform - SQL Injection (high 8.7)
- [CVE-2024-43774](https://insights.sbomify.com/CVE-2024-43774/): Huachu Easytest Online Learning Test Platform - SQL Injection (high 8.7)
- [CVE-2024-43773](https://insights.sbomify.com/CVE-2024-43773/): Huachu Easytest Online Learning Test Platform - SQL Injection (critical 9.3)
- [CVE-2024-43772](https://insights.sbomify.com/CVE-2024-43772/): Huachu Easytest Online Learning Test Platform - SQL Injection (critical 9.3)
- [CVE-2024-43771](https://insights.sbomify.com/CVE-2024-43771/): Memory corruption in Android (high 8.8)
- [CVE-2024-43770](https://insights.sbomify.com/CVE-2024-43770/): Memory corruption in Android (high 8.8)
- [CVE-2024-4377](https://insights.sbomify.com/CVE-2024-4377/): DOP Shortcodes <= 1.2 - Contributor+ Stored XSS via Shortcode (medium 6.1)
- [CVE-2024-43769](https://insights.sbomify.com/CVE-2024-43769/): Business logic in Android (high 7.8)
- [CVE-2024-43768](https://insights.sbomify.com/CVE-2024-43768/): Integer overflow in Android (high 7.8)
- [CVE-2024-43767](https://insights.sbomify.com/CVE-2024-43767/): Memory corruption in Android (high 8.8)
- [CVE-2024-43766](https://insights.sbomify.com/CVE-2024-43766/): Information disclosure in Android (medium 6.5)
- [CVE-2024-43765](https://insights.sbomify.com/CVE-2024-43765/): Security feature bypass in Android (high 7.8)
- [CVE-2024-43764](https://insights.sbomify.com/CVE-2024-43764/): Security feature bypass in Android (high 7.8)
- [CVE-2024-43763](https://insights.sbomify.com/CVE-2024-43763/): Denial of service in Android (medium 6.5)
- [CVE-2024-43762](https://insights.sbomify.com/CVE-2024-43762/): Business logic in Android (high 7.8)
- [CVE-2024-43760](https://insights.sbomify.com/CVE-2024-43760/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-4376](https://insights.sbomify.com/CVE-2024-4376/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-43759](https://insights.sbomify.com/CVE-2024-43759/): Illustrator | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-43758](https://insights.sbomify.com/CVE-2024-43758/): Illustrator | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-43756](https://insights.sbomify.com/CVE-2024-43756/): Photoshop Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-43755](https://insights.sbomify.com/CVE-2024-43755/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2024-43754](https://insights.sbomify.com/CVE-2024-43754/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43752](https://insights.sbomify.com/CVE-2024-43752/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43751](https://insights.sbomify.com/CVE-2024-43751/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43750](https://insights.sbomify.com/CVE-2024-43750/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-4375](https://insights.sbomify.com/CVE-2024-4375/): Cross-site scripting in Master Slider – Responsive Touch Slider (medium 6.4)
- [CVE-2024-43749](https://insights.sbomify.com/CVE-2024-43749/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43748](https://insights.sbomify.com/CVE-2024-43748/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43747](https://insights.sbomify.com/CVE-2024-43747/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43746](https://insights.sbomify.com/CVE-2024-43746/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43745](https://insights.sbomify.com/CVE-2024-43745/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43744](https://insights.sbomify.com/CVE-2024-43744/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43743](https://insights.sbomify.com/CVE-2024-43743/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43742](https://insights.sbomify.com/CVE-2024-43742/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43740](https://insights.sbomify.com/CVE-2024-43740/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-4374](https://insights.sbomify.com/CVE-2024-4374/): DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-43739](https://insights.sbomify.com/CVE-2024-43739/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43738](https://insights.sbomify.com/CVE-2024-43738/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/279/