# CVEs published 2024-12-29

69 CVEs were published on December 29, 2024: 2 critical, 9 high. Days are UTC.

- [CVE-2024-13029](https://cve.now/CVE-2024-13029.md): Antabot White-Jotter Edit Book book server-side request forgery (CVSS 5.3, Antabot White-Jotter)
- [CVE-2024-13028](https://cve.now/CVE-2024-13028.md): Antabot White-Jotter login observable response discrepancy (CVSS 6.3, Antabot White-Jotter)
- [CVE-2024-13025](https://cve.now/CVE-2024-13025.md): Codezips College Management System faculty.php sql injection (CVSS 5.3, Codezips College Management System)
- [CVE-2024-13024](https://cve.now/CVE-2024-13024.md): Codezips Blood Bank Management System campaign.php sql injection (CVSS 5.3, Codezips Blood Bank Management System)
- [CVE-2024-13023](https://cve.now/CVE-2024-13023.md): PHPGurukul Maid Hiring Management System Search Maid Page search-maid.php cross site scripting (CVSS 5.1, PHPGurukul Maid Hiring Management System)
- [CVE-2024-13022](https://cve.now/CVE-2024-13022.md): taisan tarzan-cms Article Management UploadController.java UploadResponse unrestricted upload (CVSS 5.3, taisan tarzan-cms)
- [CVE-2024-13021](https://cve.now/CVE-2024-13021.md): SourceCodester Road Accident Map Marker add-mark.php cross site scripting (CVSS 5.3, SourceCodester Road Accident Map Marker)
- [CVE-2024-13020](https://cve.now/CVE-2024-13020.md): code-projects Chat System chatroom.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2024-13019](https://cve.now/CVE-2024-13019.md): code-projects Chat System Chat Room Page update\_room.php cross site scripting (CVSS 5.3, code-projects Chat System)
- [CVE-2024-13018](https://cve.now/CVE-2024-13018.md): PHPGurukul Maid Hiring Management System profile.php cross site scripting (CVSS 5.1, PHPGurukul Maid Hiring Management System)
- [CVE-2024-13017](https://cve.now/CVE-2024-13017.md): PHPGurukul Maid Hiring Management System About Us Page aboutus.php cross site scripting (CVSS 5.1, PHPGurukul Maid Hiring Management System)
- [CVE-2024-13016](https://cve.now/CVE-2024-13016.md): PHPGurukul Maid Hiring Management System edit-category.php sql injection (CVSS 5.3, PHPGurukul Maid Hiring Management System)
- [CVE-2024-13015](https://cve.now/CVE-2024-13015.md): PHPGurukul Maid Hiring Management System search-booking-request.php cross site scripting (CVSS 5.1, PHPGurukul Maid Hiring Management System)
- [CVE-2024-13014](https://cve.now/CVE-2024-13014.md): PHPGurukul Maid Hiring Management System search-maid.php sql injection (CVSS 5.3, PHPGurukul Maid Hiring Management System)
- [CVE-2024-13013](https://cve.now/CVE-2024-13013.md): PHPGurukul Maid Hiring Management System Contact Us Page contactus.php cross site scripting (CVSS 5.1, PHPGurukul Maid Hiring Management System)
- [CVE-2024-13012](https://cve.now/CVE-2024-13012.md): code-projects Hostel Management System registration.php cross site scripting (CVSS 5.3, code-projects Hostel Management System)
- [CVE-2024-56756](https://cve.now/CVE-2024-56756.md): nvme-pci: fix freeing of the HMB descriptor table (CVSS 5.5, Linux)
- [CVE-2024-56755](https://cve.now/CVE-2024-56755.md): netfs/fscache: Add a memory barrier for FSCACHE\_VOLUME\_CREATING (CVSS 5.5, Linux)
- [CVE-2024-56754](https://cve.now/CVE-2024-56754.md): crypto: caam - Fix the pointer passed to caam\_qi\_shutdown() (CVSS 5.5, Linux)
- [CVE-2024-56753](https://cve.now/CVE-2024-56753.md): drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx\_v9\_0 Module (CVSS 5.5, Linux)
- [CVE-2024-56752](https://cve.now/CVE-2024-56752.md): drm/nouveau/gr/gf100: Fix missing unlock in gf100\_gr\_chan\_new() (CVSS 5.5, Linux)
- [CVE-2024-56751](https://cve.now/CVE-2024-56751.md): ipv6: release nexthop on device removal (no CVSS, Linux)
- [CVE-2024-56750](https://cve.now/CVE-2024-56750.md): erofs: fix blksize \< PAGE\_SIZE for file-backed mounts (CVSS 5.5, Linux)
- [CVE-2024-56749](https://cve.now/CVE-2024-56749.md): dlm: fix dlm\_recover\_members refcount on error (CVSS 7.5, Linux)
- [CVE-2024-56748](https://cve.now/CVE-2024-56748.md): scsi: qedf: Fix a possible memory leak in qedf\_alloc\_and\_init\_sb() (CVSS 3.3, Linux)
- [CVE-2024-56747](https://cve.now/CVE-2024-56747.md): scsi: qedi: Fix a possible memory leak in qedi\_alloc\_and\_init\_sb() (CVSS 3.3, Linux)
- [CVE-2024-56746](https://cve.now/CVE-2024-56746.md): fbdev: sh7760fb: Fix a possible memory leak in sh7760fb\_alloc\_mem() (CVSS 3.3, Linux)
- [CVE-2024-56745](https://cve.now/CVE-2024-56745.md): PCI: Fix reset\_method\_store() memory leak (CVSS 3.3, Linux)
- [CVE-2024-56744](https://cve.now/CVE-2024-56744.md): f2fs: fix to avoid potential deadlock in f2fs\_record\_stop\_reason() (no CVSS, Linux)
- [CVE-2024-56743](https://cve.now/CVE-2024-56743.md): nfs\_common: must not hold RCU while calling nfsd\_file\_put\_local (CVSS 5.5, Linux)
- [CVE-2024-56742](https://cve.now/CVE-2024-56742.md): vfio/mlx5: Fix an unwind issue in mlx5vf\_add\_migration\_pages() (CVSS 3.3, Linux)
- [CVE-2024-56740](https://cve.now/CVE-2024-56740.md): nfs/localio: must clear res.replen in nfs\_local\_read\_done (CVSS 7.8, Linux)
- [CVE-2024-56739](https://cve.now/CVE-2024-56739.md): rtc: check if \_\_rtc\_read\_time was successful in rtc\_timer\_do\_work() (CVSS 5.5, Linux)
- [CVE-2024-56730](https://cve.now/CVE-2024-56730.md): net/9p/usbg: fix handling of the failed kzalloc() memory allocation (CVSS 5.5, Linux)
- [CVE-2024-56729](https://cve.now/CVE-2024-56729.md): smb: Initialize cfid-\>tcon before performing network ops (CVSS 4.7, Linux)
- [CVE-2024-56728](https://cve.now/CVE-2024-56728.md): octeontx2-pf: handle otx2\_mbox\_get\_rsp errors in otx2\_ethtool.c (CVSS 5.5, Linux)
- [CVE-2024-56727](https://cve.now/CVE-2024-56727.md): octeontx2-pf: handle otx2\_mbox\_get\_rsp errors in otx2\_flows.c (CVSS 5.5, Linux)
- [CVE-2024-56726](https://cve.now/CVE-2024-56726.md): octeontx2-pf: handle otx2\_mbox\_get\_rsp errors in cn10k.c (CVSS 5.5, Linux)
- [CVE-2024-56725](https://cve.now/CVE-2024-56725.md): octeontx2-pf: handle otx2\_mbox\_get\_rsp errors in otx2\_dcbnl.c (CVSS 5.5, Linux)
- [CVE-2024-56724](https://cve.now/CVE-2024-56724.md): mfd: intel\_soc\_pmic\_bxtwc: Use IRQ domain for TMU device (CVSS 5.5, Linux)
- [CVE-2024-56723](https://cve.now/CVE-2024-56723.md): mfd: intel\_soc\_pmic\_bxtwc: Use IRQ domain for PMIC devices (CVSS 5.5, Linux)
- [CVE-2024-56722](https://cve.now/CVE-2024-56722.md): RDMA/hns: Fix cpu stuck caused by printings during reset (CVSS 5.5, Linux)
- [CVE-2024-56721](https://cve.now/CVE-2024-56721.md): x86/CPU/AMD: Terminate the erratum\_1386\_microcode array (CVSS 7.1, Linux)
- [CVE-2024-56720](https://cve.now/CVE-2024-56720.md): bpf, sockmap: Several fixes to bpf\_msg\_pop\_data (CVSS 7.8, Linux)
- [CVE-2024-13008](https://cve.now/CVE-2024-13008.md): code-projects Responsive Hotel Site newsletter.php sql injection (CVSS 5.3, code-projects Responsive Hotel Site)
- [CVE-2024-56719](https://cve.now/CVE-2024-56719.md): net: stmmac: fix TSO DMA API usage causing oops (CVSS 10.0, Linux)
- [CVE-2024-56718](https://cve.now/CVE-2024-56718.md): net/smc: protect link down work from execute after lgr freed (CVSS 9.8, Linux)
- [CVE-2024-56717](https://cve.now/CVE-2024-56717.md): net: mscc: ocelot: fix incorrect IFH SRC\_PORT field in ocelot\_ifh\_set\_basic() (CVSS 7.5, Linux)
- [CVE-2024-56716](https://cve.now/CVE-2024-56716.md): netdevsim: prevent bad user input in nsim\_dev\_health\_break\_write() (CVSS 5.5, Linux)
- [CVE-2024-56715](https://cve.now/CVE-2024-56715.md): ionic: Fix netdev notifier unregister on failure (CVSS 7.8, Linux)
- [CVE-2024-56714](https://cve.now/CVE-2024-56714.md): ionic: no double destroy workqueue (no CVSS, Linux)
- [CVE-2024-56713](https://cve.now/CVE-2024-56713.md): net: netdevsim: fix nsim\_pp\_hold\_write() (no CVSS, Linux)
- [CVE-2024-56712](https://cve.now/CVE-2024-56712.md): udmabuf: fix memory leak on last export\_udmabuf() error path (CVSS 3.3, Linux)
- [CVE-2024-56711](https://cve.now/CVE-2024-56711.md): drm/panel: himax-hx83102: Add a check to prevent NULL pointer dereference (CVSS 5.5, Linux)
- [CVE-2024-56710](https://cve.now/CVE-2024-56710.md): ceph: fix memory leak in ceph\_direct\_read\_write() (CVSS 3.3, Linux)
- [CVE-2024-56709](https://cve.now/CVE-2024-56709.md): io\_uring: check if iowq is killed before queuing (CVSS 7.8, Linux)
- [CVE-2024-13007](https://cve.now/CVE-2024-13007.md): Codezips Event Management System contact.php sql injection (CVSS 5.3, Codezips Event Management System)
- [CVE-2024-13006](https://cve.now/CVE-2024-13006.md): 1000 Projects Human Resource Management System employeeview.php sql injection (CVSS 6.9, 1000 Projects Human Resource Management System)
- [CVE-2024-13005](https://cve.now/CVE-2024-13005.md): 1000 Projects Attendance Tracking Management System attendance\_action.php sql injection (CVSS 5.3, 1000 Projects Attendance Tracking Management System)
- [CVE-2024-13004](https://cve.now/CVE-2024-13004.md): PHPGurukul Complaint Management System category.php sql injection (CVSS 6.9, PHPGurukul Complaint Management System)
- [CVE-2024-12238](https://cve.now/CVE-2024-12238.md): Ninja Forms – The Contact Form Builder That Grows With You \<= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 6.3, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-13003](https://cve.now/CVE-2024-13003.md): 1000 Projects Portfolio Management System MCA update\_ed.php sql injection (CVSS 5.3, 1000 Projects Portfolio Management System MCA)
- [CVE-2024-13002](https://cve.now/CVE-2024-13002.md): 1000 Projects Bookstore Management System order\_process.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-13001](https://cve.now/CVE-2024-13001.md): PHPGurukul Small CRM index.php sql injection (CVSS 5.3, PHPGurukul Small CRM)
- [CVE-2024-13000](https://cve.now/CVE-2024-13000.md): PHPGurukul Small CRM quote-details.php sql injection (CVSS 5.3, PHPGurukul Small CRM)
- [CVE-2024-12999](https://cve.now/CVE-2024-12999.md): PHPGurukul Small CRM edit-user.php sql injection (CVSS 5.3, PHPGurukul Small CRM)
- [CVE-2018-25107](https://cve.now/CVE-2018-25107.md): The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of rando (CVSS 7.5)
- [CVE-2024-56737](https://cve.now/CVE-2024-56737.md): GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. (CVSS 8.8, GNU GRUB2)
- [CVE-2024-56738](https://cve.now/CVE-2024-56738.md): GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub\_crypto\_memcmp and thus allows side-channel attacks. (CVSS 5.3, GNU GRUB2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.