Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 320 of 521.
- CVE-2024-3858 Null dereference in Firefox
- CVE-2024-38579 crypto: bcm - Fix pointer arithmetic
- CVE-2024-38578 ecryptfs: Fix buffer size for tag 66 packet
- CVE-2024-38577 rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
- CVE-2024-38576 rcu: Fix buffer overflow in print_cpu_stall_info()
- CVE-2024-38575 wifi: brcmfmac: pcie: handle randbuf allocation failure
- CVE-2024-38574 libbpf: Prevent null-pointer dereference when prog to load has no BTF
- CVE-2024-38573 cppc_cpufreq: Fix possible null pointer dereference
- CVE-2024-38572 wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
- CVE-2024-38571 thermal/drivers/tsens: Fix null pointer dereference
- CVE-2024-38570 gfs2: Fix potential glock use-after-free on unmount
- CVE-2024-3857 Use after free in Firefox
- CVE-2024-38569 drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
- CVE-2024-38568 drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
- CVE-2024-38567 wifi: carl9170: add a proper sanity check for endpoints
- CVE-2024-38566 bpf: Fix verifier assumptions about socket->sk
- CVE-2024-38565 wifi: ar5523: enable proper endpoint verification
- CVE-2024-38564 bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
- CVE-2024-38563 wifi: mt76: mt7996: fix potential memory leakage when reading chip temperature
- CVE-2024-38562 wifi: nl80211: Avoid address calculations via out of bounds array indexing
- CVE-2024-38561 kunit: Fix kthread reference
- CVE-2024-38560 scsi: bfa: Ensure the copied buf is NUL terminated
- CVE-2024-3856 Use after free in Firefox
- CVE-2024-38559 scsi: qedf: Ensure the copied buf is NUL terminated
- CVE-2024-38558 net: openvswitch: fix overwriting ct original tuple for ICMPv6
- CVE-2024-38557 net/mlx5: Reload only IB representors upon lag disable/enable
- CVE-2024-38556 net/mlx5: Add a timeout to acquire the command queue semaphore
- CVE-2024-38555 net/mlx5: Discard command completions in internal error
- CVE-2024-38554 ax25: Fix reference count leak issue of net_device
- CVE-2024-38553 net: fec: remove .ndo_poll_controller to avoid deadlocks
- CVE-2024-38552 drm/amd/display: Fix potential index out of bounds in color transformation function
- CVE-2024-38551 ASoC: mediatek: Assign dummy when codec not specified for a DAI link
- CVE-2024-38550 ASoC: kirkwood: Fix potential NULL dereference
- CVE-2024-3855 Memory corruption in Firefox
- CVE-2024-38549 drm/mediatek: Add 0 size check to mtk_drm_gem_obj
- CVE-2024-38548 drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference
- CVE-2024-38547 media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries
- CVE-2024-38546 drm: vc4: Fix possible null pointer dereference
- CVE-2024-38545 RDMA/hns: Fix UAF for cq async event
- CVE-2024-38544 RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
- CVE-2024-38543 lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
- CVE-2024-38542 RDMA/mana_ib: boundary check before installing cq callbacks
- CVE-2024-38541 of: module: add buffer overflow check in of_modalias()
- CVE-2024-38540 bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
- CVE-2024-3854 Memory corruption in Firefox
- CVE-2024-38539 RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw
- CVE-2024-38538 net: bridge: xmit: make sure we have at least eth header len bytes
- CVE-2024-38537 Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js
- CVE-2024-38536 Suricata http/range: NULL-ptr deref when http.memcap is reached
- CVE-2024-38535 Suricata http2: oom from duplicate headers
- CVE-2024-38534 Suricata modbus: txs without responses are never freed
- CVE-2024-38533 ZKsync Era invalid stack addressing conversion
- CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation
- CVE-2024-38531 Nix sandbox escape
- CVE-2024-38530 Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"
- CVE-2024-3853 Use after free in Firefox
- CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2024-38528 Unlimited number of NTS-KE connections can crash ntpd-rs server
- CVE-2024-38527 Cross-site Scripting in ZenUML
- CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled
- CVE-2024-38525 dd-trace-cpp malformed unicode header values may cause crash
- CVE-2024-38524 GWC Home Page communicate version and revision information
- CVE-2024-38523 Hush Line OTP issue
- CVE-2024-38522 CSP bypass in Hush Line
- CVE-2024-38521 Persistent Cross-Site Scripting (XSS) in hushline inbox
- CVE-2024-38520 SoftEther VPN with L2TP - 2.75x Amplification
- CVE-2024-3852 Memory corruption in Firefox
- CVE-2024-38519 yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
- CVE-2024-38518 bbb-web API additional parameters considered
- CVE-2024-38517 Integer overflow in RapidJSON
- CVE-2024-38516 Aimeos HTML client may potentially reveal sensitive information in error log
- CVE-2024-38514 NextChat Server-Side Request Forgery (SSRF)
- CVE-2024-38513 Fiber Session Middleware Token Injection Vulnerability
- CVE-2024-38512 Command injection in XClarity Controller
- CVE-2024-38511 Command injection in XClarity Controller
- CVE-2024-38510 Command injection in XClarity Controller
- CVE-2024-3851 Unrestricted File Upload Leading to XSS in imartinez/privategpt
- CVE-2024-38509 Memory corruption in XClarity Controller
- CVE-2024-38508 Command injection in XClarity Controller
- CVE-2024-38507 Cross-site scripting in Hub
- CVE-2024-38506 Missing authorization in YouTrack
- CVE-2024-38505 Information disclosure in YouTrack
- CVE-2024-38504 Missing authorization in YouTrack
- CVE-2024-38503 Apache Syncope: HTML tags can be injected into Console or Enduser text fields
- CVE-2024-38502 Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows stored XSS
- CVE-2024-38501 Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection
- CVE-2024-3850 Uniview NVR301-04S2-P4 Cross-site Scripting
- CVE-2024-38499 Improper Privilege Management Vulnerability in CA Client Automation 14.5
- CVE-2024-38496 Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability
- CVE-2024-38495 Symantec Privileged Access Manager User Enumeration vulnerability
- CVE-2024-38494 Symantec Privileged Access Manager Remote Command Execution vulnerability
- CVE-2024-38493 Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerability
- CVE-2024-38492 Symantec Privileged Access Manager Remote Command Execution vulnerability
- CVE-2024-38491 Symantec Privileged Access Manager SQL Injection vulnerability
- CVE-2024-38490 Memory corruption in iDRAC Service Module (iSM)
- CVE-2024-3849 Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-38489 Memory corruption in iDRAC Service Module (iSM)
- CVE-2024-38488 Auth bypass in RecoverPoint for Virtual Machines
- CVE-2024-38487 Privilege escalation in EMC VxRail Appliance
- CVE-2024-38486 Command injection in SmartFabric OS10 Software