Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 291 of 521.
- CVE-2024-42385 Improper Neutralization of Delimiters in Mongoose Web Server library
- CVE-2024-42384 Integer Overflow or Wraparound in Mongoose Web Server library
- CVE-2024-42383 Use of Out-of-range Pointer Offset in Mongoose Web Server library
- CVE-2024-42381 os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve
- CVE-2024-42380 Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-4238 Tenda AX1806 SetOnlineDevName formSetDeviceName stack-based overflow
- CVE-2024-42378 Cross-Site Scripting (XSS) in eProcurement on S/4HANA
- CVE-2024-42377 Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework
- CVE-2024-42376 Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework
- CVE-2024-42375 Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform
- CVE-2024-42374 XML injection in SAP BEx Web Java Runtime Export Web Service
- CVE-2024-42373 Missing Authorization Check in SAP Student Life Cycle Management (SLcM)
- CVE-2024-42372 Missing Authorization check in SAP NetWeaver AS Java (System Landscape Directory)
- CVE-2024-42371 Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-42370 Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow
- CVE-2024-4237 Tenda AX1806 execCommand R7WebsSecurityHandler stack-based overflow
- CVE-2024-42369 A room with itself as a its predecessor will freeze matrix-js-sdk
- CVE-2024-42368 open-telemetry has an Observable Timing Discrepancy
- CVE-2024-42367 In aiohttp, compressed files as symlinks are not protected from path traversal
- CVE-2024-42366 VR Overlay RCE
- CVE-2024-42365 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan
- CVE-2024-42364 homepage DNS rebinding vulnerability (GHSL-2024-096)
- CVE-2024-42363 GHSL-2023-136_Samson
- CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
- CVE-2024-42361 GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}
- CVE-2024-42360 Command Injection in sequenceserver
- CVE-2024-4236 Tenda AX1803 SetDDNSCfg formSetSysToolDDNS stack-based overflow
- CVE-2024-42358 Loop with Unreachable Exit Condition ('Infinite Loop') in pdfio
- CVE-2024-42357 Shopware vulnerable to blind SQL-injection in DAL aggregations
- CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions
- CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
- CVE-2024-42354 Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
- CVE-2024-42353 WebOb's location header normalization during redirect leads to open redirect
- CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
- CVE-2024-42351 Possible Data Tampering & Loss of Public Datasets in Galaxy
- CVE-2024-42350 Public key confusion in third party block in Biscuit
- CVE-2024-4235 Netgear DG834Gv5 Web Management Interface cleartext storage
- CVE-2024-42349 FOG has a Log Information Disclosure
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-42347 URL preview setting for a room is controllable by the homeserver in matrix-react-sdk
- CVE-2024-42346 Stored Cross Site Scripting (Stored XSS) in Galaxy
- CVE-2024-42345 Auth bypass in SINEMA Remote Connect Server
- CVE-2024-42344 Information disclosure in SINEMA Remote Connect Client
- CVE-2024-42343 Loway - CWE-204: Observable Response Discrepancy
- CVE-2024-42342 Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CVE-2024-42341 Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- CVE-2024-42340 CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security
- CVE-2024-4234 WordPress Filterable Portfolio plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-42339 CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-42338 CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-42337 CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-42336 Servision - CWE-287: Improper Authentication
- CVE-2024-42335 7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2024-42333 Heap buffer over-read
- CVE-2024-42332 New line injection in Zabbix SNMP traps
- CVE-2024-42331 Use after free in browser_push_error
- CVE-2024-42330 JS - Internal strings in HTTP headers
- CVE-2024-4233 Broken Access Control vulnerability in multiple WordPress plugins by Tyche Softwares
- CVE-2024-42329 JS - Crash on unexpected HTTP server response
- CVE-2024-42328 JS - Crash on empty HTTP server response
- CVE-2024-42327 SQL injection in user.get API
- CVE-2024-42326 Use after free vulnerability in browser.c
- CVE-2024-42325 Excessive information returned by user.get
- CVE-2024-42323 Apache HertzBeat: RCE by snakeYaml deser load malicious xml
- CVE-2024-42322 ipvs: properly dereference pe in ip_vs_add_service
- CVE-2024-42321 net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
- CVE-2024-42320 s390/dasd: fix error checks in dasd_copy_pair_store()
- CVE-2024-4232 Password Storage in Plaintext Vulnerability in Digisol Router
- CVE-2024-42319 mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()
- CVE-2024-42318 landlock: Don't lose track of restrictions on cred_transfer
- CVE-2024-42317 mm/huge_memory: avoid PMD-size page cache if needed
- CVE-2024-42316 mm/mglru: fix div-by-zero in vmpressure_calc_level()
- CVE-2024-42315 exfat: fix potential deadlock on __exfat_get_dentry_set
- CVE-2024-42314 btrfs: fix extent map use-after-free when adding pages to compressed bio
- CVE-2024-42313 media: venus: fix use after free in vdec_close
- CVE-2024-42312 sysctl: always initialize i_uid/i_gid
- CVE-2024-42311 hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
- CVE-2024-42310 drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
- CVE-2024-4231 Incorrect Access Control Vulnerability in Digisol Router
- CVE-2024-42309 drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
- CVE-2024-42307 cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path
- CVE-2024-42306 udf: Avoid using corrupted block bitmap buffer
- CVE-2024-42305 ext4: check dot and dotdot of dx_root before making dir indexed
- CVE-2024-42304 ext4: make sure the first directory block is not a hole
- CVE-2024-42303 media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
- CVE-2024-42302 PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
- CVE-2024-42301 dev/parport: fix the array out-of-bounds risk
- CVE-2024-42300 erofs: fix race in z_erofs_get_gbuf()
- CVE-2024-4230 Path traversal in Edgecross Basic Software for Developers
- CVE-2024-42299 fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
- CVE-2024-42298 ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
- CVE-2024-42297 f2fs: fix to don't dirty inode for readonly filesystem
- CVE-2024-42296 f2fs: fix return value of f2fs_convert_inline_inode()
- CVE-2024-42295 nilfs2: handle inconsistent state in nilfs_btnode_create_block()
- CVE-2024-42294 block: fix deadlock between sd_remove & sd_release
- CVE-2024-42293 arm64: mm: Fix lockless walks with static and dynamic page-table folding
- CVE-2024-42292 kobject_uevent: Fix OOB access within zap_modalias_env()
- CVE-2024-42291 ice: Add a per-VF limit on number of FDIR filters
- CVE-2024-42290 irqchip/imx-irqsteer: Handle runtime power management correctly
- CVE-2024-4229 Misconfiguration in Edgecross Basic Software for Developers