Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 294 of 521.
- CVE-2024-42091 drm/xe: Check pat.ops before dumping PAT settings
- CVE-2024-42090 pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
- CVE-2024-4209 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-42089 ASoC: fsl-asoc-card: set priv->pdev before using it
- CVE-2024-42088 ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
- CVE-2024-42087 drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
- CVE-2024-42086 iio: chemical: bme680: Fix overflows in compensate() functions
- CVE-2024-42085 usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
- CVE-2024-42084 ftruncate: pass a signed offset
- CVE-2024-42083 ionic: fix kernel panic due to multi-buffer handling
- CVE-2024-42082 xdp: Remove WARN() from __xdp_reg_mem_model()
- CVE-2024-42081 drm/xe/xe_devcoredump: Check NULL before assignments
- CVE-2024-42080 RDMA/restrack: Fix potential invalid address access
- CVE-2024-4208 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-42079 gfs2: Fix NULL pointer dereference in gfs2_log_flush
- CVE-2024-42078 nfsd: initialise nfsd_info.mutex early.
- CVE-2024-42077 ocfs2: fix DIO failure due to insufficient transaction credits
- CVE-2024-42076 net: can: j1939: Initialize unused data in j1939_send_one()
- CVE-2024-42075 bpf: Fix remap of arena.
- CVE-2024-42074 ASoC: amd: acp: add a null check for chip_pdev structure
- CVE-2024-42073 mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
- CVE-2024-42072 bpf: Fix may_goto with negative offset.
- CVE-2024-42071 ionic: use dev_consume_skb_any outside of napi
- CVE-2024-42070 netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
- CVE-2024-4207 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2024-42069 net: mana: Fix possible double free in error handling path
- CVE-2024-42068 bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
- CVE-2024-42067 bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
- CVE-2024-42066 drm/xe: Fix potential integer overflow in page size calculation
- CVE-2024-42065 drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init
- CVE-2024-42064 drm/amd/display: Skip pipe if the pipe idx not set properly
- CVE-2024-42063 bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
- CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins
- CVE-2024-42061 Cross-site scripting in ATP series firmware
- CVE-2024-42060 Command injection in ATP series firmware
- CVE-2024-42059 Command injection in ATP series firmware
- CVE-2024-42058 Null dereference in ATP series firmware
- CVE-2024-42057 Command injection in ATP series firmware
- CVE-2024-42056 Information disclosure in retool:retool
- CVE-2024-42055 Cross-site scripting in cervantessec:cervantes
- CVE-2024-42054 File upload in cervantessec:cervantes
- CVE-2024-42053 Privilege escalation in splashtop:streamer
- CVE-2024-42052 Privilege escalation in splashtop:streamer
- CVE-2024-42051 Privilege escalation in splashtop:streamer
- CVE-2024-42050 Privilege escalation in splashtop:streamer
- CVE-2024-4205 Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure
- CVE-2024-42049 TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.
- CVE-2024-42048 OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users
- CVE-2024-42041 The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an
- CVE-2024-42040 Memory corruption in denx:u-boot
- CVE-2024-4204 Bulk Posts Editing For WordPress <= 4.2.3 - Cross-Site Request Forgery
- CVE-2024-42039 Missing authorization in EMUI
- CVE-2024-42038 Auth bypass in EMUI
- CVE-2024-42037 Other in EMUI
- CVE-2024-42036 Missing authorization in EMUI
- CVE-2024-42035 Missing authorization in EMUI
- CVE-2024-42034 Other in EMUI
- CVE-2024-42033 Missing authorization in EMUI
- CVE-2024-42032 Missing authorization in EMUI
- CVE-2024-42031 Missing authorization in EMUI
- CVE-2024-42030 Missing authorization in EMUI
- CVE-2024-4203 Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-42029 xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single
- CVE-2024-42028 Privilege escalation in UniFi Network Application
- CVE-2024-42027 Weak cryptography in Mobile
- CVE-2024-42025 Command injection in UniFi Network Application
- CVE-2024-42024 Code injection in One
- CVE-2024-42023 Privilege escalation in One
- CVE-2024-42022 Misconfiguration in One
- CVE-2024-42021 Missing authorization in One
- CVE-2024-42020 Cross-site scripting in One
- CVE-2024-4202 Progress Telerik Reporting Local Instantiation Vulnerability
- CVE-2024-42019 Information disclosure in One
- CVE-2024-42018 An issue was discovered in Atos Eviden SMC xScale before 1.6.6.
- CVE-2024-42017 An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11.
- CVE-2024-42013 In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability.
- CVE-2024-42012 GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed.
- CVE-2024-42011 The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat.
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in ren
- CVE-2024-4201 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2024-42009 RoundCube Webmail Cross-Site Scripting
- CVE-2024-42008 Cross-site scripting in roundcube:webmail
- CVE-2024-42007 SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files.
- CVE-2024-42006 Information disclosure in keyfactor:aws orchestrator
- CVE-2024-42005 Django SQL injection vulnerability
- CVE-2024-42004 Security feature bypass in Teams (work or school)
- CVE-2024-42002 Unsafe use of eval() method in ros2 topic hz tool
- CVE-2024-42001 Vonets WiFi Bridges Forced Browsing
- CVE-2024-42000 Unauthorized Access to view channels' details
- CVE-2024-4200 Progress Telerik Reporting Local Deserialization Vulnerability
- CVE-2024-41999 Misconfiguration in Smart-tab Android app
- CVE-2024-41997 An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02).
- CVE-2024-41996 Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote att
- CVE-2024-41995 Misconfiguration in JavaTM Platform
- CVE-2024-41992 Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library function is used.
- CVE-2024-41991 Django vulnerable to denial-of-service attack
- CVE-2024-41990 Django vulnerable to a denial-of-service attack
- CVE-2024-4199 Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization
- CVE-2024-41989 Django memory consumption vulnerability
- CVE-2024-41988 Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family Transmitter