Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 335 of 521.
- CVE-2024-36919 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
- CVE-2024-36918 bpf: Check bloom filter map value size
- CVE-2024-36917 block: fix overflow in blk_ioctl_discard()
- CVE-2024-36916 blk-iocost: avoid out of bounds shift
- CVE-2024-36915 nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
- CVE-2024-36914 drm/amd/display: Skip on writeback when it's not applicable
- CVE-2024-36913 Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
- CVE-2024-36912 Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
- CVE-2024-36911 hv_netvsc: Don't free decrypted memory
- CVE-2024-36910 uio_hv_generic: Don't free decrypted memory
- CVE-2024-3691 PHPGurukul Small CRM Registration Page sql injection
- CVE-2024-36909 Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
- CVE-2024-36908 blk-iocost: do not WARN if iocg was already offlined
- CVE-2024-36906 ARM: 9381/1: kasan: clear stale stack poison
- CVE-2024-36905 tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
- CVE-2024-36904 tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
- CVE-2024-36903 ipv6: Fix potential uninit-value access in __ip6_make_skb()
- CVE-2024-36902 ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
- CVE-2024-36901 ipv6: prevent NULL dereference in ip6_output()
- CVE-2024-36900 net: hns3: fix kernel crash when devlink reload during initialization
- CVE-2024-3690 PHPGurukul Small CRM Change Password sql injection
- CVE-2024-36899 gpiolib: cdev: Fix use after free in lineinfo_changed_notify
- CVE-2024-36898 gpiolib: cdev: fix uninitialised kfifo
- CVE-2024-36897 drm/amd/display: Atom Integrated System Info v2_2 for DCN35
- CVE-2024-36896 USB: core: Fix access violation during port device removal
- CVE-2024-36895 usb: gadget: uvc: use correct buffer size when parsing configfs lists
- CVE-2024-36894 usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
- CVE-2024-36893 usb: typec: tcpm: Check for port partner validity before consuming it
- CVE-2024-36892 mm/slub: avoid zeroing outside-object freepointer for single free
- CVE-2024-36891 maple_tree: fix mas_empty_area_rev() null pointer dereference
- CVE-2024-36890 mm/slab: make __free(kfree) accept error pointers
- CVE-2024-3689 Zhejiang Land Zongheng Network Technology O2OA information disclosure
- CVE-2024-36889 mptcp: ensure snd_nxt is properly initialized on connect
- CVE-2024-36888 workqueue: Fix selection of wake_cpu in kick_pool()
- CVE-2024-36887 e1000e: change usleep_range to udelay in PHY mdic access
- CVE-2024-36886 tipc: fix UAF in error path
- CVE-2024-36884 iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()
- CVE-2024-36883 net: fix out-of-bounds access in ops_init
- CVE-2024-36882 mm: use memalloc_nofs_save() in page_cache_ra_order()
- CVE-2024-36881 mm/userfaultfd: reset ptes when close() for wr-protected ones
- CVE-2024-36880 Bluetooth: qca: add missing firmware sanity checks
- CVE-2024-3688 Xiamen Four-Faith RMP Router Management Platform sql injection
- CVE-2024-36877 Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7
- CVE-2024-3687 bihell Dice Comment cross site scripting
- CVE-2024-3686 DedeCMS update_guide.php path traversal
- CVE-2024-36858 Jan path traversal vulnerability
- CVE-2024-36857 Jan path traversal vulnerability
- CVE-2024-36856 RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management.
- CVE-2024-3685 DedeCMS stepselect_main.php sql injection
- CVE-2024-36845 Denial of service in libmodbus:libmodbus
- CVE-2024-36844 Use after free in libmodbus:libmodbus
- CVE-2024-36843 Memory corruption in libmodbus:libmodbus
- CVE-2024-36842 An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Numbe
- CVE-2024-36840 SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive
- CVE-2024-3684 Server-side request forgery in Enterprise Server
- CVE-2024-36837 SQL injection in crmeb:crmeb
- CVE-2024-36832 Null dereference in dlink:dap-1513 firmware
- CVE-2024-36831 Null dereference in dlink:dap-1520 firmware
- CVE-2024-36829 Information disclosure in teldat:m1 firmware
- CVE-2024-36827 ebookmeta XML External Entity vulnerability
- CVE-2024-36823 Weak encryption in Ninja Core
- CVE-2024-36821 Privilege escalation in linksys:velop whw0101 firmware
- CVE-2024-3682 WP STAGING <= 3.4.3 and WP STAGING Pro <= 5.4.3 - Sensitive Information Exposure via Log File
- CVE-2024-36819 Cross-site scripting in mapos:map-os
- CVE-2024-36814 Adguard Home arbitrary file read vulnerability
- CVE-2024-3681 Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scripting
- CVE-2024-36801 SQL injection in sem-cms:semcms
- CVE-2024-36800 SQL injection in sem-cms:semcms
- CVE-2024-3680 Cross-site scripting in Enter Addons – Ultimate Template Builder for Elementor
- CVE-2024-36795 Path traversal in netgear:wnr614 firmware
- CVE-2024-36792 Information disclosure in netgear:wnr614 firmware
- CVE-2024-36790 Information disclosure in netgear:wnr614 firmware
- CVE-2024-3679 Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure
- CVE-2024-36789 Weak cryptography in netgear:wnr614 firmware
- CVE-2024-36788 Misconfiguration in netgear:wnr614 firmware
- CVE-2024-36787 Auth bypass in netgear:wnr614 firmware
- CVE-2024-36783 Command injection in totolink:lr350 firmware
- CVE-2024-36782 Hardcoded credentials in totolink:cp300 firmware
- CVE-2024-3678 Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure
- CVE-2024-36779 SQL injection in stock management system project:stock management system
- CVE-2024-36775 Cross-site scripting in monstra:monstra
- CVE-2024-36774 File upload in monstra:monstra
- CVE-2024-36773 Cross-site scripting in monstra:monstra
- CVE-2024-3677 Ultimate 410 Gone Status Code <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-36761 Memory corruption in gfx-rs:naga
- CVE-2024-36760 Rhai stack overflow vulenrability
- CVE-2024-3676 Business logic in Enterprise Protection
- CVE-2024-36755 Security feature bypass in dlink:dir-1950 firmware
- CVE-2024-36751 parse-uri Regular expression Denial of Service (ReDoS)
- CVE-2024-3675 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-36745 Denial of service in oneflow:oneflow
- CVE-2024-36743 Denial of service in oneflow:oneflow
- CVE-2024-36742 Denial of service in oneflow:oneflow
- CVE-2024-36740 Denial of service in oneflow:oneflow
- CVE-2024-3674 Inline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-36737 Denial of service in oneflow:oneflow
- CVE-2024-36736 Other in oneflow:oneflow
- CVE-2024-36735 Other in oneflow:oneflow
- CVE-2024-36734 Denial of service in oneflow:oneflow
- CVE-2024-36732 Denial of service in oneflow:oneflow