CVEs from 2024
Total
6,678
critical
critical 124
high
high 1,047
medium
medium 2,013
low
low 48
% Critical
1.9%
% with KEV
2.4%
% with exploit
3.3%
Top products
- surveillance_station 12
- checkmk 10
- profilegrid 8
- office 8
- office_long_term_servicing_channel 6
- glibc 5
- virtual_traffic_manager 5
- element_pack 5
Top packages
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-50283 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It… | |||
| CVE-2024-50284 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix the missing xa_store error check xa_store() can fail, it return xa_err(-EINVAL) if the entry cannot be stored in an XA… | |||
| CVE-2024-50285 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: check outstanding simultaneous SMB operations If Client send simultaneous SMB operations to ksmbd, It exhausts too much me… | |||
| CVE-2024-50286 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition between ksmbd_smb2_session_create and ksmbd… | |||
| CVE-2024-50287 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logic at tpg_precalculate_line() blindly res… | |||
| CVE-2024-50288 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix buffer overwrite when using > 32 buffers The maximum number of buffers that can be requested was increased to 6… | |||
| CVE-2024-50289 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: av7110: fix a spectre vulnerability As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn… | |||
| CVE-2024-50291 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: add missing buffer index check dvb_vb2_expbuf() didn't check if the given buffer index was for a valid buffer. A… | |||
| CVE-2024-50290 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR registers fail, a negative number will … | |||
| CVE-2024-50293 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/smc: do not leave a dangling sk pointer in __smc_create() Thanks to commit 4bbd360a5084 ("socket: Print pf->create() when it … | |||
| CVE-2024-50295 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dma_map_single/dma_unmap_single The ndev->dev and pdev->dev aren't the same device, use ndev->dev.pa… | |||
| CVE-2024-50296 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and the VF is disabled concurrently, a kernel… | |||
| CVE-2024-50297 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets in dql after dma engine starts causes rac… | |||
| CVE-2024-50298 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vf_state during PF probes In the previous implementation, vf_state is allocated memory only when VF is enabl… | |||
| CVE-2024-50300 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: regulator: rtq2208: Fix uninitialized use of regulator_config Fix rtq2208 driver uninitialized use to cause kernel error. | |||
| CVE-2024-52319 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault addr… | |||
| CVE-2024-51729 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault… | |||
| CVE-2024-52557 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get() This patch fixes a potential integer overflow in the zynqmp_dp_rate_… | |||
| CVE-2024-53043 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mctp i2c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet s… | |||
| CVE-2024-52559 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() The "submit->cmd[i].size" and "submit->cmd[i].offset" variables a… | |||
| CVE-2024-52560 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() Extended the `mi_enum_attr()` function interface with an … | |||
| CVE-2024-53048 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ice: fix crash on probe for DPLL enabled E810 LOM The E810 Lan On Motherboard (LOM) design is vendor specific. Intel provides the… | |||
| CVE-2024-53046 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: arm64: dts: imx8ulp: correct the flexspi compatible string The flexspi on imx8ulp only has 16 LUTs, and imx8mm flexspi has 32 LUT… | |||
| CVE-2024-53045 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: fix bounds checker error in dapm_widget_list_create The widgets array in the snd_soc_dapm_widget_list has a __counted… | |||
| CVE-2024-53049 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: slub/kunit: fix a WARNING due to unwrapped __kmalloc_cache_noprof 'modprobe slub_kunit' will have a warning as shown below. The r… | |||
| CVE-2024-53053 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix another deadlock during RTC update If ufshcd_rtc_work calls ufshcd_rpm_put_sync() and the pm's usage_count i… | |||
| CVE-2024-53056 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() In mtk_crtc_create(), if the call to mbox_request_channel() fa… | |||
| CVE-2024-53058 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data In case the non-paged data of a SKB carries protocol header… | |||
| CVE-2024-53066 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: nfs: Fix KMSAN warning in decode_getfattr_attrs() Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G … | |||
| CVE-2024-53061 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: s5p-jpeg: prevent buffer overflows The current logic allows word to be less than 2. If this happens, there will be buffer … | |||
| CVE-2024-53062 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: mgb4: protect driver against spectre Frequency range is set from sysfs via frequency_range_store(), being vulnerable to sp… | |||
| CVE-2024-53063 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: prevent the risk of out of memory access The dvbdev contains a static variable used to store dvb minors. The beha… | |||
| CVE-2024-53069 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: fix a NULL-pointer dereference Some SCM calls can be invoked with __scm being NULL (the driver may not have … | |||
| CVE-2024-53067 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Start the RTC update work later The RTC update work involves runtime resuming the UFS controller. Hence, only st… | |||
| CVE-2024-53071 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Be stricter about IO mapping flags The current panthor_device_mmap_io() implementation has two issues: 1. For mappi… | |||
| CVE-2024-53068 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() The scmi_dev->name is released prematurely in __scmi_device_de… | |||
| CVE-2024-53073 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pending_async_copies on error The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decr… | |||
| CVE-2024-53076 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table() If per_time_scales[i] or per_time_gains… | |||
| CVE-2024-53075 | unknown | — | — | — | In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent a bad reference count on CPU nodes When populating cache leaves we previously fetched the CPU device node at the v… | |||
| CVE-2024-47097 | unknown | — | — | 4d ago | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the site parameter of handleloginform.do. | |||
| CVE-2024-47096 | unknown | — | — | 4d ago | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the showSupportExpiredMessage parameter of hand… | |||
| CVE-2024-5986 | unknown | — | — | 4mo ago | H2O has an External Control of File Name or Path vulnerability | |||
| CVE-2024-4027 | unknown | — | — | 4mo ago | Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names | |||
| CVE-2024-29371 | unknown | — | — | 6mo ago | jose4j is vulnerable to DoS via compressed JWE content | |||
| CVE-2024-3884 | unknown | — | — | 6mo ago | Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded | |||
| CVE-2024-44088 | unknown | — | — | 8mo ago | Apache Geode web-api is vulnerable to Cross-site Scripting | |||
| CVE-2024-6429 | unknown | — | — | 8mo ago | WSO2 Identity Server Apps allows content spoofing in logs | |||
| CVE-2024-43115 | unknown | — | — | 9mo ago | Apache DolphinScheduler vulnerable to Alert Script Attack | |||
| CVE-2024-43166 | unknown | — | — | 9mo ago | Apache DolphinScheduler Incorrect Default Permissions Vulnerability | |||
| CVE-2024-39954 | unknown | — | — | 10mo ago | Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java | |||
| CVE-2024-51775 | unknown | — | — | 10mo ago | Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability | |||
| CVE-2024-52279 | unknown | — | — | 10mo ago | Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string | |||
| CVE-2024-41177 | unknown | — | — | 10mo ago | Apache Zeppelin: XSS in the Helium module | |||
| CVE-2024-9408 | unknown | — | — | 11mo ago | Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints | |||
| CVE-2024-10029 | unknown | — | — | 11mo ago | Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console | |||
| CVE-2024-9342 | unknown | — | — | 11mo ago | Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts | |||
| CVE-2024-10031 | unknown | — | — | 11mo ago | Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications | |||
| CVE-2024-9343 | unknown | — | — | 11mo ago | Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console | |||
| CVE-2024-10032 | unknown | — | — | 11mo ago | Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console | |||
| CVE-2024-41169 | unknown | — | — | 11mo ago | Apache Zeppelin exposes server resources to unauthenticated attackers | |||
| CVE-2024-56158 | unknown | — | — | 1y ago | XWiki allows SQL injection in query endpoint of REST API with Oracle | |||
| CVE-2024-40625 | unknown | — | — | 1y ago | Coverage REST API Server Side Request Forgery | |||
| CVE-2024-38524 | unknown | — | — | 1y ago | GWC Home Page communicate version and revision information | |||
| CVE-2024-34711 | unknown | — | — | 1y ago | GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) | |||
| CVE-2024-29198 | unknown | — | — | 1y ago | GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost | |||
| CVE-2024-8008 | unknown | — | — | 1y ago | WSO2 products vulnerable to Cross-site Scripting | |||
| CVE-2024-1440 | unknown | — | — | 1y ago | WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint | |||
| CVE-2024-7096 | unknown | — | — | 1y ago | WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services | |||
| CVE-2024-24780 | unknown | — | — | 1y ago | Apache IoTDB Vulnerable to Remote Code Execution | |||
| CVE-2024-13009 | unknown | — | — | 1y ago | **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request | |||
| CVE-2024-52979 | unknown | — | — | 1y ago | Elasticsearch Uncontrolled Resource Consumption Vulnerability | |||
| CVE-2024-42699 | unknown | — | — | 1y ago | OpenCMS Cross-Site Scripting vulnerability | |||
| CVE-2024-41446 | unknown | — | — | 1y ago | OpenCMS cross-site scripting (XSS) vulnerability | |||
| CVE-2024-41447 | unknown | — | — | 1y ago | Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability | |||
| CVE-2024-55238 | unknown | — | — | 1y ago | OpenMetadata SQL Injection | |||
| CVE-2024-52981 | unknown | — | — | 1y ago | Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion | |||
| CVE-2024-52980 | unknown | — | — | 1y ago | Elasticsearch Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function | |||
| CVE-2024-56325 | unknown | — | — | 1y ago | Apache Pinot Vulnerable to Authentication Bypass | |||
| CVE-2024-6875 | unknown | — | — | 1y ago | Infinispan Potential Out of Memory Error via REST Compare API Buffer API | |||
| CVE-2024-48944 | unknown | — | — | 1y ago | Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint | |||
| CVE-2024-12369 | unknown | — | — | 1y ago | WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack | |||
| CVE-2024-8616 | unknown | — | — | 1y ago | H2O Vulnerable to Arbitrary File Overwrite | |||
| CVE-2024-8062 | unknown | — | — | 1y ago | H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request | |||
| CVE-2024-7765 | unknown | — | — | 1y ago | H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing | |||
| CVE-2024-7768 | unknown | — | — | 1y ago | H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint | |||
| CVE-2024-6863 | unknown | — | — | 1y ago | H2O Vulnerable to Execution of Arbitrary Files | |||
| CVE-2024-6854 | unknown | — | — | 1y ago | H2O Vulnerable to Arbitrary File Overwrite via File Export | |||
| CVE-2024-10553 | unknown | — | — | 1y ago | H2O Deserialization of Untrusted Data Vulnerability | |||
| CVE-2024-10550 | unknown | — | — | 1y ago | H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint | |||
| CVE-2024-10549 | unknown | — | — | 1y ago | H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint | |||
| CVE-2024-10572 | unknown | — | — | 1y ago | H2O Vulnerable to Denial of Service (DoS) and File Write | |||
| CVE-2024-47552 | unknown | — | — | 1y ago | Apache Seata Vulnerable to Deserialization of Untrusted Data | |||
| CVE-2024-54016 | unknown | — | — | 1y ago | Apache Seata Vulnerable to Data Amplification | |||
| CVE-2024-58103 | unknown | — | — | 1y ago | Wire has Uncontrolled Recursion on Nested Groups | |||
| CVE-2024-55532 | unknown | — | — | 1y ago | Apache Ranger Improper Neutralization of Formula Elements vulnerability | |||
| CVE-2024-24778 | unknown | — | — | 1y ago | Apache StreamPipes has improper privilege management in a REST interface | |||
| CVE-2024-2321 | unknown | — | — | 1y ago | WSO2 incorrect authorization vulnerability | |||
| CVE-2024-4028 | unknown | — | — | 1y ago | Keycloak allows cross-site scripting (XSS) | |||
| CVE-2024-56180 | unknown | — | — | 1y ago | Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution | |||
| CVE-2024-52577 | unknown | — | — | 1y ago | Apache Ignite: Possible RCE when deserializing incoming messages by the server node |