Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 301 of 521.
- CVE-2024-41131 Out-of-bounds Write in SixLabors ImageSharp
- CVE-2024-41130 llama.cpp null pointer dereference in gguf_init_from_file
- CVE-2024-4113 Tenda TX9 SetSysTimeCfg sub_42D4DC stack-based overflow
- CVE-2024-41129 The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
- CVE-2024-41128 Action Dispatch has possible ReDoS vulnerability in query parameter filtering
- CVE-2024-41127 Code injection in monkeytype
- CVE-2024-41126 Out-of-bounds read when decoding SNMP messages in Contiki-NG
- CVE-2024-41125 Out-of-bounds read in SNMP when decoding a string in Contiki-NG
- CVE-2024-41124 Puncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`
- CVE-2024-41123 REXML DoS vulnerability
- CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker
- CVE-2024-41121 Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker
- CVE-2024-41120 streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.py
- CVE-2024-4112 Tenda TX9 SetVirtualServerCfg sub_42CB94 stack-based overflow
- CVE-2024-41119 streamlit-geospatial remote code execution in pages/8_🏜️_Raster_Data_Visualization.py
- CVE-2024-41118 streamlit-geospatial blind SSRF in pages/7_📦_Web_Map_Service.py
- CVE-2024-41117 Remote code execution in streamlit geospatial in pages/10_🌍_Earth_Engine_Datasets.py
- CVE-2024-41116 Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option vis_params
- CVE-2024-41115 Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option palette
- CVE-2024-41114 Code injection in streamlit-geospatial
- CVE-2024-41113 Code injection in streamlit-geospatial
- CVE-2024-41112 Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option palette
- CVE-2024-41111 BishopFox Sliver Authenticated Remote Code Execution
- CVE-2024-41110 Moby authz zero length regression
- CVE-2024-4111 Tenda TX9 SetLEDCfg sub_42BD7C stack-based overflow
- CVE-2024-41109 Pimcore vulnerable to disclosure of system and database information behind /admin firewall
- CVE-2024-41108 FOG Sensitive Information Disclosure
- CVE-2024-41107 Apache CloudStack: SAML Signature Exclusion
- CVE-2024-41098 ata: libata-core: Fix null pointer dereference on error
- CVE-2024-41097 usb: atm: cxacru: fix endpoint checking in cxacru_bind()
- CVE-2024-41096 PCI/MSI: Fix UAF in msi_capability_init
- CVE-2024-41095 drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
- CVE-2024-41094 drm/fbdev-dma: Only set smem_start is enable per module option
- CVE-2024-41093 drm/amdgpu: avoid using null object of framebuffer
- CVE-2024-41092 drm/i915/gt: Fix potential UAF by revoke of fence registers
- CVE-2024-41091 tun: add missing verification for short frame
- CVE-2024-41090 tap: add missing verification for short frame
- CVE-2024-41089 drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
- CVE-2024-41088 can: mcp251xfd: fix infinite loop when xmit fails
- CVE-2024-41087 ata: libata-core: Fix double free on error
- CVE-2024-41086 bcachefs: Fix sb_field_downgrade validation
- CVE-2024-41085 cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
- CVE-2024-41084 cxl/region: Avoid null pointer dereference in region lookup
- CVE-2024-41083 netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid
- CVE-2024-41082 nvme-fabrics: use reserved tag for reg read/write command
- CVE-2024-41081 ila: block BH in ila_output()
- CVE-2024-41080 io_uring: fix possible deadlock in io_register_iowq_max_workers()
- CVE-2024-41079 nvmet: always initialize cqe.result
- CVE-2024-41078 btrfs: qgroup: fix quota root leak after quota disable failure
- CVE-2024-41077 null_blk: fix validation of block size
- CVE-2024-41076 NFSv4: Fix memory leak in nfs4_set_security_label
- CVE-2024-41075 cachefiles: add consistency check for copen/cread
- CVE-2024-41074 cachefiles: Set object to close if ondemand_id < 0 in copen
- CVE-2024-41073 nvme: avoid double free special payload
- CVE-2024-41072 wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
- CVE-2024-41070 KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
- CVE-2024-4107 Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- CVE-2024-41069 ASoC: topology: Fix references to freed memory
- CVE-2024-41068 s390/sclp: Fix sclp_init() cleanup on failure
- CVE-2024-41067 btrfs: scrub: handle RST lookup error correctly
- CVE-2024-41066 ibmvnic: Add tx check to prevent skb leak
- CVE-2024-41065 powerpc/pseries: Whitelist dtl slub object for copying to userspace
- CVE-2024-41064 powerpc/eeh: avoid possible crash when edev->pdev changes
- CVE-2024-41063 Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
- CVE-2024-41062 bluetooth/l2cap: sync sock recv cb and release
- CVE-2024-41061 drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport
- CVE-2024-41060 drm/radeon: check bo_va->bo is non-NULL before using it
- CVE-2024-4106 Hardcoded credentials in CI Server
- CVE-2024-41059 hfsplus: fix uninit-value in copy_name
- CVE-2024-41058 cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
- CVE-2024-41057 cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
- CVE-2024-41056 firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
- CVE-2024-41055 mm: prevent derefencing NULL ptr in pfn_section_valid()
- CVE-2024-41054 scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
- CVE-2024-41053 scsi: ufs: core: Fix ufshcd_abort_one racing issue
- CVE-2024-41052 vfio/pci: Init the count variable in collecting hot-reset devices
- CVE-2024-41051 cachefiles: wait for ondemand_object_worker to finish when dropping object
- CVE-2024-41050 cachefiles: cyclic allocation of msg_id to avoid reuse
- CVE-2024-4105 Cross-site scripting in CI Server
- CVE-2024-41049 filelock: fix potential use-after-free in posix_lock_inode
- CVE-2024-41048 skmsg: Skip zero length skb in sk_msg_recvmsg
- CVE-2024-41047 i40e: Fix XDP program unloading while removing the driver
- CVE-2024-41046 net: ethernet: lantiq_etop: fix double free in detach
- CVE-2024-41045 bpf: Defer work in bpf_timer_cancel_and_free
- CVE-2024-41044 ppp: reject claimed-as-LCP but actually malformed packets
- CVE-2024-41043 netfilter: nfnetlink_queue: drop bogus WARN_ON
- CVE-2024-41042 netfilter: nf_tables: prefer nft_chain_validate
- CVE-2024-41041 udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
- CVE-2024-41040 net/sched: Fix UAF when resolving a clash
- CVE-2024-4104 ADFO – Custom data in admin dashboard <= 1.9.0 - Reflected Cross-Site Scripting
- CVE-2024-41039 firmware: cs_dsp: Fix overflow checking of wmfw header
- CVE-2024-41038 firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
- CVE-2024-41037 ASoC: SOF: Intel: hda: fix null deref on system suspend entry
- CVE-2024-41036 net: ks8851: Fix deadlock with the SPI chip variant
- CVE-2024-41035 USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
- CVE-2024-41034 nilfs2: fix kernel bug on rename operation of broken directory
- CVE-2024-41033 cachestat: do not flush stats in recency check
- CVE-2024-41032 mm: vmalloc: check if a hash-index is in cpu_possible_mask
- CVE-2024-41031 mm/filemap: skip to create PMD-sized page cache if needed
- CVE-2024-41030 ksmbd: discard write access to the directory open