# CVEs published 2024-12-28

50 CVEs were published on December 28, 2024: 0 critical, 20 high. Days are UTC.

- [CVE-2024-12998](https://cve.now/CVE-2024-12998.md): code-projects Online Car Rental System GET Parameter index.php cross site scripting (CVSS 6.9, code-projects Online Car Rental System)
- [CVE-2024-56512](https://cve.now/CVE-2024-56512.md): Apache NiFi: Missing Complete Authorization for Parameter and Service References (CVSS 2.1, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2024-12995](https://cve.now/CVE-2024-12995.md): ruifang-tech Rebuild Project Tasks Section tasks cross site scripting (CVSS 5.3, ruifang-tech Rebuild)
- [CVE-2024-12994](https://cve.now/CVE-2024-12994.md): running-elephant Datart File Upload import extractModel deserialization (CVSS 5.3, running-elephant Datart)
- [CVE-2024-56708](https://cve.now/CVE-2024-56708.md): EDAC/igen6: Avoid segmentation fault on module unload (CVSS 7.8, Linux)
- [CVE-2024-56707](https://cve.now/CVE-2024-56707.md): octeontx2-pf: handle otx2\_mbox\_get\_rsp errors in otx2\_dmac\_flt.c (no CVSS, Linux)
- [CVE-2024-56706](https://cve.now/CVE-2024-56706.md): s390/cpum\_sf: Fix and protect memory allocation of SDBs with mutex (CVSS 7.8, Linux)
- [CVE-2024-56705](https://cve.now/CVE-2024-56705.md): media: atomisp: Add check for rgby\_data memory allocation failure (no CVSS, Linux)
- [CVE-2024-56704](https://cve.now/CVE-2024-56704.md): 9p/xen: fix release of IRQ (CVSS 8.4, Linux)
- [CVE-2024-56703](https://cve.now/CVE-2024-56703.md): ipv6: Fix soft lockups in fib6\_select\_path under high next hop churn (CVSS 7.5, Linux)
- [CVE-2024-56702](https://cve.now/CVE-2024-56702.md): bpf: Mark raw\_tp arguments with PTR\_MAYBE\_NULL (CVSS 5.5, Linux)
- [CVE-2024-56701](https://cve.now/CVE-2024-56701.md): powerpc/pseries: Fix dtl\_access\_lock to be a rw\_semaphore (no CVSS, Linux)
- [CVE-2024-56700](https://cve.now/CVE-2024-56700.md): media: wl128x: Fix atomicity violation in fmc\_send\_cmd() (no CVSS, Linux)
- [CVE-2024-56699](https://cve.now/CVE-2024-56699.md): s390/pci: Fix potential double remove of hotplug slot (no CVSS, Linux)
- [CVE-2024-56698](https://cve.now/CVE-2024-56698.md): usb: dwc3: gadget: Fix looping of queued SG entries (CVSS 5.5, Linux)
- [CVE-2024-56697](https://cve.now/CVE-2024-56697.md): drm/amdgpu: Fix the memory allocation issue in amdgpu\_discovery\_get\_nps\_info() (CVSS 5.5, Linux)
- [CVE-2024-56696](https://cve.now/CVE-2024-56696.md): ALSA: core: Fix possible NULL dereference caused by kunit\_kzalloc() (CVSS 5.5, Linux)
- [CVE-2024-56695](https://cve.now/CVE-2024-56695.md): drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd\_get\_cu\_occupancy()' (CVSS 7.8, Linux)
- [CVE-2024-56694](https://cve.now/CVE-2024-56694.md): bpf: fix recursive lock when verdict program return SK\_PASS (CVSS 7.5, Linux)
- [CVE-2024-56693](https://cve.now/CVE-2024-56693.md): brd: defer automatic disk creation until module initialization succeeds (CVSS 7.8, Linux)
- [CVE-2024-56692](https://cve.now/CVE-2024-56692.md): f2fs: fix to do sanity check on node blkaddr in truncate\_node() (CVSS 7.8, Linux)
- [CVE-2024-56691](https://cve.now/CVE-2024-56691.md): mfd: intel\_soc\_pmic\_bxtwc: Use IRQ domain for USB Type-C device (no CVSS, Linux)
- [CVE-2024-56690](https://cve.now/CVE-2024-56690.md): crypto: pcrypt - Call crypto layer directly when padata\_do\_parallel() return -EBUSY (no CVSS, Linux)
- [CVE-2024-56689](https://cve.now/CVE-2024-56689.md): PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio' (CVSS 5.5, Linux)
- [CVE-2024-56688](https://cve.now/CVE-2024-56688.md): sunrpc: clear XPRT\_SOCK\_UPD\_TIMEOUT when reset transport (CVSS 7.5, Linux)
- [CVE-2024-56687](https://cve.now/CVE-2024-56687.md): usb: musb: Fix hardware lockup on first Rx endpoint request (CVSS 5.5, Linux)
- [CVE-2024-56685](https://cve.now/CVE-2024-56685.md): ASoC: mediatek: Check num\_codecs is not zero to avoid panic during probe (no CVSS, Linux)
- [CVE-2024-56684](https://cve.now/CVE-2024-56684.md): mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq\_get\_clocks() (CVSS 8.4, Linux)
- [CVE-2024-56683](https://cve.now/CVE-2024-56683.md): drm/vc4: hdmi: Avoid hang with debug registers when suspended (no CVSS, Linux)
- [CVE-2024-56682](https://cve.now/CVE-2024-56682.md): irqchip/riscv-aplic: Prevent crash when MSI domain is missing (CVSS 5.5, Linux)
- [CVE-2024-56681](https://cve.now/CVE-2024-56681.md): crypto: bcm - add error check in the ahash\_hmac\_init function (CVSS 7.8, Linux)
- [CVE-2024-56680](https://cve.now/CVE-2024-56680.md): media: intel/ipu6: do not handle interrupts when device is disabled (no CVSS, Linux)
- [CVE-2024-56679](https://cve.now/CVE-2024-56679.md): octeontx2-pf: handle otx2\_mbox\_get\_rsp errors in otx2\_common.c (no CVSS, Linux)
- [CVE-2024-56678](https://cve.now/CVE-2024-56678.md): powerpc/mm/fault: Fix kfence page fault reporting (CVSS 7.8, Linux)
- [CVE-2024-56677](https://cve.now/CVE-2024-56677.md): powerpc/fadump: Move fadump\_cma\_init to setup\_arch() after initmem\_init() (CVSS 7.8, Linux)
- [CVE-2024-56676](https://cve.now/CVE-2024-56676.md): thermal: testing: Initialize some variables annoteded with \_free() (no CVSS, Linux)
- [CVE-2023-52718](https://cve.now/CVE-2023-52718.md): A connection hijacking vulnerability exists in some Huawei home routers. (CVSS 6.4, Huawei PT9030-15 · Huawei WS7206-10 +7)
- [CVE-2023-7263](https://cve.now/CVE-2023-7263.md): Some Huawei home music system products have a path traversal vulnerability. (CVSS 7.3, Huawei HarmonyOS AILife Solution)
- [CVE-2023-7266](https://cve.now/CVE-2023-7266.md): Some Huawei home routers have a connection hijacking vulnerability. (CVSS 7.5, Huawei TC7001-10 · Huawei WS7200-10 +1)
- [CVE-2022-48470](https://cve.now/CVE-2022-48470.md): Huawei HiLink AI Life product has an identity authentication bypass vulnerability. (CVSS 4.0, Huawei HarmonyOS AILife Solution)
- [CVE-2021-22484](https://cve.now/CVE-2021-22484.md): Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2021-37000](https://cve.now/CVE-2021-37000.md): Some Huawei wearables have a permission management vulnerability. (CVSS 7.7, Huawei HarmonyOS)
- [CVE-2020-1824](https://cve.now/CVE-2020-1824.md): There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some (CVSS 3.7, Huawei IPS Module · Huawei NGFW Module +7)
- [CVE-2020-1823](https://cve.now/CVE-2020-1823.md): There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some (CVSS 3.7, Huawei IPS Module · Huawei NGFW Module +7)
- [CVE-2020-1822](https://cve.now/CVE-2020-1822.md): There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some (CVSS 3.7, Huawei IPS Module · Huawei NGFW Module +7)
- [CVE-2020-1821](https://cve.now/CVE-2020-1821.md): There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some (CVSS 3.7, Huawei IPS Module · Huawei NGFW Module +7)
- [CVE-2020-1820](https://cve.now/CVE-2020-1820.md): There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some (CVSS 3.7, Huawei IPS Module · Huawei NGFW Module +7)
- [CVE-2024-43705](https://cve.now/CVE-2024-43705.md): GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so) (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-46973](https://cve.now/CVE-2024-46973.md): Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-46972](https://cve.now/CVE-2024-46972.md): GPU DDK - Security: Reference count overflow in pvr\_sync\_rollback\_export\_fence (CVSS 7.8, Imagination Technologies Graphics DDK)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.