CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- heyewei jfinalcmsJFinalCMS save cross-site request forgery6.9 Medium
- guizhou xiaoma technology jpressGuizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting5.3 Medium
jinja2Debianjinja2 - regression updateNo score- No product listedOxide before 6 has unencrypted Control Plane datastores.5.7 Medium
- No product listedAn issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR....7.5 High
- No product listedAn issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An...8.8 High
- zammadZammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and...4.3 Medium
colpackDebianColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name...6.6 Mediumnanoidnpm,automation-controller-venv-towerRed Hat,automation-gateway-serverRed Hat +63 more +65 morePredictable results in nanoid generation when given non-integer values4.3 Medium- perl posix 2028The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.9.8 Critical
- bitcoin coreBitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a...5.3 Medium
- lopalopa e-learning management systemA Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows...7.5 High
- lopalopa e-learning management systemA Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows...5.3 Medium
- lopalopa e-learning management systemA Stored Cross-Site Scripting (XSS) vulnerability was found in the /send_message.php of Kashipara...5.4 Medium
- lopalopa e-learning management systemA Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student...5.4 Medium
- lopalopa e-learning management systemKashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class...9.8 Critical
- lopalopa e-learning management systemKashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin...7.2 High
- lopalopa e-learning management systemKashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin...9.8 Critical
- lopalopa e-learning management systemA SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1...9.8 Critical
- lopalopa e-learning management systemKashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin...7.2 High
- lopalopa e-learning management systemKASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin...7.2 High
- lopalopa e-learning management systemkashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin...7.2 High
- lopalopa e-learning management systemKashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users...7.2 High
- lopalopa e-learning management systemA SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management...8.8 High
- lopalopa e-learning management systemA SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System...9.8 Critical
- lopalopa e-learning management systemA SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1...9.8 Critical
- lopalopa e-learning management systemA SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning...9.8 Critical
- lopalopa e-learning management systemA SQL Injection was found in /lms/admin/edit_user.php of kashipara E-learning Management System...7.2 High
- lopalopa e-learning management systemA SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0,...9.8 Critical
- lopalopa e-learning management systemA SQL Injection vulnerability was found in the /teacher_signup.php of kashipara E-learning...9.8 Critical
- lopalopa e-learning management systemA Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning...5.4 Medium
- lopalopa e-learning management systemKashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File...9.8 Critical
- infiniflow ragflowRAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized...7.5 High
cookie-encrypternpmBit flip attack vulnerability in cookie-encrypter9.1 Critical- digi connectport lts firmwareAn issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an...8.8 High
- digi connectport lts firmwareAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation...8.8 High
- digi connectport lts firmwareAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal...8.8 High
- digi connectport lts firmwareAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload...8.0 High
- No product listedServiceware Processes 6.0 through 7.3 allows attackers without valid authentication to send a...9.8 Critical
- No product listedA vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3...7.5 High
unstructuredPyPI,github.com/Unstructured-IO/unstructuredGo,govulncheck-vulndbopenSUSE +2 moreunstructured XML External Entity (XXE)9.8 Critical- pentaminds curovmsPentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.9.1 Critical
- pentaminds curovmsPentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information.7.5 High
- No product listedCross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker...4.8 Medium
- jigar-sable flipkart-clone-phpSQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title...9.8 Critical
- divscorp doctor-appointmentArbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php...9.8 Critical
- No product listedAMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer...4.3 Medium
- erzhongxmu jeewmsGuangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization6.9 Medium
- talenteraTalentera byt_cv_manager cross site scripting5.3 Medium
- tp-link vn020 f3v(t), vn020 f3v firmware +1 moreTP-Link VN020 F3v(T) FTP USER Command memory corruption5.3 Medium
- Show moreLoading…