Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 409 of 521.
- CVE-2024-27138 Apache Archiva: disabling user registration is not effective
- CVE-2024-27137 Apache Cassandra: unrestricted deserialization of JMX authentication credentials
- CVE-2024-27136 Apache JSPWiki: Cross-site scripting vulnerability on upload page
- CVE-2024-27135 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution
- CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
- CVE-2024-27133 Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.
- CVE-2024-27132 Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.
- CVE-2024-27130 QTS, QuTS hero
- CVE-2024-2713 Campcodes Complete Online DJ Booking System booking-search.php sql injection
- CVE-2024-27129 QTS, QuTS hero
- CVE-2024-27128 QTS, QuTS hero
- CVE-2024-27127 QTS, QuTS hero
- CVE-2024-27126 Notes Station 3
- CVE-2024-27125 Helpdesk
- CVE-2024-27124 QTS, QuTS hero, QuTScloud
- CVE-2024-27123 QcalAgent
- CVE-2024-27122 Notes Station 3
- CVE-2024-27121 Path traversal in Machine Automation Controller NJ Series
- CVE-2024-27120 Local File Inclusion in ComfortKey before version 24.1.2
- CVE-2024-2712 Campcodes Complete Online DJ Booking System user-search.php sql injection
- CVE-2024-27115 Remote Code Execution through File Upload in SOPlanning before 1.52.02
- CVE-2024-27114 Remote Code Execution through File Upload in SOPlanning before 1.52.02
- CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02
- CVE-2024-27112 SQL Injection in SOPlanning before 1.52.02
- CVE-2024-27110 Elevation of privilege vulnerability in GE HealthCare EchoPAC products
- CVE-2024-2711 Tenda AC10U addWifiMacFilter stack-based overflow
- CVE-2024-27109 Insufficiently protected credentials in GE HealthCare EchoPAC products
- CVE-2024-27108 Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
- CVE-2024-27107 Weak account password in GE HealthCare EchoPAC products
- CVE-2024-27106 Vulnerable data in transit in GE HealthCare EchoPAC products
- CVE-2024-27105 Frappe File Permissions can by bypassed using certain endpoints
- CVE-2024-27104 Stored XSS in dashboards in GLPI
- CVE-2024-27103 Querybook Stored Cross-Site Scripting allows Privilege Elevation
- CVE-2024-27102 Improper isolation of server file access in github.com/pterodactyl/wings
- CVE-2024-27101 Integer overflow in chunking helper causes dispatching to miss elements or panic
- CVE-2024-27100 Denial of service via Staff Actions in Discourse
- CVE-2024-2710 Tenda AC10U openSchedWifi setSchedWifi stack-based overflow
- CVE-2024-27099 Azure IoT Platform Device SDK Double Free Vulnerability
- CVE-2024-27098 Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI
- CVE-2024-27097 Potential log injection in reset user endpoint in ckan
- CVE-2024-27096 SQL Injection in through the search engine
- CVE-2024-27095 Decidim cross-site scripting (XSS) in the admin panel
- CVE-2024-27094 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
- CVE-2024-27093 Minder trusts client-provided mapping from repo name to upstream ID
- CVE-2024-27092 Content spoofing - real Hoppscotch emails
- CVE-2024-27091 GeoNode stored XSS to full account takeover
- CVE-2024-27090 Decidim vulnerable to data disclosure through the embed feature
- CVE-2024-2709 Tenda AC10U SetStaticRouteCfg fromSetRouteStatic stack-based overflow
- CVE-2024-27088 es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`
- CVE-2024-27087 Kirby cross-site scripting (XSS) in the link field "Custom" type
- CVE-2024-27086 MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service
- CVE-2024-27085 Denial of service through invites in Discourse
- CVE-2024-27083 Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
- CVE-2024-27082 Cacti Cross-site Scripting vulnerability when managing trees
- CVE-2024-27081 ESPHome remote code execution via arbitrary file write
- CVE-2024-27080 btrfs: fix race when detecting delalloc ranges during fiemap
- CVE-2024-2708 Tenda AC10U execCommand formexeCommand stack-based overflow
- CVE-2024-27079 iommu/vt-d: Fix NULL domain on device release
- CVE-2024-27078 media: v4l2-tpg: fix some memleaks in tpg_alloc
- CVE-2024-27077 media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
- CVE-2024-27076 media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
- CVE-2024-27075 media: dvb-frontends: avoid stack overflow warnings with clang
- CVE-2024-27074 media: go7007: fix a memleak in go7007_load_encoder
- CVE-2024-27073 media: ttpci: fix two memleaks in budget_av_attach
- CVE-2024-27072 media: usbtv: Remove useless locks in usbtv_video_free()
- CVE-2024-27071 backlight: hx8357: Fix potential NULL pointer dereference
- CVE-2024-27070 f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
- CVE-2024-2707 Tenda AC10U WriteFacMac formWriteFacMac os command injection
- CVE-2024-27069 ovl: relax WARN_ON in ovl_verify_area()
- CVE-2024-27068 thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path
- CVE-2024-27067 xen/evtchn: avoid WARN() when unbinding an event channel
- CVE-2024-27066 virtio: packed: fix unmap leak for indirect desc table
- CVE-2024-27065 netfilter: nf_tables: do not compare internal table flags on updates
- CVE-2024-27064 netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
- CVE-2024-27063 leds: trigger: netdev: Fix kernel panic on interface rename trig notify
- CVE-2024-27062 nouveau: lock the client object tree.
- CVE-2024-27061 crypto: sun8i-ce - Fix use after free in unprepare
- CVE-2024-27060 thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()
- CVE-2024-2706 Tenda AC10U WifiWpsStart formWifiWpsStart stack-based overflow
- CVE-2024-27059 USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
- CVE-2024-27058 tmpfs: fix race on handling dquot rbtree
- CVE-2024-27057 ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend
- CVE-2024-27056 wifi: iwlwifi: mvm: ensure offloading TID queue exists
- CVE-2024-27054 s390/dasd: fix double module refcount decrement
- CVE-2024-27053 wifi: wilc1000: fix RCU usage in connect path
- CVE-2024-27052 wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
- CVE-2024-27051 cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
- CVE-2024-27050 libbpf: Use OPTS_SET() macro in bpf_xdp_query()
- CVE-2024-2705 Tenda AC10U SetNetControlList formSetQosBand stack-based overflow
- CVE-2024-27049 wifi: mt76: mt7925e: fix use-after-free in free_irq()
- CVE-2024-27048 wifi: brcm80211: handle pmk_op allocation failure
- CVE-2024-27047 net: phy: fix phy_get_internal_delay accessing an empty array
- CVE-2024-27046 nfp: flower: handle acti_netdevs allocation failure
- CVE-2024-27045 drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
- CVE-2024-27044 drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
- CVE-2024-27043 media: edia: dvbdev: fix a use-after-free
- CVE-2024-27041 drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
- CVE-2024-27040 drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
- CVE-2024-2704 Tenda AC10U SetFirewallCfg formSetFirewallCfg stack-based overflow
- CVE-2024-27039 clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()