Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 302 of 521.
- CVE-2024-4103 ADFO – Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery
- CVE-2024-41029 nvmem: core: limit cell sysfs permissions to main attribute ones
- CVE-2024-41028 platform/x86: toshiba_acpi: Fix array out-of-bounds access
- CVE-2024-41027 Fix userfaultfd_api to return EINVAL as expected
- CVE-2024-41026 mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length
- CVE-2024-41025 misc: fastrpc: Fix memory leak in audio daemon attach operation
- CVE-2024-41023 sched/deadline: Fix task_struct reference leak
- CVE-2024-41022 drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
- CVE-2024-41021 s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
- CVE-2024-41020 filelock: Fix fcntl/close race recovery compat path
- CVE-2024-4102 Pricing Table <= 2.0.1 - Missing Authorization
- CVE-2024-41019 fs/ntfs3: Validate ff offset
- CVE-2024-41018 fs/ntfs3: Add a check for attr_names and oatbl
- CVE-2024-41017 jfs: don't walk off the end of ealist
- CVE-2024-41016 ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
- CVE-2024-41015 ocfs2: add bounds checking to ocfs2_check_dir_entry()
- CVE-2024-41014 xfs: add bounds checking to xlog_recover_process_data
- CVE-2024-41013 xfs: don't walk off the end of a directory data block
- CVE-2024-41012 filelock: Remove locks reliably when fcntl/close race is detected
- CVE-2024-41011 drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
- CVE-2024-41010 bpf: Fix too early release of tcx_entry
- CVE-2024-41009 bpf: Fix overrunning reservations in ringbuf
- CVE-2024-41008 drm/amdgpu: change vm->task_info handling
- CVE-2024-41007 tcp: avoid too many retransmit packets
- CVE-2024-41006 netrom: Fix a memory leak in nr_heartbeat_expiry()
- CVE-2024-41005 netpoll: Fix race condition in netpoll_owner_active
- CVE-2024-41004 tracing: Build event generation tests only as modules
- CVE-2024-41003 bpf: Fix reg_set_min_max corruption of fake_reg
- CVE-2024-41002 crypto: hisilicon/sec - Fix memory leak for sec resource release
- CVE-2024-41001 io_uring/sqpoll: work around a potential audit memory leak
- CVE-2024-41000 block/ioctl: prefer different overflow check
- CVE-2024-4100 Pricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()
- CVE-2024-40999 net: ena: Add validation for completion descriptors consistency
- CVE-2024-40998 ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
- CVE-2024-40997 cpufreq: amd-pstate: fix memory leak on CPU EPP exit
- CVE-2024-40996 bpf: Avoid splat in pskb_pull_reason
- CVE-2024-40995 net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
- CVE-2024-40994 ptp: fix integer overflow in max_vclocks_store
- CVE-2024-40993 netfilter: ipset: Fix suspicious rcu_dereference_protected()
- CVE-2024-40992 RDMA/rxe: Fix responder length checking for UD request packets
- CVE-2024-40991 dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()
- CVE-2024-40990 RDMA/mlx5: Add check for srq max_sge attribute
- CVE-2024-4099 Improper Encoding or Escaping of Output in GitLab
- CVE-2024-40989 KVM: arm64: Disassociate vcpus from redistributor region on teardown
- CVE-2024-40988 drm/radeon: fix UBSAN warning in kv_dpm.c
- CVE-2024-40987 drm/amdgpu: fix UBSAN warning in kv_dpm.c
- CVE-2024-40986 dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()
- CVE-2024-40985 net/tcp_ao: Don't leak ao_info on error-path
- CVE-2024-40984 ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
- CVE-2024-40983 tipc: force a dst refcount before doing decryption
- CVE-2024-40981 batman-adv: bypass empty buckets in batadv_purge_orig_ref()
- CVE-2024-40980 drop_monitor: replace spin_lock by raw_spin_lock
- CVE-2024-4098 Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion
- CVE-2024-40979 wifi: ath12k: fix kernel crash during resume
- CVE-2024-40978 scsi: qedi: Fix crash while reading debugfs attribute
- CVE-2024-40977 wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
- CVE-2024-40976 drm/lima: mask irqs in timeout path before hard reset
- CVE-2024-40975 platform/x86: x86-android-tablets: Unregister devices in reverse order
- CVE-2024-40974 powerpc/pseries: Enforce hcall result buffer validity and size
- CVE-2024-40973 media: mtk-vcodec: potential null pointer deference in SCP
- CVE-2024-40972 ext4: do not create EA inode under buffer lock
- CVE-2024-40971 f2fs: remove clear SB_INLINECRYPT flag in default_options
- CVE-2024-40970 Avoid hw_desc array overrun in dw-axi-dmac
- CVE-2024-4097 Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload
- CVE-2024-40969 f2fs: don't set RO when shutting down f2fs
- CVE-2024-40968 MIPS: Octeon: Add PCIe link status check
- CVE-2024-40967 serial: imx: Introduce timeout when waiting on transmitter empty
- CVE-2024-40966 tty: add the option to have a tty reject a new ldisc
- CVE-2024-40965 i2c: lpi2c: Avoid calling clk_get_rate during transfer
- CVE-2024-40964 ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()
- CVE-2024-40963 mips: bmips: BCM6358: make sure CBR is correctly set
- CVE-2024-40962 btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
- CVE-2024-40961 ipv6: prevent possible NULL deref in fib6_nh_init()
- CVE-2024-40960 ipv6: prevent possible NULL dereference in rt6_probe()
- CVE-2024-4096 Responsive Tabs <= 4.0.8 - Contributor+ Stored XSS
- CVE-2024-40959 xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
- CVE-2024-40958 netns: Make get_net_ns() handle zero refcount net
- CVE-2024-40957 seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
- CVE-2024-40956 dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
- CVE-2024-40955 ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
- CVE-2024-40954 net: do not leave a dangling sk pointer, when socket creation fails
- CVE-2024-40953 KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
- CVE-2024-40952 ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
- CVE-2024-40951 ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
- CVE-2024-40950 mm: huge_memory: fix misused mapping_large_folio_support() for anon folios
- CVE-2024-4095 Collapse-O-Matic <= 1.8.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-40949 mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
- CVE-2024-40948 mm/page_table_check: fix crash on ZONE_DEVICE
- CVE-2024-40947 ima: Avoid blocking in RCU read-side critical section
- CVE-2024-40945 iommu: Return right value in iommu_sva_bind_device()
- CVE-2024-40944 x86/kexec: Fix bug with call depth tracking
- CVE-2024-40943 ocfs2: fix races between hole punching and AIO+DIO
- CVE-2024-40942 wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
- CVE-2024-40941 wifi: iwlwifi: mvm: don't read past the mfuart notifcation
- CVE-2024-40940 net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
- CVE-2024-4094 Simple Share Buttons Adder < 8.5.1 - Admin+ Stored XSS
- CVE-2024-40939 net: wwan: iosm: Fix tainted pointer delete is case of region creation fail
- CVE-2024-40938 landlock: Fix d_parent walk
- CVE-2024-40937 gve: Clear napi->skb before dev_kfree_skb_any()
- CVE-2024-40936 cxl/region: Fix memregion leaks in devm_cxl_add_region()