# Vulnerabilities published in 2024


- [CVE-2024-36919](https://insights.sbomify.com/CVE-2024-36919/): scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (medium 5.5)
- [CVE-2024-36918](https://insights.sbomify.com/CVE-2024-36918/): bpf: Check bloom filter map value size (high 7.8)
- [CVE-2024-36917](https://insights.sbomify.com/CVE-2024-36917/): block: fix overflow in blk_ioctl_discard() (medium 5.5)
- [CVE-2024-36916](https://insights.sbomify.com/CVE-2024-36916/): blk-iocost: avoid out of bounds shift (medium 6.5)
- [CVE-2024-36915](https://insights.sbomify.com/CVE-2024-36915/): nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (high 7.1)
- [CVE-2024-36914](https://insights.sbomify.com/CVE-2024-36914/): drm/amd/display: Skip on writeback when it's not applicable (high 7.8)
- [CVE-2024-36913](https://insights.sbomify.com/CVE-2024-36913/): Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (critical 9.3)
- [CVE-2024-36912](https://insights.sbomify.com/CVE-2024-36912/): Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (critical 9.6)
- [CVE-2024-36911](https://insights.sbomify.com/CVE-2024-36911/): hv_netvsc: Don't free decrypted memory (critical 9.8)
- [CVE-2024-36910](https://insights.sbomify.com/CVE-2024-36910/): uio_hv_generic: Don't free decrypted memory (high 8.4)
- [CVE-2024-3691](https://insights.sbomify.com/CVE-2024-3691/): PHPGurukul Small CRM Registration Page sql injection (high 7.3)
- [CVE-2024-36909](https://insights.sbomify.com/CVE-2024-36909/): Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted (critical 9.3)
- [CVE-2024-36908](https://insights.sbomify.com/CVE-2024-36908/): blk-iocost: do not WARN if iocg was already offlined (high 7.1)
- [CVE-2024-36906](https://insights.sbomify.com/CVE-2024-36906/): ARM: 9381/1: kasan: clear stale stack poison (high 7.8)
- [CVE-2024-36905](https://insights.sbomify.com/CVE-2024-36905/): tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (medium 5.5)
- [CVE-2024-36904](https://insights.sbomify.com/CVE-2024-36904/): tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (high 7.8)
- [CVE-2024-36903](https://insights.sbomify.com/CVE-2024-36903/): ipv6: Fix potential uninit-value access in __ip6_make_skb() (medium 5.5)
- [CVE-2024-36902](https://insights.sbomify.com/CVE-2024-36902/): ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (medium 5.5)
- [CVE-2024-36901](https://insights.sbomify.com/CVE-2024-36901/): ipv6: prevent NULL dereference in ip6_output() (medium 5.5)
- [CVE-2024-36900](https://insights.sbomify.com/CVE-2024-36900/): net: hns3: fix kernel crash when devlink reload during initialization (medium 5.5)
- [CVE-2024-3690](https://insights.sbomify.com/CVE-2024-3690/): PHPGurukul Small CRM Change Password sql injection (medium 6.3)
- [CVE-2024-36899](https://insights.sbomify.com/CVE-2024-36899/): gpiolib: cdev: Fix use after free in lineinfo_changed_notify (high 7.0)
- [CVE-2024-36898](https://insights.sbomify.com/CVE-2024-36898/): gpiolib: cdev: fix uninitialised kfifo (high 7.1)
- [CVE-2024-36897](https://insights.sbomify.com/CVE-2024-36897/): drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (medium 5.5)
- [CVE-2024-36896](https://insights.sbomify.com/CVE-2024-36896/): USB: core: Fix access violation during port device removal (critical 9.1)
- [CVE-2024-36895](https://insights.sbomify.com/CVE-2024-36895/): usb: gadget: uvc: use correct buffer size when parsing configfs lists (high 7.8)
- [CVE-2024-36894](https://insights.sbomify.com/CVE-2024-36894/): usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (high 7.8)
- [CVE-2024-36893](https://insights.sbomify.com/CVE-2024-36893/): usb: typec: tcpm: Check for port partner validity before consuming it (medium 5.5)
- [CVE-2024-36892](https://insights.sbomify.com/CVE-2024-36892/): mm/slub: avoid zeroing outside-object freepointer for single free (medium 5.5)
- [CVE-2024-36891](https://insights.sbomify.com/CVE-2024-36891/): maple_tree: fix mas_empty_area_rev() null pointer dereference (medium 5.5)
- [CVE-2024-36890](https://insights.sbomify.com/CVE-2024-36890/): mm/slab: make __free(kfree) accept error pointers (high 7.8)
- [CVE-2024-3689](https://insights.sbomify.com/CVE-2024-3689/): Zhejiang Land Zongheng Network Technology O2OA information disclosure (low 3.7)
- [CVE-2024-36889](https://insights.sbomify.com/CVE-2024-36889/): mptcp: ensure snd_nxt is properly initialized on connect (medium 5.5)
- [CVE-2024-36888](https://insights.sbomify.com/CVE-2024-36888/): workqueue: Fix selection of wake_cpu in kick_pool() (medium 6.2)
- [CVE-2024-36887](https://insights.sbomify.com/CVE-2024-36887/): e1000e: change usleep_range to udelay in PHY mdic access (medium 5.5)
- [CVE-2024-36886](https://insights.sbomify.com/CVE-2024-36886/): tipc: fix UAF in error path (critical 9.8)
- [CVE-2024-36884](https://insights.sbomify.com/CVE-2024-36884/): iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault() (high 7.8)
- [CVE-2024-36883](https://insights.sbomify.com/CVE-2024-36883/): net: fix out-of-bounds access in ops_init (high 7.8)
- [CVE-2024-36882](https://insights.sbomify.com/CVE-2024-36882/): mm: use memalloc_nofs_save() in page_cache_ra_order() (medium 5.5)
- [CVE-2024-36881](https://insights.sbomify.com/CVE-2024-36881/): mm/userfaultfd: reset ptes when close() for wr-protected ones (medium 5.5)
- [CVE-2024-36880](https://insights.sbomify.com/CVE-2024-36880/): Bluetooth: qca: add missing firmware sanity checks (high 7.8)
- [CVE-2024-3688](https://insights.sbomify.com/CVE-2024-3688/): Xiamen Four-Faith RMP Router Management Platform sql injection (medium 6.3)
- [CVE-2024-36877](https://insights.sbomify.com/CVE-2024-36877/): Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7 (high 8.2)
- [CVE-2024-3687](https://insights.sbomify.com/CVE-2024-3687/): bihell Dice Comment cross site scripting (low 3.5)
- [CVE-2024-3686](https://insights.sbomify.com/CVE-2024-3686/): DedeCMS update_guide.php path traversal (medium 4.3)
- [CVE-2024-36858](https://insights.sbomify.com/CVE-2024-36858/): Jan path traversal vulnerability (critical 9.8)
- [CVE-2024-36857](https://insights.sbomify.com/CVE-2024-36857/): Jan path traversal vulnerability (high 7.5)
- [CVE-2024-36856](https://insights.sbomify.com/CVE-2024-36856/): RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. (high 7.5)
- [CVE-2024-3685](https://insights.sbomify.com/CVE-2024-3685/): DedeCMS stepselect_main.php sql injection (medium 6.3)
- [CVE-2024-36845](https://insights.sbomify.com/CVE-2024-36845/): Denial of service in libmodbus:libmodbus (medium 4.3)
- [CVE-2024-36844](https://insights.sbomify.com/CVE-2024-36844/): Use after free in libmodbus:libmodbus (high 7.5)
- [CVE-2024-36843](https://insights.sbomify.com/CVE-2024-36843/): Memory corruption in libmodbus:libmodbus (high 7.5)
- [CVE-2024-36842](https://insights.sbomify.com/CVE-2024-36842/): An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Numbe (high 7.3)
- [CVE-2024-36840](https://insights.sbomify.com/CVE-2024-36840/): SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive (critical 9.1)
- [CVE-2024-3684](https://insights.sbomify.com/CVE-2024-3684/): Server-side request forgery in Enterprise Server (high 8.0)
- [CVE-2024-36837](https://insights.sbomify.com/CVE-2024-36837/): SQL injection in crmeb:crmeb (medium 5.4)
- [CVE-2024-36832](https://insights.sbomify.com/CVE-2024-36832/): Null dereference in dlink:dap-1513 firmware (high 7.5)
- [CVE-2024-36831](https://insights.sbomify.com/CVE-2024-36831/): Null dereference in dlink:dap-1520 firmware (medium 5.3)
- [CVE-2024-36829](https://insights.sbomify.com/CVE-2024-36829/): Information disclosure in teldat:m1 firmware (high 7.5)
- [CVE-2024-36827](https://insights.sbomify.com/CVE-2024-36827/): ebookmeta XML External Entity vulnerability (high 7.5)
- [CVE-2024-36823](https://insights.sbomify.com/CVE-2024-36823/): Weak encryption in Ninja Core (high 7.5)
- [CVE-2024-36821](https://insights.sbomify.com/CVE-2024-36821/): Privilege escalation in linksys:velop whw0101 firmware (high 8.8)
- [CVE-2024-3682](https://insights.sbomify.com/CVE-2024-3682/): WP STAGING <= 3.4.3 and WP STAGING Pro <= 5.4.3 - Sensitive Information Exposure via Log File (medium 5.3)
- [CVE-2024-36819](https://insights.sbomify.com/CVE-2024-36819/): Cross-site scripting in mapos:map-os (medium 5.4)
- [CVE-2024-36814](https://insights.sbomify.com/CVE-2024-36814/): Adguard Home arbitrary file read vulnerability (medium 4.9)
- [CVE-2024-3681](https://insights.sbomify.com/CVE-2024-3681/): Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-36801](https://insights.sbomify.com/CVE-2024-36801/): SQL injection in sem-cms:semcms (medium 5.9)
- [CVE-2024-36800](https://insights.sbomify.com/CVE-2024-36800/): SQL injection in sem-cms:semcms (high 7.5)
- [CVE-2024-3680](https://insights.sbomify.com/CVE-2024-3680/): Cross-site scripting in Enter Addons – Ultimate Template Builder for Elementor (medium 6.4)
- [CVE-2024-36795](https://insights.sbomify.com/CVE-2024-36795/): Path traversal in netgear:wnr614 firmware (medium 4.0)
- [CVE-2024-36792](https://insights.sbomify.com/CVE-2024-36792/): Information disclosure in netgear:wnr614 firmware (high 8.2)
- [CVE-2024-36790](https://insights.sbomify.com/CVE-2024-36790/): Information disclosure in netgear:wnr614 firmware (high 8.8)
- [CVE-2024-3679](https://insights.sbomify.com/CVE-2024-3679/): Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure (medium 5.3)
- [CVE-2024-36789](https://insights.sbomify.com/CVE-2024-36789/): Weak cryptography in netgear:wnr614 firmware (high 8.1)
- [CVE-2024-36788](https://insights.sbomify.com/CVE-2024-36788/): Misconfiguration in netgear:wnr614 firmware (medium 5.9)
- [CVE-2024-36787](https://insights.sbomify.com/CVE-2024-36787/): Auth bypass in netgear:wnr614 firmware (high 8.8)
- [CVE-2024-36783](https://insights.sbomify.com/CVE-2024-36783/): Command injection in totolink:lr350 firmware (critical 9.8)
- [CVE-2024-36782](https://insights.sbomify.com/CVE-2024-36782/): Hardcoded credentials in totolink:cp300 firmware (critical 9.8)
- [CVE-2024-3678](https://insights.sbomify.com/CVE-2024-3678/): Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure (medium 5.3)
- [CVE-2024-36779](https://insights.sbomify.com/CVE-2024-36779/): SQL injection in stock management system project:stock management system (critical 9.8)
- [CVE-2024-36775](https://insights.sbomify.com/CVE-2024-36775/): Cross-site scripting in monstra:monstra (medium 4.7)
- [CVE-2024-36774](https://insights.sbomify.com/CVE-2024-36774/): File upload in monstra:monstra (high 8.0)
- [CVE-2024-36773](https://insights.sbomify.com/CVE-2024-36773/): Cross-site scripting in monstra:monstra (medium 4.8)
- [CVE-2024-3677](https://insights.sbomify.com/CVE-2024-3677/): Ultimate 410 Gone Status Code <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-36761](https://insights.sbomify.com/CVE-2024-36761/): Memory corruption in gfx-rs:naga (critical 9.8)
- [CVE-2024-36760](https://insights.sbomify.com/CVE-2024-36760/): Rhai stack overflow vulenrability (high 7.5)
- [CVE-2024-3676](https://insights.sbomify.com/CVE-2024-3676/): Business logic in Enterprise Protection (high 7.5)
- [CVE-2024-36755](https://insights.sbomify.com/CVE-2024-36755/): Security feature bypass in dlink:dir-1950 firmware (medium 6.8)
- [CVE-2024-36751](https://insights.sbomify.com/CVE-2024-36751/): parse-uri Regular expression Denial of Service (ReDoS) (medium 6.5)
- [CVE-2024-3675](https://insights.sbomify.com/CVE-2024-3675/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-36745](https://insights.sbomify.com/CVE-2024-36745/): Denial of service in oneflow:oneflow (high 7.5)
- [CVE-2024-36743](https://insights.sbomify.com/CVE-2024-36743/): Denial of service in oneflow:oneflow (high 7.5)
- [CVE-2024-36742](https://insights.sbomify.com/CVE-2024-36742/): Denial of service in oneflow:oneflow (high 7.5)
- [CVE-2024-36740](https://insights.sbomify.com/CVE-2024-36740/): Denial of service in oneflow:oneflow (high 7.5)
- [CVE-2024-3674](https://insights.sbomify.com/CVE-2024-3674/): Inline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-36737](https://insights.sbomify.com/CVE-2024-36737/): Denial of service in oneflow:oneflow (high 7.5)
- [CVE-2024-36736](https://insights.sbomify.com/CVE-2024-36736/): Other in oneflow:oneflow (critical 9.8)
- [CVE-2024-36735](https://insights.sbomify.com/CVE-2024-36735/): Other in oneflow:oneflow (medium 5.3)
- [CVE-2024-36734](https://insights.sbomify.com/CVE-2024-36734/): Denial of service in oneflow:oneflow (high 7.5)
- [CVE-2024-36732](https://insights.sbomify.com/CVE-2024-36732/): Denial of service in oneflow:oneflow (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/335/