CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- shenzhen tenda technology co tenda ac6v2, tenda ac6 firmware +1 moreDenial of Service on Tenda AC6V2 Due To Stack Overflow8.3 High
- docusealPDF Document Spoofing in DocuSeal8.2 High
- docusignPDF Document Spoofing in DocuSign8.2 High
- algoritmika additional custom order status for woocommerceAdditional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting6.1 Medium
- bplugins b testimonial – customer testimonials in custom layoutsB Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builder, bqworks accordion slider, colorlibplugins fancybox for wordpress +13 more +15 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library6.4 Medium
- classic addons – wpbakery page builder, webcodingplace classic addons – wpbakery page builder, classic addons wp bakery page builder plugin for wordpress +2 moreClassic Addons – WPBakery Page Builder <= 3.0 - Authenticated (Contributor+) Limited Local PHP File Inclusion7.5 High
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- templateinvaders ti woocommerce wishlist, woocommerce +1 moreTI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access7.5 High
- timsayshey wp ecards – branded digital greeting cardsWP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- astoundify wp job manager – company profiles, wp job manager +1 moreWP Job Manager – Company Profiles <= 1.7 - Reflected Cross-Site Scripting6.1 Medium
- floristone flower delivery by florist oneFlower Delivery by Florist One <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- genetech solutions pie register - social sites login (add on), genetechsolutions pie register +1 moreRegistration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login <= 1.7.9 - Authentication Bypass via WordPress…8.1 High
- codesavory knowledge base documentation & wiki plugin – basepress docsKnowledge Base documentation & wiki plugin – BasePress Docs <= 2.16.3.3 - Missing Authorization to Authenticated (Subscriber+) Database Update4.3 Medium
- tomasgroulik intro tour tutorial deeppresentationIntro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting6.1 Medium
- solarwinds platformSolarWinds Platform Cross- Site Scripting Vulnerability7.0 High
- synology surveillance stationIncorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance...4.3 Medium
- synology surveillance stationIncorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance...4.3 Medium
- synology router manager, router manager (srm) +1 moreImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in...8.1 High
- moxa eds-405a series, eds-408a series, eds-505a series +45 more +47 moreDenial-of-Service Vulnerability6.9 Medium
- getdollie dollie ai – connectDollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- searchiq, searchiq – the search solution +1 moreSearchIQ – The Search Solution <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- issuetrakUnauthorized Modification of Ticket Requester5.3 Medium
- calliko nps computyNPS computy <= 2.8.0 - Reflected Cross-Site Scripting6.1 Medium
- wpenhanced responsive videosResponsive Videos <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- aminshah74 pulsating chat buttonPulsating Chat Button <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- smarettheme eleblog – elementor blog and magazine addonsEleblog – Elementor Blog And Magazine Addons <= 1.8 - Missing Authorization to Authenticated (Subscriber+) Deactivation Submission4.3 Medium
- mightyforms contact form, survey & form builder – mightyforms, mightyforms +1 moreContact Form, Survey & Form Builder – MightyForms <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- burgthaleratsirconic sg helperSG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload5.5 Medium
- wpkube authors listAuthors List <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax7.3 High
- funnelforms interactive contact form and multi step form builder with drag & drop editor – funnelforms free, interactive contact form and multi step form builder with drag and drop editor funnelforms free +1 moreFunnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection8.8 High
- posti shipping, postioy posti shipping +1 morePosti Shipping <= 3.10.3 - Reflected Cross-Site Scripting6.1 Medium
- asus rt-ax55, rt-ax55 v2, rt-ax56u +4 more +6 moreAn improper input validation vulnerability leads to device crashes in certain ASUS router models....4.4 Medium
- veeam backup & replication, backup \& replication +1 moreA vulnerability exists where a low-privileged user can exploit insufficient permissions in...7.7 High
- veeam agent, agent for windows +1 moreDLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes...7.0 High
- veeam service provider consoleA vulnerability in Veeam Service Provider Console has been identified, which allows to perform...6.5 Medium
- ubiquiti unifi ios app, ui unifi +1 moreAn Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point ...7.1 High
- veeam backup & replication, backup \& replication +1 moreA vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose...7.7 High
- veeam backup & replication, backup and replication, backup \& replication +2 moreA vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a...8.8 High
- veeam backup & replication, backup and replication, backup \& replication +2 moreA vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting...7.1 High
- veeam backup & replication, backup \& replication +1 moreA vulnerability Veeam Backup & Replication allows low-privileged users to control and modify...7.4 High
- veeam agent, backup & replication, backup \& replication +2 moreA vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent...8.8 High
- veeam backup & replication, backup \& replication +1 moreA vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved...7.7 High
- veeam service provider consoleFrom the VSPC management agent machine, under condition that the management agent is authorized...7.1 High
- veeam backup & replication, backup and replication, backup \& replication +2 moreA vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to...8.8 High
- issuetrakAuthenticated HTML Injection in Issuetrak Ticket Comment Function5.1 Medium
- No product listedapp/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the...6.1 Medium
- No product listedapp/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when...6.1 Medium
- dest-unreach socatreadline.sh in socat through 1.8.0.1 relies on the /tmp/$USER/stderr2 file.9.8 Critical
- No product listedA hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive...6.5 Medium
- Show moreLoading…