CVEs published August 17, 2024
135 CVEs were published on August 17, 2024: 4 critical, 40 high.
- Published
- 135
- Critical
- 4
- High
- 40
- Medium
- 20
- Low
- 0
- Unrated
- 71
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- Linux
- 109
- princeahmed Radio Player – Live Shoutcast, Icecast and Any…
- 3
- Tosei Online Store Management System ネット店舗管理システム
- 3
- Bricks Builder Bricks
- 2
- tagDiv Opt-In Builder
- 2
- 2j-slideshow Slideshow, Image Slider by
- 1
- binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…
- 1
- InnoCMS
- 1
- inspirelabs InPost for WooCommerce · inspirelabs InPost PL
- 1
- kaizencoders Short URL
- 1
Critical 4
- CVE-2024-42285RDMA/iwcm: Fix a use-after-free related to destroying CM IDsLinux
- CVE-2024-42284tipc: Return non-zero value from tipc_udp_addr2str() on errorLinux
- CVE-2024-6459News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFINews Element Elementor Blog Magazine
- CVE-2024-6500InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Deleteinspirelabs InPost for WooCommerce · inspirelabs InPost PL
High 40
- CVE-2023-3416tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL InjectiontagDiv Opt-In Builder
- CVE-2023-0714Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Uploadroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-3419tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL InjectiontagDiv Opt-In Builder
- CVE-2024-43858jfs: Fix array-index-out-of-bounds in diFreeLinux
- CVE-2024-43856dma: fix call order in dmam_free_coherentLinux
- CVE-2024-43853cgroup/cpuset: Prevent UAF in proc_cpuset_show()Linux
- CVE-2024-43848wifi: mac80211: fix TTLM teardown workLinux
- CVE-2024-43847wifi: ath12k: fix invalid memory access while processing fragmented packetsLinux
- CVE-2024-43846lib: objagg: Fix general protection faultLinux
- CVE-2024-43845udf: Fix bogus checksum computation in udf_rename()Linux
- CVE-2024-43840bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIGLinux
- CVE-2024-43832s390/uv: Don't call folio_wait_writeback() without a folio referenceLinux
- CVE-2024-43830leds: trigger: Unregister sysfs attributes before calling deactivate()Linux
- CVE-2024-43825iio: Fix the sorting functionality in iio_gts_build_avail_time_tableLinux
- CVE-2024-43816scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usagesLinux
- CVE-2024-42318landlock: Don't lose track of restrictions on cred_transferLinux
- CVE-2024-42314btrfs: fix extent map use-after-free when adding pages to compressed bioLinux
- CVE-2024-42313media: venus: fix use after free in vdec_closeLinux
- CVE-2024-42311hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()Linux
- CVE-2024-42306udf: Avoid using corrupted block bitmap bufferLinux
- CVE-2024-42304ext4: make sure the first directory block is not a holeLinux
- CVE-2024-42301dev/parport: fix the array out-of-bounds riskLinux
- CVE-2024-42300erofs: fix race in z_erofs_get_gbuf()Linux
- CVE-2024-42299fs/ntfs3: Update log->page_{mask,bits} if log->page_size changedLinux
- CVE-2024-42297f2fs: fix to don't dirty inode for readonly filesystemLinux
- CVE-2024-42296f2fs: fix return value of f2fs_convert_inline_inode()Linux
- CVE-2024-42293arm64: mm: Fix lockless walks with static and dynamic page-table foldingLinux
- CVE-2024-42288scsi: qla2xxx: Fix for possible memory corruptionLinux
- CVE-2024-42287scsi: qla2xxx: Complete command early within lockLinux
- CVE-2024-42286scsi: qla2xxx: validate nvme_local_port correctlyLinux
- CVE-2024-42280mISDN: Fix a use after free in hfcmulti_tx()Linux
- CVE-2024-42279spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transferLinux
- CVE-2024-42276nvme-pci: add missing condition check for existence of mapped dataLinux
- CVE-2024-42275drm/client: Fix error code in drm_client_buffer_vmap_local()Linux
- CVE-2024-42273f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is validLinux
- CVE-2024-42272sched: act_ct: take care of padding in struct zones_ht_keyLinux
- CVE-2024-42271net/iucv: fix use after free in iucv_sock_close()Linux
- CVE-2024-42266btrfs: make cow_file_range_inline() honor locked_page on errorLinux
- CVE-2024-42264drm/v3d: Prevent out of bounds access in performance query extensionsLinux
- CVE-2022-1751Skitter Slideshow <= 2.5.2 - Unauthenticated Server-Side Request Forgerythiagosf Skitter Slideshow
Medium, low and unrated 91
- CVE-2024-7902pkp ojs signOut redirectpkp ojs
- CVE-2024-7901Scada-LTS Message Scada cross site scriptingScada-LTS
- CVE-2024-7900xiaohe4966 TpMeCMS Basic Configuration config cross site scriptingxiaohe4966 TpMeCMS
- CVE-2024-7899InnoCMS Backend edit code injectionInnoCMS
- CVE-2024-7898Tosei Online Store Management System ネット店舗管理システム Backend default credentialsTosei Online Store Management System ネット店舗管理システム
- CVE-2024-7897Tosei Online Store Management System ネット店舗管理システム tosei_kikai.php command injectionTosei Online Store Management System ネット店舗管理システム
- CVE-2024-7896Tosei Online Store Management System ネット店舗管理システム p1_ftpserver.php command injectionTosei Online Store Management System ネット店舗管理システム
- CVE-2024-7703ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploadreputeinfosystems ARMember – Membership Plugin, Content Res…
- CVE-2024-43860remoteproc: imx_rproc: Skip over memory region when node value is NULLLinux
- CVE-2024-43859f2fs: fix to truncate preallocated blocks in f2fs_file_open()Linux
- CVE-2024-43857f2fs: fix null reference error when checking end of zoneLinux
- CVE-2024-43855md: fix deadlock between mddev_suspend and flush bioLinux
- CVE-2024-43854block: initialize integrity buffer to zero before writing it to mediaLinux
- CVE-2024-43852hwmon: (ltc2991) re-order conditions to fix off by one bugLinux
- CVE-2024-43851soc: xilinx: rename cpu_number1 to dummy_cpu_numberLinux
- CVE-2024-43850soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_removeLinux
- CVE-2024-43849soc: qcom: pdr: protect locator_addr with the main mutexLinux
- CVE-2024-43844wifi: rtw89: wow: fix GTK offload H2C skbuff issueLinux
- CVE-2024-43843riscv, bpf: Fix out-of-bounds issue when preparing trampoline imageLinux
- CVE-2024-43842wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()Linux
- CVE-2024-43841wifi: virt_wifi: avoid reporting connection success with wrong SSIDLinux
- CVE-2024-43839bna: adjust 'name' buf size of bna_tcb and bna_ccb structuresLinux
- CVE-2024-43838bpf: fix overflow check in adjust_jmp_off()Linux
- CVE-2024-43837bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXTLinux
- CVE-2024-43836net: ethtool: pse-pd: Fix possible null-derefLinux
- CVE-2024-43835virtio_net: Fix napi_skb_cache_put warningLinux
- CVE-2024-43834xdp: fix invalid wait context of page_pool_destroy()Linux
- CVE-2024-43833media: v4l: async: Fix NULL pointer dereference in adding ancillary linksLinux
- CVE-2024-43831media: mediatek: vcodec: Handle invalid decoder vsiLinux
- CVE-2024-43829drm/qxl: Add check for drm_cvt_modeLinux
- CVE-2024-43828ext4: fix infinite loop when replaying fast_commitLinux
- CVE-2024-43827drm/amd/display: Add null check before access structsLinux
- CVE-2024-43826nfs: pass explicit offset/count to trace eventsLinux
- CVE-2024-43824PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()Linux
- CVE-2024-43823PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()Linux
- CVE-2024-43822ASoc: PCM6240: Return directly after a failed devm_kzalloc() in pcmdevice_i2c_probe()Linux
- CVE-2024-43821scsi: lpfc: Fix a possible null pointer dereferenceLinux
- CVE-2024-43820dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resumeLinux
- CVE-2024-43819kvm: s390: Reject memory region operations for ucontrol VMsLinux
- CVE-2024-43818ASoC: amd: Adjust error handling in case of absent codec deviceLinux
- CVE-2024-43817net: missing check virtioLinux
- CVE-2024-43815crypto: mxs-dcp - Ensure payload is zero when using key slotLinux
- CVE-2024-42322ipvs: properly dereference pe in ip_vs_add_serviceLinux
- CVE-2024-42321net: flow_dissector: use DEBUG_NET_WARN_ON_ONCELinux
- CVE-2024-42320s390/dasd: fix error checks in dasd_copy_pair_store()Linux
- CVE-2024-42319mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()Linux
- CVE-2024-42317mm/huge_memory: avoid PMD-size page cache if neededLinux
- CVE-2024-42316mm/mglru: fix div-by-zero in vmpressure_calc_level()Linux
- CVE-2024-42315exfat: fix potential deadlock on __exfat_get_dentry_setLinux
- CVE-2024-42312sysctl: always initialize i_uid/i_gidLinux
- CVE-2024-42310drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modesLinux
- CVE-2024-42309drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modesLinux
- CVE-2024-42307cifs: fix potential null pointer use in destroy_workqueue in init_cifs error pathLinux
- CVE-2024-42305ext4: check dot and dotdot of dx_root before making dir indexedLinux
- CVE-2024-42303media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()Linux
- CVE-2024-42302PCI/DPC: Fix use-after-free on concurrent DPC and hot-removalLinux
- CVE-2024-42298ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned valueLinux
- CVE-2024-42295nilfs2: handle inconsistent state in nilfs_btnode_create_block()Linux
- CVE-2024-42294block: fix deadlock between sd_remove & sd_releaseLinux
- CVE-2024-42292kobject_uevent: Fix OOB access within zap_modalias_env()Linux
- CVE-2024-42291ice: Add a per-VF limit on number of FDIR filtersLinux
- CVE-2024-42290irqchip/imx-irqsteer: Handle runtime power management correctlyLinux
- CVE-2024-42289scsi: qla2xxx: During vport delete send async logout explicitlyLinux
- CVE-2024-42283net: nexthop: Initialize all fields in dumped nexthopsLinux
- CVE-2024-42282net: mediatek: Fix potential NULL pointer dereference in dummy net_device handlingLinux
- CVE-2024-42281bpf: Fix a segment issue when downgrading gso_sizeLinux
- CVE-2024-42278ASoC: TAS2781: Fix tasdev_load_calibrated_data()Linux
- CVE-2024-42277iommu: sprd: Avoid NULL deref in sprd_iommu_hw_enLinux
- CVE-2023-52889apparmor: Fix null pointer deref when receiving skb during sock creationLinux
- CVE-2024-7887LimeSurvey File Upload index.php denial of serviceLimeSurvey
- CVE-2024-42274Revert "ALSA: firewire-lib: operate for period elapse event in process context"Linux
- CVE-2024-42270netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().Linux
- CVE-2024-42269netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().Linux
- CVE-2024-42268net/mlx5: Fix missing lock on sync reset reloadLinux
- CVE-2024-42267riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()Linux
- CVE-2024-42265protect the fetch of ->fd[fd] in do_dup2() from mispredictionsLinux
- CVE-2024-42263drm/v3d: Fix potential memory leak in the timestamp extensionLinux
- CVE-2024-42262drm/v3d: Fix potential memory leak in the performance extensionLinux
- CVE-2024-42261drm/v3d: Validate passed in drm syncobj handles in the timestamp extensionLinux
- CVE-2024-42260drm/v3d: Validate passed in drm syncobj handles in the performance extensionLinux
- CVE-2023-3408Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settingsBricks Builder Bricks
- CVE-2023-5505BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversalwp_media BackWPup – WordPress Backup & Restore Plugin
- CVE-2023-3409Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settingsBricks Builder Bricks
- CVE-2023-4604Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post'2j-slideshow Slideshow, Image Slider by
- CVE-2023-1604Short URL <= 1.6.8 - Cross-Site Request Forgery via configuration_pagekaizencoders Short URL
- CVE-2023-4025Radio Player <= 2.0.73 - Missing Authorization to Player Updateprinceahmed Radio Player – Live Shoutcast, Icecast and Any…
- CVE-2023-4730LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpointbinhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…
- CVE-2023-4507Admission AppManager <= 1.0.0 - Reflected Cross-Site Scriptingzvijerka Admission AppManager
- CVE-2022-4532LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypasskrut1 LOGIN AND REGISTRATION ATTEMPTS LIMIT
- CVE-2023-4024Radio Player <= 2.0.73 - Missing Authorization to Player Deletionprinceahmed Radio Player – Live Shoutcast, Icecast and Any…
- CVE-2023-4027Radio Player <= 2.0.73 - Missing Authorization to Settings Updateprinceahmed Radio Player – Live Shoutcast, Icecast and Any…