CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- drupal minify jsMinify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-0704.5 Medium
- dependencytrack dependency-trackDependency-Track allows enumeration of managed users via /api/v1/user/login endpoint5.3 Medium
- cliGitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability6.3 Medium
- allaccessible accessibility, accessibility by allaccessible +1 moreAccessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update8.8 High
- solana-labs solana-web3.js@solana/web3.js modified package published to npm, containing malware that exfiltrates private key material8.3 High
- download all files project all files, drupal download all files +1 moreDownload All Files - Critical - Access bypass - SA-CONTRIB-2024-0695.3 Medium
- convert forms project forms, tassos.gr convert forms component for joomla +1 moreExtension - tassos.gr - Reflected Cross site scripting vulnerability in Convert Forms component for Joomla < 4.4.85.4 Medium
- convert forms project forms, tassos.gr convert forms component for joomla, tassosgr convert forms +2 moreExtension - tassos.gr - Unrestricted file upload in Convert Forms component for Joomla < 4.4.89.8 Critical
- djangoproject djangoDjango SQL injection in HasKey(lhs, rhs) on Oracle9.8 Critical
- djangoproject djangoDjango denial-of-service in django.utils.html.strip_tags()7.5 High
- ciandt pages restriction accessPages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-0685.3 Medium
- drupal oauth & openid connect single sign on – sso (oauth/oidc client), miniorange oauth \& openid connect single sign-on +1 moreOAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-0676.1 Medium
- arcinfo pcvueClient Secret not checked with OAuth Password grant type2.3 Low
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 morenetlink: terminate outstanding dump on socket close7.8 High
- linux, linux kernel +1 moresctp: fix possible UAF in sctp_v6_available()7.8 High
- linux, linux kernel +1 morenet/mlx5e: kTLS, Fix incorrect page refcounting9.8 Critical
- linux, linux kernel +1 moreARM: fix cacheflush with PAN5.5 Medium
- linux, linux kernel +1 moremm: revert "mm: shmem: fix data-race in shmem_getattr()"7.5 High
- linux, linux kernel +1 moreKVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN8.8 High
- linux, linux kernel +1 morepmdomain: imx93-blk-ctrl: correct remove path5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: Handle dml allocation failure to avoid crash7.8 High
- linux, linux kernel +1 moredrm/xe/oa: Fix "Missing outer runtime PM protection" warning5.5 Medium
- linux, linux kernel +1 morenilfs2: fix null-ptr-deref in block_touch_buffer tracepoint5.5 Medium
- linux, linux kernel +1 morenilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint5.5 Medium
- linux, linux kernel +1 moredrm/rockchip: vop: Fix a dereferenced before check warning5.5 Medium
- linux, linux kernel +1 moresched/task_stack: fix object_is_on_stack() for KASAN tagged pointers5.5 Medium
- linux, linux kernel +1 moreRevert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"7.8 High
- linux, linux kernel +1 morevdpa: solidrun: Fix UB bug with devres7.1 High
- linux, linux kernel +1 morebpf: sync_linked_regs() must preserve subreg_def7.8 High
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container command execution8.8 High
- order up online ordering systemBusiness Logic Error in RestApp Inc.'s Online Ordering System5.3 Medium
- horillahorilla create_skills deserialization5.3 Medium
- neotrendy email address obfuscationEmail Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter6.4 Medium
- infinix mobile com.transsion.agingfunction, com.transmission.agingfunction +1 moreUnauthorized factory reset of Infinix devices9.4 Critical
pyo3crates.ioBuild corruption when using `PYO3_CONFIG_FILE` environment variableNo scorepprofcrates.ioUnsound usages of `std::slice::from_raw_parts`No score- open design alliance oda drawings sdk - all versions < 2025.10Out-of-bounds Write vulnerability in ODA SDK versions < 2025.108.1 High
- docusignAI Assistant PDF Document Spoofing in DocuSign8.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of...3.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype...4.2 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project...3.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in...8.0 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible...3.1 Low
- wpbits addons for elementor page builderWPBITS Addons For Elementor Page Builder <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- webilia listdom: ai-powered business directory with classifieds ads listingsListdom – Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter6.4 Medium
- d3tn ud3tn, d3tn gmbh µd3tn +1 moreDouble Free in µD3TN7.5 High
- shenzhen tenda technology co tenda ac6v2, tenda ac6 firmware +1 moreDenial of Service on Tenda AC6V2 Due To Stack Overflow8.3 High
- shenzhen tenda technology co tenda ac6v2, tenda ac6 firmware +1 moreDenial of Service on Tenda AC6V2 Due To Stack Overflow8.3 High
- shenzhen tenda technology co tenda ac6v2, tenda ac6 firmware +1 moreDenial of Service on Tenda AC6V2 Due To Stack Overflow8.3 High
- Show moreLoading…