# Vulnerabilities published in 2024


- [CVE-2024-42289](https://insights.sbomify.com/CVE-2024-42289/): scsi: qla2xxx: During vport delete send async logout explicitly (medium 5.5)
- [CVE-2024-42288](https://insights.sbomify.com/CVE-2024-42288/): scsi: qla2xxx: Fix for possible memory corruption (high 7.8)
- [CVE-2024-42287](https://insights.sbomify.com/CVE-2024-42287/): scsi: qla2xxx: Complete command early within lock (high 8.8)
- [CVE-2024-42286](https://insights.sbomify.com/CVE-2024-42286/): scsi: qla2xxx: validate nvme_local_port correctly (high 7.5)
- [CVE-2024-42285](https://insights.sbomify.com/CVE-2024-42285/): RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (critical 9.8)
- [CVE-2024-42284](https://insights.sbomify.com/CVE-2024-42284/): tipc: Return non-zero value from tipc_udp_addr2str() on error (critical 9.1)
- [CVE-2024-42283](https://insights.sbomify.com/CVE-2024-42283/): net: nexthop: Initialize all fields in dumped nexthops (medium 5.5)
- [CVE-2024-42282](https://insights.sbomify.com/CVE-2024-42282/): net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling (medium 5.5)
- [CVE-2024-42281](https://insights.sbomify.com/CVE-2024-42281/): bpf: Fix a segment issue when downgrading gso_size (medium 5.5)
- [CVE-2024-42280](https://insights.sbomify.com/CVE-2024-42280/): mISDN: Fix a use after free in hfcmulti_tx() (high 7.8)
- [CVE-2024-4228](https://insights.sbomify.com/CVE-2024-4228/): SQLi in Magarsus Consultancy's SSO (critical 9.8)
- [CVE-2024-42279](https://insights.sbomify.com/CVE-2024-42279/): spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer (high 7.8)
- [CVE-2024-42278](https://insights.sbomify.com/CVE-2024-42278/): ASoC: TAS2781: Fix tasdev_load_calibrated_data() (medium 5.5)
- [CVE-2024-42277](https://insights.sbomify.com/CVE-2024-42277/): iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en (medium 5.5)
- [CVE-2024-42276](https://insights.sbomify.com/CVE-2024-42276/): nvme-pci: add missing condition check for existence of mapped data (high 7.8)
- [CVE-2024-42275](https://insights.sbomify.com/CVE-2024-42275/): drm/client: Fix error code in drm_client_buffer_vmap_local() (high 7.8)
- [CVE-2024-42274](https://insights.sbomify.com/CVE-2024-42274/): Revert "ALSA: firewire-lib: operate for period elapse event in process context" (medium 5.5)
- [CVE-2024-42273](https://insights.sbomify.com/CVE-2024-42273/): f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid (high 7.8)
- [CVE-2024-42272](https://insights.sbomify.com/CVE-2024-42272/): sched: act_ct: take care of padding in struct zones_ht_key (high 7.8)
- [CVE-2024-42271](https://insights.sbomify.com/CVE-2024-42271/): net/iucv: fix use after free in iucv_sock_close() (high 7.8)
- [CVE-2024-42270](https://insights.sbomify.com/CVE-2024-42270/): netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). (medium 5.5)
- [CVE-2024-4227](https://insights.sbomify.com/CVE-2024-4227/): gSOAP: Vulnerable to specially crafted unencrypted SDC messages (high 7.5)
- [CVE-2024-42269](https://insights.sbomify.com/CVE-2024-42269/): netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). (medium 5.5)
- [CVE-2024-42268](https://insights.sbomify.com/CVE-2024-42268/): net/mlx5: Fix missing lock on sync reset reload (medium 5.5)
- [CVE-2024-42267](https://insights.sbomify.com/CVE-2024-42267/): riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() (medium 5.5)
- [CVE-2024-42266](https://insights.sbomify.com/CVE-2024-42266/): btrfs: make cow_file_range_inline() honor locked_page on error (high 7.8)
- [CVE-2024-42265](https://insights.sbomify.com/CVE-2024-42265/): protect the fetch of ->fd[fd] in do_dup2() from mispredictions (medium 5.5)
- [CVE-2024-42264](https://insights.sbomify.com/CVE-2024-42264/): drm/v3d: Prevent out of bounds access in performance query extensions (high 7.8)
- [CVE-2024-42263](https://insights.sbomify.com/CVE-2024-42263/): drm/v3d: Fix potential memory leak in the timestamp extension (medium 5.5)
- [CVE-2024-42262](https://insights.sbomify.com/CVE-2024-42262/): drm/v3d: Fix potential memory leak in the performance extension (medium 5.5)
- [CVE-2024-42261](https://insights.sbomify.com/CVE-2024-42261/): drm/v3d: Validate passed in drm syncobj handles in the timestamp extension (medium 5.5)
- [CVE-2024-42260](https://insights.sbomify.com/CVE-2024-42260/): drm/v3d: Validate passed in drm syncobj handles in the performance extension (medium 5.5)
- [CVE-2024-4226](https://insights.sbomify.com/CVE-2024-4226/): Missing authorization in Octopus Server (low 3.5)
- [CVE-2024-42259](https://insights.sbomify.com/CVE-2024-42259/): drm/i915/gem: Fix Virtual Memory mapping boundaries calculation (high 7.8)
- [CVE-2024-42258](https://insights.sbomify.com/CVE-2024-42258/): mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines (high 7.1)
- [CVE-2024-42257](https://insights.sbomify.com/CVE-2024-42257/): ext4: use memtostr_pad() for s_volume_name (high 7.8)
- [CVE-2024-42256](https://insights.sbomify.com/CVE-2024-42256/): cifs: Fix server re-repick on subrequest retry (high 7.5)
- [CVE-2024-42255](https://insights.sbomify.com/CVE-2024-42255/): tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() (medium 5.5)
- [CVE-2024-42254](https://insights.sbomify.com/CVE-2024-42254/): io_uring: fix error pbuf checking (medium 5.5)
- [CVE-2024-42253](https://insights.sbomify.com/CVE-2024-42253/): gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (high 7.8)
- [CVE-2024-42252](https://insights.sbomify.com/CVE-2024-42252/): closures: Change BUG_ON() to WARN_ON() (medium 5.5)
- [CVE-2024-42251](https://insights.sbomify.com/CVE-2024-42251/): mm: page_ref: remove folio_try_get_rcu() (medium 5.5)
- [CVE-2024-42250](https://insights.sbomify.com/CVE-2024-42250/): cachefiles: add missing lock protection when polling (high 7.8)
- [CVE-2024-4225](https://insights.sbomify.com/CVE-2024-4225/): NGDIN_ST v2.0D.0062 - Multiple Vulnerabilities (high 7.6)
- [CVE-2024-42249](https://insights.sbomify.com/CVE-2024-42249/): spi: don't unoptimize message in spi_async() (high 7.8)
- [CVE-2024-42248](https://insights.sbomify.com/CVE-2024-42248/): tty: serial: ma35d1: Add a NULL check for of_node (medium 5.5)
- [CVE-2024-42247](https://insights.sbomify.com/CVE-2024-42247/): wireguard: allowedips: avoid unaligned 64-bit memory accesses (high 7.5)
- [CVE-2024-42246](https://insights.sbomify.com/CVE-2024-42246/): net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (medium 5.5)
- [CVE-2024-42245](https://insights.sbomify.com/CVE-2024-42245/): Revert "sched/fair: Make sure to try to detach at least one movable task" (medium 5.5)
- [CVE-2024-42244](https://insights.sbomify.com/CVE-2024-42244/): USB: serial: mos7840: fix crash on resume (medium 5.5)
- [CVE-2024-42243](https://insights.sbomify.com/CVE-2024-42243/): mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray (medium 5.5)
- [CVE-2024-42242](https://insights.sbomify.com/CVE-2024-42242/): mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE (medium 5.5)
- [CVE-2024-42241](https://insights.sbomify.com/CVE-2024-42241/): mm/shmem: disable PMD-sized page cache if needed (medium 5.5)
- [CVE-2024-42240](https://insights.sbomify.com/CVE-2024-42240/): x86/bhi: Avoid warning in #DB handler due to BHI mitigation (medium 5.5)
- [CVE-2024-4224](https://insights.sbomify.com/CVE-2024-4224/): TP-Link TL-SG1016DE XSS (medium 5.4)
- [CVE-2024-42239](https://insights.sbomify.com/CVE-2024-42239/): bpf: Fail bpf_timer_cancel when callback is being cancelled (medium 5.5)
- [CVE-2024-42238](https://insights.sbomify.com/CVE-2024-42238/): firmware: cs_dsp: Return error if block header overflows file (medium 5.5)
- [CVE-2024-42237](https://insights.sbomify.com/CVE-2024-42237/): firmware: cs_dsp: Validate payload length before processing block (medium 5.5)
- [CVE-2024-42236](https://insights.sbomify.com/CVE-2024-42236/): usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() (high 7.8)
- [CVE-2024-42235](https://insights.sbomify.com/CVE-2024-42235/): s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() (high 7.8)
- [CVE-2024-42234](https://insights.sbomify.com/CVE-2024-42234/): mm: fix crashes from deferred split racing folio migration (high 7.8)
- [CVE-2024-42233](https://insights.sbomify.com/CVE-2024-42233/): filemap: replace pte_offset_map() with pte_offset_map_nolock() (high 7.8)
- [CVE-2024-42232](https://insights.sbomify.com/CVE-2024-42232/): libceph: fix race between delayed_work() and ceph_monc_stop() (critical 9.8)
- [CVE-2024-42231](https://insights.sbomify.com/CVE-2024-42231/): btrfs: zoned: fix calc_available_free_space() for zoned mode (medium 5.5)
- [CVE-2024-42230](https://insights.sbomify.com/CVE-2024-42230/): powerpc/pseries: Fix scv instruction crash with kexec (medium 4.4)
- [CVE-2024-4223](https://insights.sbomify.com/CVE-2024-4223/): Tutor LMS <= 2.7.0 - Missing Authorization (critical 9.8)
- [CVE-2024-42229](https://insights.sbomify.com/CVE-2024-42229/): crypto: aead,cipher - zeroize key buffer after use (medium 4.1)
- [CVE-2024-42228](https://insights.sbomify.com/CVE-2024-42228/): drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (high 7.0)
- [CVE-2024-42227](https://insights.sbomify.com/CVE-2024-42227/): drm/amd/display: Fix overlapping copy within dml_core_mode_programming (medium 4.7)
- [CVE-2024-42225](https://insights.sbomify.com/CVE-2024-42225/): wifi: mt76: replace skb_put with skb_put_zero (high 8.3)
- [CVE-2024-42224](https://insights.sbomify.com/CVE-2024-42224/): net: dsa: mv88e6xxx: Correct check for empty list (high 7.0)
- [CVE-2024-42223](https://insights.sbomify.com/CVE-2024-42223/): media: dvb-frontends: tda10048: Fix integer overflow (medium 5.5)
- [CVE-2024-42222](https://insights.sbomify.com/CVE-2024-42222/): Apache CloudStack: Unauthorised Network List Access (medium 4.3)
- [CVE-2024-42220](https://insights.sbomify.com/CVE-2024-42220/): Security feature bypass in Outlook (high 7.1)
- [CVE-2024-4222](https://insights.sbomify.com/CVE-2024-4222/): Tutor LMS Pro <= 2.7.0 - Missing Authorization (high 7.3)
- [CVE-2024-42219](https://insights.sbomify.com/CVE-2024-42219/): Security feature bypass in 1password:1password (high 7.0)
- [CVE-2024-42218](https://insights.sbomify.com/CVE-2024-42218/): Security feature bypass in 1password:1password (medium 6.3)
- [CVE-2024-42214](https://insights.sbomify.com/CVE-2024-42214/): Information disclosure in Aftermarket EPC (medium 5.3)
- [CVE-2024-42213](https://insights.sbomify.com/CVE-2024-42213/): HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment (medium 5.3)
- [CVE-2024-42212](https://insights.sbomify.com/CVE-2024-42212/): HCL BigFix Compliance is affected by an improper or missing SameSite attribute (medium 5.4)
- [CVE-2024-42210](https://insights.sbomify.com/CVE-2024-42210/): HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability (high 7.6)
- [CVE-2024-42209](https://insights.sbomify.com/CVE-2024-42209/): HCL Connections is vulnerable to an information disclosure vulnerability (low 3.5)
- [CVE-2024-42208](https://insights.sbomify.com/CVE-2024-42208/): HCL Connections is vulnerable to an information disclosure vulnerability (low 3.5)
- [CVE-2024-42207](https://insights.sbomify.com/CVE-2024-42207/): HCL iAutomate is affected by a session fixation vulnerability (medium 5.5)
- [CVE-2024-42206](https://insights.sbomify.com/CVE-2024-42206/): HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application. (low 3.1)
- [CVE-2024-42200](https://insights.sbomify.com/CVE-2024-42200/): HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attack (medium 4.8)
- [CVE-2024-4220](https://insights.sbomify.com/CVE-2024-4220/): Information Disclosure in BeyondInsight (medium 4.3)
- [CVE-2024-42197](https://insights.sbomify.com/CVE-2024-42197/): HCL Workload Scheduler is vulnerable to plain text storage of a password (medium 5.5)
- [CVE-2024-42196](https://insights.sbomify.com/CVE-2024-42196/): HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability (medium 6.2)
- [CVE-2024-42195](https://insights.sbomify.com/CVE-2024-42195/): HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection (low 3.1)
- [CVE-2024-42194](https://insights.sbomify.com/CVE-2024-42194/): HCL BigFix Inventory is affected by an access control vulnerability (low 3.1)
- [CVE-2024-42193](https://insights.sbomify.com/CVE-2024-42193/): HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attack (low 2.1)
- [CVE-2024-42192](https://insights.sbomify.com/CVE-2024-42192/): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage (medium 5.5)
- [CVE-2024-42191](https://insights.sbomify.com/CVE-2024-42191/): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to COM hijacking (medium 6.5)
- [CVE-2024-42190](https://insights.sbomify.com/CVE-2024-42190/): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking (medium 6.5)
- [CVE-2024-4219](https://insights.sbomify.com/CVE-2024-4219/): SSRF In BeyondInsight (medium 4.8)
- [CVE-2024-42189](https://insights.sbomify.com/CVE-2024-42189/): HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack (medium 5.6)
- [CVE-2024-42188](https://insights.sbomify.com/CVE-2024-42188/): HCL Connections is vulnerable to a broken access control vulnerability (low 3.7)
- [CVE-2024-42187](https://insights.sbomify.com/CVE-2024-42187/): HCL BigFix Patch Download Plug-ins are affected by path traversal vulnerability (medium 5.3)
- [CVE-2024-42186](https://insights.sbomify.com/CVE-2024-42186/): HCL BigFix Patch Download Plug-ins are affected by an insecure protocol support (low 2.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/292/