CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- apache ozoneApache Ozone: Improper authentication when generating S3 secrets8.1 High
- paulnagle bmlt tabbed mapBMLT Tabbed Map <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- northern beaches websites ideapushIdeaPush <= 8.71 - Missing Authorization to Board Term Deletion4.3 Medium
- venutius bp profile shortcodes extraBP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter6.5 Medium
- soraco quick license manager – woocommerce pluginQuick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting6.1 Medium
- mlaza jalbum bridgejAlbum Bridge <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter6.4 Medium
- akashmalik scratch & win – giveaways and contests. boost subscribers, traffic, repeat visits, referrals, sales and more, appsmav scratch \& win +1 moreScratch & Win – Giveaways and Contests <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- taunoh form data collectorForm Data Collector <= 2.2.3 - Reflected Cross-Site Scripting6.1 Medium
- wphocus my auctions allegroMy auctions allegro <= 3.6.17 - Reflected Cross-Site Scripting6.1 Medium
- gsplugins gs pinterest portfolio, samdani gs pinterest portfolio – pins grid, masonry, user profile, popup & board widgets +1 moreWordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bdthemes element pack, element pack – widgets, templates & addons for elementor +1 moreElement Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget6.4 Medium
- unknown wp booking calendarWP Booking Calendar < 10.6.5 - Admin+ Stored XSS4.8 Medium
- samsung quick share, samsung mobile quick share agent +1 morePath traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in...4.3 Medium
- samsung mobile gaminghub, gaming hub +1 moreImproper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in...7.5 High
- samsung mobile gaminghubInsufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7...4.3 Medium
- samsung mobile gaminghubInsufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7...6.5 Medium
- samsung smart touch callUse of implicit intent for sensitive communication in Smart Touch Call prior to 1.0.0.8 allows...2.0 Low
- samsung smartthingsUse of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows...4.0 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to...8.1 High
- samsung android, samsung mobile devices +1 moreAuthentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows...2.4 Low
- samsung android, samsung mobile devices +1 moreImproper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1...7.1 High
- samsung mobile devicesImproper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to...5.5 Medium
- samsung android, samsung mobile devices +1 morePath Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy...4.3 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers...5.9 Medium
- brainstormforce spectra, spectra gutenberg blocks – website builder for the block editor +1 moreSpectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget6.4 Medium
- hitachi ops center common services, ops center ova +1 moreAuthentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA7.1 High
- cmsmasters elementor addonCMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- zyxel vmg4005-b50a firmware, emg6726-b10a firmware, vmg3927-b50b firmware +3 more +5 moreA post-authentication command injection vulnerability in the "host" parameter of the diagnostic...7.2 High
- zyxel vmg3625-t50b firmware, ax7501-b0 firmware, ax7501-b1 firmware +33 more +35 moreA post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program...4.9 Medium
- zyxel vmg8825-t50k firmware, ax7501-b0 firmware, ax7501-b1 firmware +61 more +63 moreA buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in...7.5 High
- google androidIn process_service_search_attr_rsp of sdp_discovery.cc, there is a possible out of bound read due...5.5 Medium
- google androidIn sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds read due to an...5.5 Medium
- samsung magicianAn issue was discovered in the installer in Samsung Magician 8.1.0 on Windows. An attacker can...2.8 Low
- sem-cms semcmsSeecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php...3.8 Low
- No product listedInsecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.9.8 Critical
- beijing digital china cloud technology imcloudAn issue in Beijing Digital China Yunke Information Technology Co.Ltd v.7.2.6.120 allows a remote...8.8 High
- mochimqttAn issue in mochiMQTT v2.6.3 allows attackers to cause a Denial of Service (DoS) via a crafted...7.5 High
- cephCeph is vulnerable to authentication bypass through RadosGW8.1 High
- aedes project aedesAn issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request.7.5 High
- No product listedAn authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of...8.8 High
- infodom performa 365An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their...8.8 High
- No product listedAn issue was discovered in Centreon centreon-bam 24.04, 23.10, 23.04, and 22.10. SQL injection...7.2 High
- No product listedAn issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker...7.8 High
- google androidIn gatt_process_error_rsp of gatt_cl.cc, there is a possible out of bound read due to a missing...5.5 Medium
- google androidIn OSUInfo of OSUInfo.java, there is a possible escalation of privilege due to improper input...7.8 High
- google androidIn prop2cfg of btif_storage.cc, there is a possible out of bounds write due to an incorrect...9.8 Critical
- google androidIn buildImageItemsIfPossible of ItemTable.cpp there is a possible out of bound read due to...6.5 Medium
- google androidIn RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect...7.5 High
- google androidIn ihevcd_parse_slice_header of ihevcd_parse_slice_header.c there is a possible out of bound read...6.5 Medium
- google android, pixel +1 moreIn handle_app_cur_val_response of dtif_rc.cc, there is a possible stack buffer overflow due to a...9.8 Critical
- Show moreLoading…