CVEs published May 1, 2024
253 CVEs were published on May 1, 2024: 16 critical, 90 high.
- Published
- 253
- Critical
- 16
- High
- 90
- Medium
- 62
- Low
- 1
- Unrated
- 84
- Now in CISA KEV
- 0
- Fix available
- 76
Most affected products
- Linux
- 159
- Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- 10
- Google Chrome
- 5
- lunasvg
- 5
- Cisco IP Phones with Multiplatform Firmware · Cisco PhoneOS
- 3
- RIOT-OS RIOT
- 3
- Dell OpenManage Enterprise
- 2
- IBM WebSphere Automation
- 2
- mybb
- 2
- SonicWall GMS
- 2
Critical 16
- CVE-2024-4142JFrog Artifactory Improper input validation within token creation flowJFrog Artifactory
- CVE-2023-47212A heap-based buffer overflow vulnerability exists in the comment functionality of stb _vorbis.c v1.22.stb_vorbis.c
- CVE-2023-49606A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0.Tinyproxy
- CVE-2024-33512There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated remHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-33511There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code executHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-26305There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendinHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-26304There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code executionHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-27388SUNRPC: fix some memleaks in gssx_dec_option_arrayLinux
- CVE-2024-4058Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-32017Buffer overflows in RIOTRIOT-OS RIOT
- CVE-2024-26953net: esp: fix bad handling of pages from page_poolLinux
- CVE-2023-26793libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c.
- CVE-2023-46295An issue was discovered in Teledyne FLIR M300 2.00-19.
- CVE-2024-33078Tencent Libpag v4.3 is vulnerable to Buffer Overflow.
- CVE-2024-33768lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.lunasvg
- CVE-2024-33835Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the remoteIp parameter from formSetSafeWanWebMan function.
High 90
- CVE-2024-29011Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability.SonicWall GMS
- CVE-2024-29010The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the diSonicWall GMS
- CVE-2023-7241Webroot Antivirus COM-Hijacking LPEWebroot AntiVirus (Consumer) and Webroot Endpoint Protection
- CVE-2024-20376A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause anCisco IP Phones with Multiplatform Firmware · Cisco PhoneOS
- CVE-2024-20378A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieveCisco IP Phones with Multiplatform Firmware · Cisco PhoneOS
- CVE-2024-23480Insecure MacOS code sign check fallback Zscaler Client Connector
- CVE-2024-23457Anti-tampering can be disabled with uninstall password enforcedZscaler Client Connector
- CVE-2024-25015IBM MQ denial of serviceIBM MQ
- CVE-2024-28893Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been HP software packages
- CVE-2023-47166A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2.Milesight UR32L
- CVE-2024-27392nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()Linux
- CVE-2024-27389pstore: inode: Only d_invalidate() is neededLinux
- CVE-2024-27073media: ttpci: fix two memleaks in budget_av_attachLinux
- CVE-2024-27070f2fs: fix to avoid use-after-free issue in f2fs_filemap_faultLinux
- CVE-2024-27066virtio: packed: fix unmap leak for indirect desc tableLinux
- CVE-2024-27062nouveau: lock the client object tree.Linux
- CVE-2024-27061crypto: sun8i-ce - Fix use after free in unprepareLinux
- CVE-2024-27058tmpfs: fix race on handling dquot rbtreeLinux
- CVE-2024-27056wifi: iwlwifi: mvm: ensure offloading TID queue existsLinux
- CVE-2024-27053wifi: wilc1000: fix RCU usage in connect pathLinux
- CVE-2024-27052wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_workLinux
- CVE-2024-27050libbpf: Use OPTS_SET() macro in bpf_xdp_query()Linux
- CVE-2024-27045drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'Linux
- CVE-2024-27043media: edia: dvbdev: fix a use-after-freeLinux
- CVE-2024-27035f2fs: compress: fix to guarantee persisting compressed blocks by CPLinux
- CVE-2024-27034f2fs: compress: fix to cover normal cluster write with cp_rwsemLinux
- CVE-2024-27030octeontx2-af: Use separate handlers for interruptsLinux
- CVE-2024-27029drm/amdgpu: fix mmhub client id out-of-bounds accessLinux
- CVE-2024-31412Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver.OMRON CX-Programmer
- CVE-2024-4331Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2024-27026vmxnet3: Fix missing reserved tailroomLinux
- CVE-2024-4060Use after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2024-32979Reflected Cross-site Scripting potential in all object list views in Nautobotnautobot
- CVE-2024-32984Yamux Memory Exhaustion Vulnerability via Active::pending_frames property libp2p rust-yamux · yamux
- CVE-2024-32018Ineffective size check due to assert() and buffer overflow in RIOTRIOT-OS RIOT
- CVE-2024-31225Lack of size check and buffer overflow in RIOTRIOT-OS RIOT
- CVE-2024-27022fork: defer linking file vma until vma is fully initializedLinux
- CVE-2024-27020netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()Linux
- CVE-2024-27019netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()Linux
- CVE-2024-27018netfilter: br_netfilter: skip conntrack input hook for promisc packetsLinux
- CVE-2024-27017netfilter: nft_set_pipapo: walk over current view on netlink dumpLinux
- CVE-2024-27016netfilter: flowtable: validate pppoe headerLinux
- CVE-2024-27012netfilter: nf_tables: restore set elements when delete set failsLinux
- CVE-2024-27007userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVELinux
- CVE-2024-27005interconnect: Don't access req_list while it's being manipulatedLinux
- CVE-2024-26996usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport errorLinux
- CVE-2024-26994speakup: Avoid crash on very long wordLinux
- CVE-2024-26992KVM: x86/pmu: Disable support for adaptive PEBSLinux
- CVE-2024-26990KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty statusLinux
- CVE-2024-26983bootconfig: use memblock_free_late to free xbc memory to buddyLinux
- CVE-2024-26980ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_bufLinux
- CVE-2024-26936ksmbd: validate request buffer size in smb2_allocate_rsp_buf()Linux
- CVE-2024-26976KVM: Always flush async #PF workqueue when vCPU is being destroyedLinux
- CVE-2024-26974crypto: qat - resolve race condition during AER recoveryLinux
- CVE-2024-26971clk: qcom: gcc-ipq5018: fix terminating of frequency table arraysLinux
- CVE-2024-26969clk: qcom: gcc-ipq8074: fix terminating of frequency table arraysLinux
- CVE-2024-26968clk: qcom: gcc-ipq9574: fix terminating of frequency table arraysLinux
- CVE-2024-26967clk: qcom: camcc-sc8280xp: fix terminating of frequency table arraysLinux
- CVE-2024-26966clk: qcom: mmcc-apq8084: fix terminating of frequency table arraysLinux
- CVE-2024-26965clk: qcom: mmcc-msm8974: fix terminating of frequency table arraysLinux
- CVE-2024-26961mac802154: fix llsec key resources release in mac802154_llsec_key_delLinux
- CVE-2024-26960mm: swap: fix race between free_swap_and_cache() and swapoff()Linux
- CVE-2024-26958nfs: fix UAF in direct writesLinux
- CVE-2024-26957s390/zcrypt: fix reference counting on zcrypt card objectsLinux
- CVE-2024-26954ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()Linux
- CVE-2024-26952ksmbd: fix potencial out-of-bounds when buffer offset is invalidLinux
- CVE-2024-26951wireguard: netlink: check for dangling peer via is_dead instead of empty listLinux
- CVE-2024-26950wireguard: netlink: access device through ctx instead of peerLinux
- CVE-2024-26945crypto: iaa - Fix nr_cpus < nr_iaa caseLinux
- CVE-2024-26944btrfs: zoned: fix use-after-free in do_zone_finish()Linux
- CVE-2024-26939drm/i915/vma: Fix UAF on destroy against retire raceLinux
- CVE-2024-26932usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()Linux
- CVE-2024-26931scsi: qla2xxx: Fix command flush on cable pullLinux
- CVE-2024-26930scsi: qla2xxx: Fix double free of the ha->vp_map pointerLinux
- CVE-2024-24312SQL injection vulnerability in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Model
- CVE-2024-24313An issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and
- CVE-2024-25355s3-url-parser 1.0.3 is vulnerable to Denial of service via the regexes component.s3-url-parser
- CVE-2024-25458An issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM_48B_BC01_v87_0903 allows a remote
- CVE-2024-26504An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter.
- CVE-2024-32212SQL Injection vulnerability in LOGINT LoMag Inventory Management v1.0.20.120 and before allows an attacker to execute arbitrary code via the
- CVE-2024-33292SQL Injection vulnerability in Realisation MGSD v.1.0 allows a remote attacker to obtain sensitive information via the id parameter.
- CVE-2024-33300Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute
- CVE-2024-33306SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" parameter in Create User.
- CVE-2024-33423Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML vi
- CVE-2024-33428Buffer-Overflow vulnerability at conv.c:68 of stsaz phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .w
- CVE-2024-33429Buffer-Overflow vulnerability at pcm_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via a crafted .wav
- CVE-2024-33430An issue in phiola/src/afilter/pcm_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .w
- CVE-2024-33763lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.lunasvg
- CVE-2024-33775An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.
- CVE-2024-33820Totolink AC1200 Wireless Dual Band Gigabit Router A3002R_V4 Firmware V4.0.0-B20230531.1404 is vulnerable to Buffer Overflow via the formWlEn
Medium, low and unrated 147
- CVE-2023-51631D-Link DIR-X3260 prog.cgi SetUsersSettings Stack-based Buffer Overflow Remote Code Execution VulnerabilityD-Link DIR-X3260
- CVE-2024-20357A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an Cisco IP Phones with Multiplatform Firmware · Cisco PhoneOS
- CVE-2024-28764IBM WebSphere Automation CSV injectionIBM WebSphere Automation
- CVE-2024-33518An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-33517An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-33516An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-33515Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-33514Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-33513Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2024-24912Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL filecheckpoint Harmony Endpoint Security Client for Windows
- CVE-2024-24978Denial-of-service (DoS) vulnerability exists in TvRock 0.9t8a.TvRock
- CVE-2024-27391wifi: wilc1000: do not realloc workqueue everytime an interface is addedLinux
- CVE-2024-27390ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()Linux
- CVE-2024-27080btrfs: fix race when detecting delalloc ranges during fiemapLinux
- CVE-2024-27079iommu/vt-d: Fix NULL domain on device releaseLinux
- CVE-2024-27078media: v4l2-tpg: fix some memleaks in tpg_allocLinux
- CVE-2024-27077media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entityLinux
- CVE-2024-27076media: imx: csc/scaler: fix v4l2_ctrl_handler memory leakLinux
- CVE-2024-27075media: dvb-frontends: avoid stack overflow warnings with clangLinux
- CVE-2024-27074media: go7007: fix a memleak in go7007_load_encoderLinux
- CVE-2024-27072media: usbtv: Remove useless locks in usbtv_video_free()Linux
- CVE-2024-27071backlight: hx8357: Fix potential NULL pointer dereferenceLinux
- CVE-2024-27069ovl: relax WARN_ON in ovl_verify_area()Linux
- CVE-2024-27068thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling pathLinux
- CVE-2024-27067xen/evtchn: avoid WARN() when unbinding an event channelLinux
- CVE-2024-27065netfilter: nf_tables: do not compare internal table flags on updatesLinux
- CVE-2024-27064netfilter: nf_tables: Fix a memory leak in nf_tables_updchainLinux
- CVE-2023-52653SUNRPC: fix a memleak in gss_import_v2_contextLinux
- CVE-2023-52652NTB: fix possible name leak in ntb_register_device()Linux
- CVE-2022-48669powerpc/pseries: Fix potential memleak in papr_get_attr()Linux
- CVE-2024-27063leds: trigger: netdev: Fix kernel panic on interface rename trig notifyLinux
- CVE-2024-27060thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()Linux
- CVE-2024-27059USB: usb-storage: Prevent divide-by-0 error in isd200_ata_commandLinux
- CVE-2024-23597Cross-site request forgery (CSRF) vulnerability exists in TvRock 0.9t8a.TvRock
- CVE-2024-28775IBM WebSphere Automation cross-site scriptingIBM WebSphere Automation
- CVE-2024-27057ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspendLinux
- CVE-2024-27054s390/dasd: fix double module refcount decrementLinux
- CVE-2024-27051cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return valueLinux
- CVE-2024-27049wifi: mt76: mt7925e: fix use-after-free in free_irq()Linux
- CVE-2024-27048wifi: brcm80211: handle pmk_op allocation failureLinux
- CVE-2024-27047net: phy: fix phy_get_internal_delay accessing an empty arrayLinux
- CVE-2024-27046nfp: flower: handle acti_netdevs allocation failureLinux
- CVE-2024-31413Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD veOMRON CX-One CX-One CXONE-AL[][]D-V4 · OMRON Sysmac Studio…
- CVE-2024-27044drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'Linux
- CVE-2024-27041drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()Linux
- CVE-2024-27040drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'Linux
- CVE-2024-27039clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()Linux
- CVE-2024-27038clk: Fix clk_core_get NULL dereferenceLinux
- CVE-2024-27037clk: zynq: Prevent null pointer dereference caused by kmalloc failureLinux
- CVE-2024-27036cifs: Fix writeback data corruptionLinux
- CVE-2024-27033f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panicLinux
- CVE-2024-27032f2fs: fix to avoid potential panic during recoveryLinux
- CVE-2024-27031NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interruptLinux
- CVE-2024-27028spi: spi-mt65xx: Fix NULL pointer access in interrupt handlerLinux
- CVE-2023-52650drm/tegra: dsi: Add missing check for of_find_device_by_nodeLinux
- CVE-2023-52649drm/vkms: Avoid reading beyond LUT arrayLinux
- CVE-2024-4368Use after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-27027dpll: fix dpll_xa_ref_*_del() for multiple registrationsLinux
- CVE-2024-27025nbd: null check for nla_nest_startLinux
- CVE-2024-27024net/rds: fix WARNING in rds_conn_connect_if_downLinux
- CVE-2024-27023md: Fix missing release of 'active_io' for flushLinux
- CVE-2024-4059Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML paGoogle Chrome
- CVE-2022-38386IBM Cloud Pak for Security information disclosureIBM Cloud Pak for Security · IBM QRadar Suite for Software
- CVE-2024-0334Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributesjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2024-32973Remote for TLS session may be trusted despite constraints in Pluto langPlutoLang Pluto
- CVE-2024-32967Zitadel exposes internal database user name and host informationzitadel · github.com/zitadel/zitadel
- CVE-2024-32963Parameter Tampering vulnerability in Navidromenavidrome · github.com/navidrome/navidrome
- CVE-2024-32890Stored Cross-site Scripting in results JSON API in librespeed/speedtestlibrespeed speedtest
- CVE-2024-23335Backups directory .htaccess deletion in. MyBBmybb
- CVE-2024-23336Incomplete disallowed remote addresses list in MyBBmybb
- CVE-2024-3591WordPress Geo Controller < 8.6.5 - PHP Object InjectionGeo Controller
- CVE-2024-32966Stored Cross-site Scripting in directory listings via file names in static-web-serverstatic-web-server
- CVE-2024-27021r8169: fix LED-related deadlock on module removalLinux
- CVE-2024-27015netfilter: flowtable: incorrect pppoe tupleLinux
- CVE-2024-27014net/mlx5e: Prevent deadlock while disabling aRFSLinux
- CVE-2024-27013tun: limit printing rate when illegal packet received by tun devLinux
- CVE-2024-27011netfilter: nf_tables: fix memleak in map from abort pathLinux
- CVE-2024-27010net/sched: Fix mirred deadlock on device recursionLinux
- CVE-2024-27009s390/cio: fix race condition during online processingLinux
- CVE-2024-27008drm: nv04: Fix out of bounds accessLinux
- CVE-2024-27006thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()Linux
- CVE-2024-27004clk: Get runtime PM before walking tree during disable_unusedLinux
- CVE-2024-27003clk: Get runtime PM before walking tree for clk_summaryLinux
- CVE-2024-27002clk: mediatek: Do a runtime PM get on controllers during probeLinux
- CVE-2024-27001comedi: vmk80xx: fix incomplete endpoint checkingLinux
- CVE-2024-27000serial: mxs-auart: add spinlock around changing cts stateLinux
- CVE-2024-26999serial/pmac_zilog: Remove flawed mitigation for rx irq floodLinux
- CVE-2024-26998serial: core: Clearing the circular buffer before NULLifying itLinux
- CVE-2024-26997usb: dwc2: host: Fix dereference issue in DDMA completion flow.Linux
- CVE-2024-26995usb: typec: tcpm: Correct the PDO counting in pd_setLinux
- CVE-2024-26993fs: sysfs: Fix reference leak in sysfs_break_active_protection()Linux
- CVE-2024-26991KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributesLinux
- CVE-2024-26989arm64: hibernate: Fix level3 translation fault in swsusp_save()Linux
- CVE-2024-26988init/main.c: Fix potential static_command_line memory overflowLinux
- CVE-2024-26987mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabledLinux
- CVE-2024-26986drm/amdkfd: Fix memory leak in create_process failureLinux
- CVE-2024-26985drm/xe: Fix bo leak in intel_fb_bo_framebuffer_initLinux
- CVE-2024-26984nouveau: fix instmem race condition around ptr storesLinux
- CVE-2024-26982Squashfs: check the inode number is not the invalid value of zeroLinux
- CVE-2024-26981nilfs2: fix OOB in nilfs_set_de_typeLinux
- CVE-2024-26978serial: max310x: fix NULL pointer dereference in I2C instantiationLinux
- CVE-2024-26977pci_iounmap(): Fix MMIO mapping leakLinux
- CVE-2024-26975powercap: intel_rapl: Fix a NULL pointer dereferenceLinux
- CVE-2024-26973fat: fix uninitialized field in nostale filehandlesLinux
- CVE-2024-26970clk: qcom: gcc-ipq6018: fix terminating of frequency table arraysLinux
- CVE-2024-26964usb: xhci: Add error handling in xhci_map_urb_for_dmaLinux
- CVE-2024-26963usb: dwc3-am62: fix module unload/reload behaviorLinux
- CVE-2024-26962dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshapeLinux
- CVE-2024-26959Bluetooth: btnxpuart: Fix btnxpuart_closeLinux
- CVE-2024-26956nilfs2: fix failure to detect DAT corruption in btree and direct mappingsLinux
- CVE-2024-26955nilfs2: prevent kernel bug at submit_bh_wbc()Linux
- CVE-2024-26949drm/amdgpu/pm: Fix NULL pointer dereference when get power limitLinux
- CVE-2024-26948drm/amd/display: Add a dc_state NULL check in dc_state_releaseLinux
- CVE-2024-26947ARM: 9359/1: flush: check if the folio is reserved for no-mapping addressesLinux
- CVE-2024-26946kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe addressLinux
- CVE-2024-26943nouveau/dmem: handle kcalloc() allocation failureLinux
- CVE-2024-26942net: phy: qcom: at803x: fix kernel panic with at8031_probeLinux
- CVE-2024-26941drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveauLinux
- CVE-2024-26940drm/vmwgfx: Create debugfs ttm_resource_manager entry only if neededLinux
- CVE-2024-26938drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()Linux
- CVE-2024-26937drm/i915/gt: Reset queue_priority_hint on parkingLinux
- CVE-2024-26935scsi: core: Fix unremoved procfs host directory regressionLinux
- CVE-2024-26934USB: core: Fix deadlock in usb_deauthorize_interface()Linux
- CVE-2024-26933USB: core: Fix deadlock in port "disable" sysfs attributeLinux
- CVE-2023-52648drm/vmwgfx: Unmap the surface before resetting it on a plane stateLinux
- CVE-2023-52647media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before accessLinux
- CVE-2024-28979Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site SDell OpenManage Enterprise
- CVE-2024-28978Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability.Dell OpenManage Enterprise
- CVE-2023-23019Cross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to fun
- CVE-2023-23021Cross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code v
- CVE-2023-23022Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 employee's payroll management system 1.0, allows attackers to execute a
- CVE-2023-46294An issue was discovered in Teledyne FLIR M300 2.00-19.
- CVE-2024-22830Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system r
- CVE-2024-25676An issue was discovered in ViewerJS 0.5.8.
- CVE-2024-30176In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets.
- CVE-2024-32210The LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL co
- CVE-2024-32211An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserCla
- CVE-2024-32213The LoMag WareHouse Management application version 1.0.20.120 and older were found to allow weak passwords.
- CVE-2024-33304SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" under Add Users.
- CVE-2024-33307SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" parameter in Create User.
- CVE-2024-33393An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the to
- CVE-2024-33424A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML
- CVE-2024-33431An issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file.
- CVE-2024-33442An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_post.php component.
- CVE-2024-33764lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.lunasvg
- CVE-2024-33766lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.lunasvg
- CVE-2024-33767lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.lunasvg