CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- tp-link tl-wr845n firmwareTP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form,...8.0 High
- tp-link tl-wr845n firmwareTP-Link TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to transmit user...9.8 Critical
- No product listedAn issue was discovered in MSA Safety FieldServer Gateways and Embedded Modules with build...9.8 Critical
- No product listedAn issue was discovered in MSA Safety FieldServer Gateways and Embedded Modules with build...9.8 Critical
- papercut mf, ng +1 moreReflected XSS in PaperCut MF6.3 Medium
- drupal, drupal core +1 moreDrupal core - Critical - Cross Site Scripting - SA-CORE-2024-0056.1 Medium
- tenable security centerAn Improper Certificate Validation vulnerability exists in Tenable Security Center where an...2.7 Low
- red hat build of keycloak, jboss enterprise application platform 7, jboss enterprise application platform 8 +1 more +3 moreElytron-oidc-client: oidc authorization code injection4.2 Medium
- gohugoio hugoHugo does not escape some attributes in internal templates5.3 Medium
- thephpleague commonmarkleague/commonmark before 2.6.0 Denial of Service via Quadratic Complexity8.7 High
- wintercms winterWinter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion8.5 High
- directusDirectus allows unauthenticated access to WebSocket events and operations7.5 High
- gstreamerGHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser6.8 Medium
- gstreamerGHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer8.6 High
- gstreamerGHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header8.6 High
- gstreamerGHSL-2024-248: GStreamer has an OOB-read in format_channel_mask5.1 Medium
- gstreamerGHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference6.8 Medium
- gstreamerGHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parser6.9 Medium
- gstreamerGHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet8.6 High
- arcinfo pcvueUser credentials recorded in log files1.8 Low
- altair-graphql altairAltair GraphQL Client's desktop app does not validate HTTPS certificates6.8 Medium
- basecamp trixTrix vulnerable to Cross-site Scripting on copy & paste5.1 Medium
- enalean tuleapTuleap vulnerable to XSS in the Gantt chart of the tracker plugin5.4 Medium
- elabftweLabFTW MFA bypass5.4 Medium
- autodesk revitA maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause...7.8 High
- autodesk revitUntrusted Search Path vulnerability in Autodesk Revit7.8 High
- autodesk revitPDF File Parsing Vulnerability in Autodesk Revit5.5 Medium
- dell openmanage server administratorDell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access...4.3 Medium
- dell openmanage server administratorDell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input...5.4 Medium
- autodesk fbx sdk, fbx software development kit +1 moreOut-of-Bounds Write Vulnerability in in Autodesk Desktop Software4.4 Medium
- dell power manager (dpm), power manager +1 moreDell Power Manager (DPM), versions prior to 3.17, contain an improper access control...7.8 High
- dell ecs, elastic cloud storage +1 moreDell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low...4.3 Medium
- dell powerscale onefsDell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource...4.3 Medium
- dfinity motokoUninitialized memory access in Motoko incremental garbage collector5.6 Medium
- dell powerscale onefsDell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument...4.3 Medium
- dell powerscale onefsDell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking...6.5 Medium
- apache supersetApache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled7.6 High
- apache supersetApache Superset: Error verbosity exposes metadata in analytics databases5.3 Medium
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific postgres functions2.3 Low
- eryaz information technologies natracar b2b dealer management programUnauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program9.8 Critical
- profilepressWordPress ProfilePress plugin <= 4.13.1 - Broken Access Control vulnerability5.3 Medium
- adnan analytify, analytify - google analytics dashboard +1 moreWordPress Analytify plugin <= 5.4.3 - Broken Access Control vulnerability6.5 Medium
- thehp aio contactWordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Plugin Settings Change vulnerability6.5 Medium
- wpmart team memberWordPress Team Member – Multi Language Supported Team plugin <= 7.4 - Limited Local File Inclusion vulnerability4.3 Medium
- genetech pie register premium, genetechsolutions pie register +1 moreWordPress Pie Register Premium plugin < 3.8.3.3 - Broken Access Control vulnerability5.3 Medium
- astoundify jobify, jobify-job board +1 moreWordPress Jobify plugin < 4.3.0 - Broken Access Control vulnerability5.3 Medium
- alexander volkov chatterWordPress Chatter plugin <= 1.0.1 - Broken Access Control vulnerability4.3 Medium
- themeum tutor lms elementor addonsWordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability4.3 Medium
- repute info systems arformsWordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability5.4 Medium
- ogun labs lenxel core for lenxel(lnx) lmsWordPress Lenxel Core plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…