# Vulnerabilities published in 2024


- [CVE-2024-40935](https://insights.sbomify.com/CVE-2024-40935/): cachefiles: flush all requests after setting CACHEFILES_DEAD (high 7.8)
- [CVE-2024-40934](https://insights.sbomify.com/CVE-2024-40934/): HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() (medium 5.5)
- [CVE-2024-40933](https://insights.sbomify.com/CVE-2024-40933/): iio: temperature: mlx90635: Fix ERR_PTR dereference in mlx90635_probe() (medium 5.5)
- [CVE-2024-40932](https://insights.sbomify.com/CVE-2024-40932/): drm/exynos/vidi: fix memory leak in .get_modes() (medium 5.5)
- [CVE-2024-40931](https://insights.sbomify.com/CVE-2024-40931/): mptcp: ensure snd_una is properly initialized on connect (medium 5.5)
- [CVE-2024-40930](https://insights.sbomify.com/CVE-2024-40930/): wifi: cfg80211: validate HE operation element parsing (high 7.1)
- [CVE-2024-4093](https://insights.sbomify.com/CVE-2024-4093/): SourceCodester Simple Subscription Website view_application.php sql injection (medium 6.3)
- [CVE-2024-40929](https://insights.sbomify.com/CVE-2024-40929/): wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (high 7.1)
- [CVE-2024-40928](https://insights.sbomify.com/CVE-2024-40928/): net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (medium 5.5)
- [CVE-2024-40927](https://insights.sbomify.com/CVE-2024-40927/): xhci: Handle TD clearing for multiple streams case (high 7.8)
- [CVE-2024-40926](https://insights.sbomify.com/CVE-2024-40926/): drm/nouveau: don't attempt to schedule hpd_work on headless cards (medium 5.5)
- [CVE-2024-40925](https://insights.sbomify.com/CVE-2024-40925/): block: fix request.queuelist usage in flush (high 7.8)
- [CVE-2024-40924](https://insights.sbomify.com/CVE-2024-40924/): drm/i915/dpt: Make DPT object unshrinkable (high 7.8)
- [CVE-2024-40923](https://insights.sbomify.com/CVE-2024-40923/): vmxnet3: disable rx data ring on dma allocation failure (critical 9.8)
- [CVE-2024-40922](https://insights.sbomify.com/CVE-2024-40922/): io_uring/rsrc: don't lock while !TASK_RUNNING (medium 5.5)
- [CVE-2024-40921](https://insights.sbomify.com/CVE-2024-40921/): net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (medium 5.5)
- [CVE-2024-40920](https://insights.sbomify.com/CVE-2024-40920/): net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (high 7.1)
- [CVE-2024-4092](https://insights.sbomify.com/CVE-2024-4092/): Slider Revolution <= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter (medium 6.4)
- [CVE-2024-40919](https://insights.sbomify.com/CVE-2024-40919/): bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (medium 5.5)
- [CVE-2024-40918](https://insights.sbomify.com/CVE-2024-40918/): parisc: Try to fix random segmentation faults in package builds (high 7.8)
- [CVE-2024-40917](https://insights.sbomify.com/CVE-2024-40917/): memblock: make memblock_set_node() also warn about use of MAX_NUMNODES (medium 5.5)
- [CVE-2024-40916](https://insights.sbomify.com/CVE-2024-40916/): drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found (medium 5.5)
- [CVE-2024-40915](https://insights.sbomify.com/CVE-2024-40915/): riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context (medium 5.5)
- [CVE-2024-40914](https://insights.sbomify.com/CVE-2024-40914/): mm/huge_memory: don't unpoison huge_zero_folio (medium 5.5)
- [CVE-2024-40913](https://insights.sbomify.com/CVE-2024-40913/): cachefiles: defer exposing anon_fd until after copy_to_user() succeeds (high 7.8)
- [CVE-2024-40912](https://insights.sbomify.com/CVE-2024-40912/): wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (medium 5.5)
- [CVE-2024-40911](https://insights.sbomify.com/CVE-2024-40911/): wifi: cfg80211: Lock wiphy in cfg80211_get_station (high 8.8)
- [CVE-2024-40910](https://insights.sbomify.com/CVE-2024-40910/): ax25: Fix refcount imbalance on inbound connections (high 8.8)
- [CVE-2024-4091](https://insights.sbomify.com/CVE-2024-4091/): Responsive Gallery Grid < 2.3.15 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-40909](https://insights.sbomify.com/CVE-2024-40909/): bpf: Fix a potential use-after-free in bpf_link_free() (high 7.8)
- [CVE-2024-40908](https://insights.sbomify.com/CVE-2024-40908/): bpf: Set run context for rawtp test_run callback (medium 5.5)
- [CVE-2024-40907](https://insights.sbomify.com/CVE-2024-40907/): ionic: fix kernel panic in XDP_TX action (critical 9.8)
- [CVE-2024-40906](https://insights.sbomify.com/CVE-2024-40906/): net/mlx5: Always stop health timer during driver removal (high 7.8)
- [CVE-2024-40905](https://insights.sbomify.com/CVE-2024-40905/): ipv6: fix possible race in __fib6_drop_pcpu_from() (medium 4.7)
- [CVE-2024-40904](https://insights.sbomify.com/CVE-2024-40904/): USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (medium 5.5)
- [CVE-2024-40903](https://insights.sbomify.com/CVE-2024-40903/): usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps (high 7.8)
- [CVE-2024-40902](https://insights.sbomify.com/CVE-2024-40902/): jfs: xattr: fix buffer overflow for invalid xattr (high 7.8)
- [CVE-2024-40901](https://insights.sbomify.com/CVE-2024-40901/): scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (high 7.3)
- [CVE-2024-40900](https://insights.sbomify.com/CVE-2024-40900/): cachefiles: remove requests from xarray during flushing requests (high 7.8)
- [CVE-2024-4090](https://insights.sbomify.com/CVE-2024-4090/): My Sticky Bar < 2.7.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-40899](https://insights.sbomify.com/CVE-2024-40899/): cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() (high 7.8)
- [CVE-2024-40898](https://insights.sbomify.com/CVE-2024-40898/): Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (critical 9.1)
- [CVE-2024-40897](https://insights.sbomify.com/CVE-2024-40897/): Memory corruption in ORC (high 7.0)
- [CVE-2024-40896](https://insights.sbomify.com/CVE-2024-40896/): XML external entity in libxml2 (critical 9.1)
- [CVE-2024-40895](https://insights.sbomify.com/CVE-2024-40895/): Command injection in EDR Plus Pack (medium 6.4)
- [CVE-2024-40893](https://insights.sbomify.com/CVE-2024-40893/): Firewalla BTLE Authenticated Command Injection (medium 6.8)
- [CVE-2024-40892](https://insights.sbomify.com/CVE-2024-40892/): Firewalla BTLE Weak Credentials (high 7.1)
- [CVE-2024-40891](https://insights.sbomify.com/CVE-2024-40891/): Zyxel DSL CPE OS Command Injection (high 8.8, exploited in the wild)
- [CVE-2024-40890](https://insights.sbomify.com/CVE-2024-40890/): Zyxel DSL CPE OS Command Injection (high 8.8, exploited in the wild)
- [CVE-2024-4089](https://insights.sbomify.com/CVE-2024-4089/): Privilege escalation in SuperFile (high 7.8)
- [CVE-2024-40887](https://insights.sbomify.com/CVE-2024-40887/): Race condition in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows (medium 6.0)
- [CVE-2024-40886](https://insights.sbomify.com/CVE-2024-40886/): One-click Client-Side Path Traversal Leading to CSRF in User Management admin page (medium 4.6)
- [CVE-2024-40885](https://insights.sbomify.com/CVE-2024-40885/): Use after free in Intel(R) Server M20NTP BIOS (high 8.7)
- [CVE-2024-40884](https://insights.sbomify.com/CVE-2024-40884/): Unauthorized disabling of invite URL (low 2.7)
- [CVE-2024-40883](https://insights.sbomify.com/CVE-2024-40883/): Cross-site request forgery in WRC-X1500GS-B (medium 6.5)
- [CVE-2024-4088](https://insights.sbomify.com/CVE-2024-4088/): Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 - Missing Authorization (medium 4.3)
- [CVE-2024-40875](https://insights.sbomify.com/CVE-2024-40875/): Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52 (medium 5.9)
- [CVE-2024-40873](https://insights.sbomify.com/CVE-2024-40873/): XSS in Secure Access administrative console (medium 4.5)
- [CVE-2024-40872](https://insights.sbomify.com/CVE-2024-40872/): Elevation of privilege in Absolute Secure Access clients and servers (high 8.4)
- [CVE-2024-4087](https://insights.sbomify.com/CVE-2024-4087/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-40867](https://insights.sbomify.com/CVE-2024-40867/): Security feature bypass in iOS and iPadOS (high 8.8)
- [CVE-2024-40866](https://insights.sbomify.com/CVE-2024-40866/): Other in Safari (medium 6.5)
- [CVE-2024-40865](https://insights.sbomify.com/CVE-2024-40865/): Information disclosure in visionOS (medium 5.3)
- [CVE-2024-40864](https://insights.sbomify.com/CVE-2024-40864/): Information disclosure in iOS and iPadOS (low 2.7)
- [CVE-2024-40863](https://insights.sbomify.com/CVE-2024-40863/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-40862](https://insights.sbomify.com/CVE-2024-40862/): Information disclosure in Xcode (high 7.5)
- [CVE-2024-40861](https://insights.sbomify.com/CVE-2024-40861/): Privilege escalation in macOS (high 7.8)
- [CVE-2024-40860](https://insights.sbomify.com/CVE-2024-40860/): Business logic in macOS (medium 5.5)
- [CVE-2024-4086](https://insights.sbomify.com/CVE-2024-4086/): CM Tooltip Glossary – Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-40859](https://insights.sbomify.com/CVE-2024-40859/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-40858](https://insights.sbomify.com/CVE-2024-40858/): Missing authorization in macOS (high 7.1)
- [CVE-2024-40857](https://insights.sbomify.com/CVE-2024-40857/): Cross-site scripting in Safari (medium 6.1)
- [CVE-2024-40856](https://insights.sbomify.com/CVE-2024-40856/): Security feature bypass in iOS and iPadOS (high 7.5)
- [CVE-2024-40855](https://insights.sbomify.com/CVE-2024-40855/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-40854](https://insights.sbomify.com/CVE-2024-40854/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2024-40853](https://insights.sbomify.com/CVE-2024-40853/): Security feature bypass in iOS and iPadOS (medium 5.9)
- [CVE-2024-40852](https://insights.sbomify.com/CVE-2024-40852/): Missing authorization in iOS and iPadOS (high 7.5)
- [CVE-2024-40851](https://insights.sbomify.com/CVE-2024-40851/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2024-40850](https://insights.sbomify.com/CVE-2024-40850/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-4085](https://insights.sbomify.com/CVE-2024-4085/): Tabellen von faustball.com <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-40849](https://insights.sbomify.com/CVE-2024-40849/): Race condition in macOS (high 7.5)
- [CVE-2024-40848](https://insights.sbomify.com/CVE-2024-40848/): Security feature bypass in macOS (high 7.5)
- [CVE-2024-40847](https://insights.sbomify.com/CVE-2024-40847/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-40846](https://insights.sbomify.com/CVE-2024-40846/): Memory corruption in macOS (high 7.8)
- [CVE-2024-40845](https://insights.sbomify.com/CVE-2024-40845/): Memory corruption in macOS (medium 5.5)
- [CVE-2024-40844](https://insights.sbomify.com/CVE-2024-40844/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-40843](https://insights.sbomify.com/CVE-2024-40843/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-40842](https://insights.sbomify.com/CVE-2024-40842/): Information disclosure in macOS (medium 5.5)
- [CVE-2024-40841](https://insights.sbomify.com/CVE-2024-40841/): Memory corruption in macOS (high 7.8)
- [CVE-2024-40840](https://insights.sbomify.com/CVE-2024-40840/): Information disclosure in iOS and iPadOS (medium 4.6)
- [CVE-2024-4084](https://insights.sbomify.com/CVE-2024-4084/): SSRF vulnerability in mintplex-labs/anything-llm (high 7.7)
- [CVE-2024-40839](https://insights.sbomify.com/CVE-2024-40839/): Missing authorization in iOS and iPadOS (low 2.4)
- [CVE-2024-40838](https://insights.sbomify.com/CVE-2024-40838/): Information disclosure in macOS (low 3.3)
- [CVE-2024-40837](https://insights.sbomify.com/CVE-2024-40837/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-40836](https://insights.sbomify.com/CVE-2024-40836/): Security feature bypass in iOS and iPadOS (high 7.5)
- [CVE-2024-40835](https://insights.sbomify.com/CVE-2024-40835/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2024-40834](https://insights.sbomify.com/CVE-2024-40834/): Security feature bypass in macOS (medium 4.4)
- [CVE-2024-40833](https://insights.sbomify.com/CVE-2024-40833/): Security feature bypass in iOS and iPadOS (medium 6.2)
- [CVE-2024-40832](https://insights.sbomify.com/CVE-2024-40832/): Information disclosure in macOS (low 3.3)
- [CVE-2024-40831](https://insights.sbomify.com/CVE-2024-40831/): Missing authorization in macOS (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/303/