Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 334 of 521.
- CVE-2024-37020 Denial of service in Intel(R) Xeon(R) Processors
- CVE-2024-37019 Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication.
- CVE-2024-37018 The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.
- CVE-2024-37017 asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h__Reader::MD_to_TimedText_TDesc in AS_DC
- CVE-2024-37016 Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach.
- CVE-2024-37015 An issue was discovered in Ada Web Server 20.0.
- CVE-2024-37014 Langflow remote code execution vulnerability
- CVE-2024-3701 Improper Authentication in com.transsion.kolun.aiservice
- CVE-2024-37008 Stack-based Overflow Vulnerability in Revit Software
- CVE-2024-37007 Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products
- CVE-2024-37006 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
- CVE-2024-37005 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
- CVE-2024-37004 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
- CVE-2024-37003 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
- CVE-2024-37002 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
- CVE-2024-37001 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
- CVE-2024-37000 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
- CVE-2024-3700 Hardcoded password in Estomed Sp. z o.o. Simple Care software
- CVE-2024-36999 Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products
- CVE-2024-36997 Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint
- CVE-2024-36996 Information Disclosure of user names
- CVE-2024-36995 Low-privileged user could create experimental items
- CVE-2024-36994 Persistent Cross-site Scripting (XSS) in Dashboard Elements
- CVE-2024-36993 Persistent Cross-site Scripting (XSS) in Web Bulletin
- CVE-2024-36992 Persistent Cross-site Scripting (XSS) in Dashboard Elements
- CVE-2024-36991 Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows
- CVE-2024-36990 Denial of Service (DoS) on the datamodel/web REST endpoint
- CVE-2024-3699 Hardcoded password in drEryk Gabinet
- CVE-2024-36989 Low-privileged user could create notifications in Splunk Web Bulletin Messages
- CVE-2024-36987 Insecure File Upload in the indexing/preview REST endpoint
- CVE-2024-36986 Risky command safeguards bypass through Search ID query in Analytics Workspace
- CVE-2024-36985 Code injection in Splunk Enterprise
- CVE-2024-36984 Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows
- CVE-2024-36983 Command Injection using External Lookups
- CVE-2024-36982 Denial of Service through null pointer reference in “cluster/config” REST endpoint
- CVE-2024-36981 Memory corruption in OpenPLC v3
- CVE-2024-36980 Memory corruption in OpenPLC v3
- CVE-2024-3698 Campcodes House Rental Management System manage_payment.php sql injection
- CVE-2024-36979 net: bridge: mst: fix vlan use-after-free
- CVE-2024-36978 net: sched: sch_multiq: fix possible OOB write in multiq_tune()
- CVE-2024-36977 usb: dwc3: Wait unconditionally after issuing EndXfer command
- CVE-2024-36976 Revert "media: v4l2-ctrls: show all owned controls in log_status"
- CVE-2024-36975 KEYS: trusted: Do not use WARN when encode fails
- CVE-2024-36974 net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
- CVE-2024-36973 misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()
- CVE-2024-36972 af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
- CVE-2024-36971 Android Kernel Remote Code Execution
- CVE-2024-36970 wifi: iwlwifi: Use request_module_nowait
- CVE-2024-3697 Campcodes House Rental Management System manage_tenant.php sql injection
- CVE-2024-36969 drm/amd/display: Fix division by zero in setup_dsc_config
- CVE-2024-36968 Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
- CVE-2024-36967 KEYS: trusted: Fix memory leak in tpm2_key_encode()
- CVE-2024-36966 erofs: reliably distinguish block based and fscache mode
- CVE-2024-36965 remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
- CVE-2024-36964 fs/9p: only translate RWX permissions for plain 9P2000
- CVE-2024-36963 tracefs: Reset permissions on remount if permissions are options
- CVE-2024-36962 net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
- CVE-2024-36961 thermal/debugfs: Fix two locking issues with thermal zone debug
- CVE-2024-36960 drm/vmwgfx: Fix invalid reads in fence signaled events
- CVE-2024-3696 Campcodes House Rental Management System view_payment.php sql injection
- CVE-2024-36959 pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
- CVE-2024-36958 NFSD: Fix nfsd4_encode_fattr4() crasher
- CVE-2024-36957 octeontx2-af: avoid off-by-one read from userspace
- CVE-2024-36956 thermal/debugfs: Free all thermal zone debug memory on zone removal
- CVE-2024-36955 ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
- CVE-2024-36954 tipc: fix a possible memleak in tipc_buf_append
- CVE-2024-36953 KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
- CVE-2024-36952 scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
- CVE-2024-36951 drm/amdkfd: range check cp bad op exception interrupts
- CVE-2024-36950 firewire: ohci: mask bus reset interrupts between ISR and bottom half
- CVE-2024-3695 SourceCodester Computer Laboratory Management System Users.php cross site scripting
- CVE-2024-36949 amd/amdkfd: sync all devices to wait all processes being evicted
- CVE-2024-36948 drm/xe/xe_migrate: Cast to output precision before multiplying operands
- CVE-2024-36947 qibfs: fix dentry leak
- CVE-2024-36946 phonet: fix rtm_phonet_notify() skb allocation
- CVE-2024-36945 net/smc: fix neighbour and rtable leak in smc_ib_find_route()
- CVE-2024-36944 Reapply "drm/qxl: simplify qxl_fence_wait"
- CVE-2024-36943 fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan
- CVE-2024-36941 wifi: nl80211: don't free NULL coalescing rule
- CVE-2024-36940 pinctrl: core: delete incorrect free in pinctrl_enable()
- CVE-2024-36939 nfs: Handle error of rpc_proc_register() in nfs_net_init().
- CVE-2024-36938 bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
- CVE-2024-36937 xdp: use flags field to disambiguate broadcast redirect
- CVE-2024-36936 efi/unaccepted: touch soft lockup during memory accept
- CVE-2024-36935 ice: ensure the copied buf is NUL terminated
- CVE-2024-36934 bna: ensure the copied buf is NUL terminated
- CVE-2024-36933 nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
- CVE-2024-36932 thermal/debugfs: Prevent use-after-free from occurring after cdev removal
- CVE-2024-36931 s390/cio: Ensure the copied buf is NUL terminated
- CVE-2024-36930 spi: fix null pointer dereference within spi_sync
- CVE-2024-36929 net: core: reject skb_copy(_expand) for fraglist GSO skbs
- CVE-2024-36928 s390/qeth: Fix kernel panic after setting hsuid
- CVE-2024-36927 ipv4: Fix uninit-value access in __ip_make_skb()
- CVE-2024-36926 powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE
- CVE-2024-36925 swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=y
- CVE-2024-36924 scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
- CVE-2024-36922 wifi: iwlwifi: read txq->read_ptr under lock
- CVE-2024-36921 wifi: iwlwifi: mvm: guard against invalid STA ID on removal
- CVE-2024-36920 scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
- CVE-2024-3692 Gutenverse < 1.9.1 - Contributor+ Stored XSS