Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 293 of 521.
- CVE-2024-42185 HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks
- CVE-2024-42184 HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme
- CVE-2024-42183 HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability
- CVE-2024-42182 HCL BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability
- CVE-2024-42181 HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability
- CVE-2024-42180 HCL MyXalytics is affected by a malicious file upload vulnerability
- CVE-2024-4218 AffiEasy <= 1.1.6 - Cross-Site Request Forgery to Various Actions
- CVE-2024-42179 HCL MyXalytics is affected by sensitive information disclosure vulnerability
- CVE-2024-42178 HCL MyXalytics is affected by a failure to restrict URL access vulnerability
- CVE-2024-42177 HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities
- CVE-2024-42176 HCL MyXalytics is affected by concurrent login vulnerability
- CVE-2024-42175 HCL MyXalytics is affected by a weak input validation vulnerability
- CVE-2024-42174 HCL MyXalytics is affected by username enumeration vulnerability
- CVE-2024-42173 HCL MyXalytics is affected by an improper password policy implementation vulnerability
- CVE-2024-42172 HCL MyXalytics is affected by broken authentication
- CVE-2024-42171 HCL MyXalytics is affected by insufficient session expiration
- CVE-2024-42170 HCL MyXalytics is affected by a session fixation vulnerability
- CVE-2024-4217 Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS
- CVE-2024-42169 HCL MyXalytics is affected by insecure direct object references
- CVE-2024-42168 HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability
- CVE-2024-42167 Command Injection in Organisationname
- CVE-2024-42166 Command Injection in Applicationname
- CVE-2024-42165 Arbitrary User Activation
- CVE-2024-42164 Disabling MFA without Authentication
- CVE-2024-42163 Password Manipulation
- CVE-2024-42162 gve: Account for stopped queues when reading NIC stats
- CVE-2024-42161 bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
- CVE-2024-42160 f2fs: check validation of fault attrs in f2fs_build_fault_attr()
- CVE-2024-4216 XSS vulnerability in /settings/store API response json payload in pgAdmin 4
- CVE-2024-42159 scsi: mpi3mr: Sanitise num_phys
- CVE-2024-42158 s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
- CVE-2024-42157 s390/pkey: Wipe sensitive data on failure
- CVE-2024-42156 s390/pkey: Wipe copies of clear-key structures on failure
- CVE-2024-42155 s390/pkey: Wipe copies of protected- and secure-keys
- CVE-2024-42154 tcp_metrics: validate source addr length
- CVE-2024-42153 i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
- CVE-2024-42152 nvmet: fix a possible leak when destroy a ctrl during qp establishment
- CVE-2024-42151 bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
- CVE-2024-42150 net: txgbe: remove separate irq request for MSI and INTx
- CVE-2024-4215 The Multi Factor Authentication bypass vulnerability in pgAdmin 4
- CVE-2024-42149 fs: don't misleadingly warn during thaw operations
- CVE-2024-42148 bnx2x: Fix multiple UBSAN array-index-out-of-bounds
- CVE-2024-42147 crypto: hisilicon/debugfs - Fix debugfs uninit process issue
- CVE-2024-42146 drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
- CVE-2024-42145 IB/core: Implement a limit on UMAD receive List
- CVE-2024-42144 thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
- CVE-2024-42142 net/mlx5: E-switch, Create ingress ACL when needed
- CVE-2024-42141 Bluetooth: ISO: Check socket flag instead of hcon
- CVE-2024-42140 riscv: kexec: Avoid deadlock in kexec crash path
- CVE-2024-4214 WordPress cardealer plugin <= 4.15 - Content Injection vulnerability
- CVE-2024-42139 ice: Fix improper extts handling
- CVE-2024-42138 mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file
- CVE-2024-42137 Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
- CVE-2024-42136 cdrom: rearrange last_media_change check to avoid unintentional overflow
- CVE-2024-42135 vhost_task: Handle SIGKILL by flushing work and exiting
- CVE-2024-42134 virtio-pci: Check if is_avq is NULL
- CVE-2024-42133 Bluetooth: Ignore too large handle values in BIG
- CVE-2024-42132 bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
- CVE-2024-42131 mm: avoid overflows in dirty throttling logic
- CVE-2024-4213 Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure
- CVE-2024-42129 leds: mlxreg: Use devm_mutex_init() for mutex initialization
- CVE-2024-42128 leds: an30259a: Use devm_mutex_init() for mutex initialization
- CVE-2024-42127 drm/lima: fix shared irq handling on driver remove
- CVE-2024-42126 powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
- CVE-2024-42125 wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband
- CVE-2024-42124 scsi: qedf: Make qedf_execute_tmf() non-preemptible
- CVE-2024-42123 drm/amdgpu: fix double free err_addr pointer warnings
- CVE-2024-42122 drm/amd/display: Add NULL pointer check for kzalloc
- CVE-2024-42121 drm/amd/display: Check index msg_id before read or write
- CVE-2024-42120 drm/amd/display: Check pipe offset before setting vblank
- CVE-2024-4212 Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
- CVE-2024-42119 drm/amd/display: Skip finding free audio for unknown engine_id
- CVE-2024-42118 drm/amd/display: Do not return negative stream id for array
- CVE-2024-42117 drm/amd/display: ASSERT when failing to find index by plane/stream id
- CVE-2024-42115 jffs2: Fix potential illegal address access in jffs2_free_inode
- CVE-2024-42114 wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
- CVE-2024-42113 net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
- CVE-2024-42112 net: txgbe: free isb resources at the right time
- CVE-2024-42111 btrfs: always do the basic checks for btrfs_qgroup_inherit structure
- CVE-2024-42110 net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
- CVE-2024-4211 Multiple missing permission checks
- CVE-2024-42109 netfilter: nf_tables: unconditionally flush pending work before notifier
- CVE-2024-42108 net: rswitch: Avoid use-after-free in rswitch_poll()
- CVE-2024-42107 ice: Don't process extts if PTP is disabled
- CVE-2024-42106 inet_diag: Initialize pad field in struct inet_diag_req_v2
- CVE-2024-42105 nilfs2: fix inode number range checks
- CVE-2024-42104 nilfs2: add missing check for inode numbers on directory entries
- CVE-2024-42103 btrfs: fix adding block group to a reclaim list and the unused list during reclaim
- CVE-2024-42102 Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
- CVE-2024-42101 drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
- CVE-2024-42100 clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
- CVE-2024-4210 Uncontrolled Resource Consumption in GitLab
- CVE-2024-42099 s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
- CVE-2024-42098 crypto: ecdh - explicitly zeroize private_key
- CVE-2024-42097 ALSA: emux: improve patch ioctl data validation
- CVE-2024-42096 x86: stop playing stack games in profile_pc()
- CVE-2024-42095 serial: 8250_omap: Implementation of Errata i2310
- CVE-2024-42094 net/iucv: Avoid explicit cpumask var allocation on stack
- CVE-2024-42093 net/dpaa2: Avoid explicit cpumask var allocation on stack
- CVE-2024-42092 gpio: davinci: Validate the obtained number of IRQs