# Vulnerabilities published in 2024


- [CVE-2024-42185](https://insights.sbomify.com/CVE-2024-42185/): HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks (low 2.5)
- [CVE-2024-42184](https://insights.sbomify.com/CVE-2024-42184/): HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme (low 2.5)
- [CVE-2024-42183](https://insights.sbomify.com/CVE-2024-42183/): HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability (low 2.5)
- [CVE-2024-42182](https://insights.sbomify.com/CVE-2024-42182/): HCL BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability (low 2.5)
- [CVE-2024-42181](https://insights.sbomify.com/CVE-2024-42181/): HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability (low 1.6)
- [CVE-2024-42180](https://insights.sbomify.com/CVE-2024-42180/): HCL MyXalytics is affected by a malicious file upload vulnerability (low 1.6)
- [CVE-2024-4218](https://insights.sbomify.com/CVE-2024-4218/): AffiEasy <= 1.1.6 - Cross-Site Request Forgery to Various Actions (medium 6.5)
- [CVE-2024-42179](https://insights.sbomify.com/CVE-2024-42179/): HCL MyXalytics is affected by sensitive information disclosure vulnerability (low 2.0)
- [CVE-2024-42178](https://insights.sbomify.com/CVE-2024-42178/): HCL MyXalytics is affected by a failure to restrict URL access vulnerability (low 2.5)
- [CVE-2024-42177](https://insights.sbomify.com/CVE-2024-42177/): HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities (low 2.6)
- [CVE-2024-42176](https://insights.sbomify.com/CVE-2024-42176/): HCL MyXalytics is affected by concurrent login vulnerability (low 2.6)
- [CVE-2024-42175](https://insights.sbomify.com/CVE-2024-42175/): HCL MyXalytics is affected by a weak input validation vulnerability (low 2.6)
- [CVE-2024-42174](https://insights.sbomify.com/CVE-2024-42174/): HCL MyXalytics is affected by username enumeration vulnerability (low 3.7)
- [CVE-2024-42173](https://insights.sbomify.com/CVE-2024-42173/): HCL MyXalytics is affected by an improper password policy implementation vulnerability (medium 4.8)
- [CVE-2024-42172](https://insights.sbomify.com/CVE-2024-42172/): HCL MyXalytics is affected by broken authentication (medium 5.3)
- [CVE-2024-42171](https://insights.sbomify.com/CVE-2024-42171/): HCL MyXalytics is affected by insufficient session expiration (medium 6.4)
- [CVE-2024-42170](https://insights.sbomify.com/CVE-2024-42170/): HCL MyXalytics is affected by a session fixation vulnerability (medium 6.8)
- [CVE-2024-4217](https://insights.sbomify.com/CVE-2024-4217/): Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS (medium 4.7)
- [CVE-2024-42169](https://insights.sbomify.com/CVE-2024-42169/): HCL MyXalytics is affected by insecure direct object references (high 7.1)
- [CVE-2024-42168](https://insights.sbomify.com/CVE-2024-42168/): HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability (high 8.9)
- [CVE-2024-42167](https://insights.sbomify.com/CVE-2024-42167/): Command Injection in Organisationname (critical 9.1)
- [CVE-2024-42166](https://insights.sbomify.com/CVE-2024-42166/): Command Injection in Applicationname (critical 9.1)
- [CVE-2024-42165](https://insights.sbomify.com/CVE-2024-42165/): Arbitrary User Activation (medium 6.3)
- [CVE-2024-42164](https://insights.sbomify.com/CVE-2024-42164/): Disabling MFA without Authentication (medium 4.3)
- [CVE-2024-42163](https://insights.sbomify.com/CVE-2024-42163/): Password Manipulation (high 8.3)
- [CVE-2024-42162](https://insights.sbomify.com/CVE-2024-42162/): gve: Account for stopped queues when reading NIC stats (high 7.8)
- [CVE-2024-42161](https://insights.sbomify.com/CVE-2024-42161/): bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (medium 6.3)
- [CVE-2024-42160](https://insights.sbomify.com/CVE-2024-42160/): f2fs: check validation of fault attrs in f2fs_build_fault_attr() (high 7.8)
- [CVE-2024-4216](https://insights.sbomify.com/CVE-2024-4216/): XSS vulnerability in /settings/store API response json payload in pgAdmin 4 (high 7.4)
- [CVE-2024-42159](https://insights.sbomify.com/CVE-2024-42159/): scsi: mpi3mr: Sanitise num_phys (high 7.8)
- [CVE-2024-42158](https://insights.sbomify.com/CVE-2024-42158/): s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (medium 4.1)
- [CVE-2024-42157](https://insights.sbomify.com/CVE-2024-42157/): s390/pkey: Wipe sensitive data on failure (medium 4.1)
- [CVE-2024-42156](https://insights.sbomify.com/CVE-2024-42156/): s390/pkey: Wipe copies of clear-key structures on failure (medium 4.1)
- [CVE-2024-42155](https://insights.sbomify.com/CVE-2024-42155/): s390/pkey: Wipe copies of protected- and secure-keys (low 1.9)
- [CVE-2024-42154](https://insights.sbomify.com/CVE-2024-42154/): tcp_metrics: validate source addr length (medium 4.4)
- [CVE-2024-42153](https://insights.sbomify.com/CVE-2024-42153/): i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr (medium 5.5)
- [CVE-2024-42152](https://insights.sbomify.com/CVE-2024-42152/): nvmet: fix a possible leak when destroy a ctrl during qp establishment (high 7.5)
- [CVE-2024-42151](https://insights.sbomify.com/CVE-2024-42151/): bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable (medium 5.5)
- [CVE-2024-42150](https://insights.sbomify.com/CVE-2024-42150/): net: txgbe: remove separate irq request for MSI and INTx (medium 5.5)
- [CVE-2024-4215](https://insights.sbomify.com/CVE-2024-4215/): The Multi Factor Authentication bypass vulnerability in pgAdmin 4 (high 7.4)
- [CVE-2024-42149](https://insights.sbomify.com/CVE-2024-42149/): fs: don't misleadingly warn during thaw operations (medium 5.5)
- [CVE-2024-42148](https://insights.sbomify.com/CVE-2024-42148/): bnx2x: Fix multiple UBSAN array-index-out-of-bounds (high 7.8)
- [CVE-2024-42147](https://insights.sbomify.com/CVE-2024-42147/): crypto: hisilicon/debugfs - Fix debugfs uninit process issue (high 7.8)
- [CVE-2024-42146](https://insights.sbomify.com/CVE-2024-42146/): drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf (medium 5.5)
- [CVE-2024-42145](https://insights.sbomify.com/CVE-2024-42145/): IB/core: Implement a limit on UMAD receive List (high 7.5)
- [CVE-2024-42144](https://insights.sbomify.com/CVE-2024-42144/): thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data (medium 5.5)
- [CVE-2024-42142](https://insights.sbomify.com/CVE-2024-42142/): net/mlx5: E-switch, Create ingress ACL when needed (medium 5.5)
- [CVE-2024-42141](https://insights.sbomify.com/CVE-2024-42141/): Bluetooth: ISO: Check socket flag instead of hcon (medium 5.5)
- [CVE-2024-42140](https://insights.sbomify.com/CVE-2024-42140/): riscv: kexec: Avoid deadlock in kexec crash path (medium 5.5)
- [CVE-2024-4214](https://insights.sbomify.com/CVE-2024-4214/): WordPress cardealer plugin <= 4.15 - Content Injection vulnerability (low 2.7)
- [CVE-2024-42139](https://insights.sbomify.com/CVE-2024-42139/): ice: Fix improper extts handling (medium 5.5)
- [CVE-2024-42138](https://insights.sbomify.com/CVE-2024-42138/): mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file (high 7.8)
- [CVE-2024-42137](https://insights.sbomify.com/CVE-2024-42137/): Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot (medium 5.5)
- [CVE-2024-42136](https://insights.sbomify.com/CVE-2024-42136/): cdrom: rearrange last_media_change check to avoid unintentional overflow (high 7.8)
- [CVE-2024-42135](https://insights.sbomify.com/CVE-2024-42135/): vhost_task: Handle SIGKILL by flushing work and exiting (medium 5.5)
- [CVE-2024-42134](https://insights.sbomify.com/CVE-2024-42134/): virtio-pci: Check if is_avq is NULL (medium 5.5)
- [CVE-2024-42133](https://insights.sbomify.com/CVE-2024-42133/): Bluetooth: Ignore too large handle values in BIG (high 7.6)
- [CVE-2024-42132](https://insights.sbomify.com/CVE-2024-42132/): bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX (high 7.6)
- [CVE-2024-42131](https://insights.sbomify.com/CVE-2024-42131/): mm: avoid overflows in dirty throttling logic (medium 4.4)
- [CVE-2024-4213](https://insights.sbomify.com/CVE-2024-4213/): Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure (medium 5.3)
- [CVE-2024-42129](https://insights.sbomify.com/CVE-2024-42129/): leds: mlxreg: Use devm_mutex_init() for mutex initialization (medium 5.5)
- [CVE-2024-42128](https://insights.sbomify.com/CVE-2024-42128/): leds: an30259a: Use devm_mutex_init() for mutex initialization (medium 5.5)
- [CVE-2024-42127](https://insights.sbomify.com/CVE-2024-42127/): drm/lima: fix shared irq handling on driver remove (medium 5.5)
- [CVE-2024-42126](https://insights.sbomify.com/CVE-2024-42126/): powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. (medium 5.5)
- [CVE-2024-42125](https://insights.sbomify.com/CVE-2024-42125/): wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband (medium 5.5)
- [CVE-2024-42124](https://insights.sbomify.com/CVE-2024-42124/): scsi: qedf: Make qedf_execute_tmf() non-preemptible (medium 5.5)
- [CVE-2024-42123](https://insights.sbomify.com/CVE-2024-42123/): drm/amdgpu: fix double free err_addr pointer warnings (high 7.0)
- [CVE-2024-42122](https://insights.sbomify.com/CVE-2024-42122/): drm/amd/display: Add NULL pointer check for kzalloc (medium 5.5)
- [CVE-2024-42121](https://insights.sbomify.com/CVE-2024-42121/): drm/amd/display: Check index msg_id before read or write (high 7.8)
- [CVE-2024-42120](https://insights.sbomify.com/CVE-2024-42120/): drm/amd/display: Check pipe offset before setting vblank (high 7.8)
- [CVE-2024-4212](https://insights.sbomify.com/CVE-2024-4212/): Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets (medium 6.4)
- [CVE-2024-42119](https://insights.sbomify.com/CVE-2024-42119/): drm/amd/display: Skip finding free audio for unknown engine_id (high 7.8)
- [CVE-2024-42118](https://insights.sbomify.com/CVE-2024-42118/): drm/amd/display: Do not return negative stream id for array (high 7.8)
- [CVE-2024-42117](https://insights.sbomify.com/CVE-2024-42117/): drm/amd/display: ASSERT when failing to find index by plane/stream id (high 7.8)
- [CVE-2024-42115](https://insights.sbomify.com/CVE-2024-42115/): jffs2: Fix potential illegal address access in jffs2_free_inode (high 7.8)
- [CVE-2024-42114](https://insights.sbomify.com/CVE-2024-42114/): wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (medium 4.4)
- [CVE-2024-42113](https://insights.sbomify.com/CVE-2024-42113/): net: txgbe: initialize num_q_vectors for MSI/INTx interrupts (medium 5.5)
- [CVE-2024-42112](https://insights.sbomify.com/CVE-2024-42112/): net: txgbe: free isb resources at the right time (high 7.8)
- [CVE-2024-42111](https://insights.sbomify.com/CVE-2024-42111/): btrfs: always do the basic checks for btrfs_qgroup_inherit structure (high 7.8)
- [CVE-2024-42110](https://insights.sbomify.com/CVE-2024-42110/): net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (high 7.5)
- [CVE-2024-4211](https://insights.sbomify.com/CVE-2024-4211/): Multiple missing permission checks (low 1.8)
- [CVE-2024-42109](https://insights.sbomify.com/CVE-2024-42109/): netfilter: nf_tables: unconditionally flush pending work before notifier (high 7.8)
- [CVE-2024-42108](https://insights.sbomify.com/CVE-2024-42108/): net: rswitch: Avoid use-after-free in rswitch_poll() (critical 9.8)
- [CVE-2024-42107](https://insights.sbomify.com/CVE-2024-42107/): ice: Don't process extts if PTP is disabled (medium 4.7)
- [CVE-2024-42106](https://insights.sbomify.com/CVE-2024-42106/): inet_diag: Initialize pad field in struct inet_diag_req_v2 (medium 5.5)
- [CVE-2024-42105](https://insights.sbomify.com/CVE-2024-42105/): nilfs2: fix inode number range checks (high 7.8)
- [CVE-2024-42104](https://insights.sbomify.com/CVE-2024-42104/): nilfs2: add missing check for inode numbers on directory entries (high 7.8)
- [CVE-2024-42103](https://insights.sbomify.com/CVE-2024-42103/): btrfs: fix adding block group to a reclaim list and the unused list during reclaim (high 7.8)
- [CVE-2024-42102](https://insights.sbomify.com/CVE-2024-42102/): Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (medium 4.7)
- [CVE-2024-42101](https://insights.sbomify.com/CVE-2024-42101/): drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes (medium 5.5)
- [CVE-2024-42100](https://insights.sbomify.com/CVE-2024-42100/): clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common (medium 5.5)
- [CVE-2024-4210](https://insights.sbomify.com/CVE-2024-4210/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-42099](https://insights.sbomify.com/CVE-2024-42099/): s390/dasd: Fix invalid dereferencing of indirect CCW data pointer (high 7.8)
- [CVE-2024-42098](https://insights.sbomify.com/CVE-2024-42098/): crypto: ecdh - explicitly zeroize private_key (medium 5.5)
- [CVE-2024-42097](https://insights.sbomify.com/CVE-2024-42097/): ALSA: emux: improve patch ioctl data validation (high 7.8)
- [CVE-2024-42096](https://insights.sbomify.com/CVE-2024-42096/): x86: stop playing stack games in profile_pc() (medium 5.5)
- [CVE-2024-42095](https://insights.sbomify.com/CVE-2024-42095/): serial: 8250_omap: Implementation of Errata i2310 (medium 5.5)
- [CVE-2024-42094](https://insights.sbomify.com/CVE-2024-42094/): net/iucv: Avoid explicit cpumask var allocation on stack (high 7.1)
- [CVE-2024-42093](https://insights.sbomify.com/CVE-2024-42093/): net/dpaa2: Avoid explicit cpumask var allocation on stack (high 7.3)
- [CVE-2024-42092](https://insights.sbomify.com/CVE-2024-42092/): gpio: davinci: Validate the obtained number of IRQs (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/293/