CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- dell avamar, avamar server +1 moreDell Avamar, version(s) 19.9, contain(s) an Improper Neutralization of Special Elements used in...7.6 High
- wpdevelop email remindersEmail Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- karim42 quran multilanguage text & audioQuran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters6.1 Medium
- teltonika networks rutos, tswos, teltonika-networks rutos devices +2 moreIncorrect Permission Assignment in RutOS based routers and TSWOS based managed switches5.9 Medium
- propertyhive property hive mortgage calculatorProperty Hive Mortgage Calculator <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via price Parameter6.4 Medium
- solarwinds web help deskSolarWinds Web Help Desk Local File Read Vulnerability5.3 Medium
- image access gmbh scan2netOS Command Execution through Arbitrary File Upload7.2 High
- image access gmbh scan2netOS Command Injection7.3 High
- bowo system dashboardSystem Dashboard < 2.8.15 - Unauthenticated Stored XSS6.1 Medium
- bowo system dashboardSystem Dashboard < 2.8.15 - Admin+ Path Traversal4.9 Medium
- fooplugins foogallery, https://fooplugins.com foogallery premium +1 moreBest WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal7.7 High
luigiPyPIluigi Arbitrary File Write via Archive Extraction (Zip Slip)7.7 High- wpforms, smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more +1 moreWPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation8.5 High
- dell data lakehouse, insightiq, powerflex appliance +5 more +7 moreDell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack...10.0 Critical
- dell data lakehouse, insightiq, powerflex appliance +5 more +7 moreDell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack...8.2 High
libwebpOSS-FuzzHeap-buffer-overflow in ChunkAssignDataNo score- sap se netweaver application server abapInformation Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP8.5 High
- sap se netweaver administrator(system overview)Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)7.2 High
- sap se netweaver application server for abap and abap platformMissing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform4.3 Medium
- sap se netweaver as javaXML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA5.3 Medium
- sap se hcmMissing Authorization check in SAP HCM (Approve Timesheets version 4)4.3 Medium
- sap se netweaver as for java (adobe document services)Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)6.8 Medium
- sap se netweaver as for java (adobe document services)Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)6.8 Medium
- sap se netweaver as for java (adobe document services)Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)9.1 Critical
- sap se commerce cloudInformation Disclosure vulnerability in SAP Commerce Cloud2.7 Low
- sap se product lifecycle costingDLL Hijacking vulnerability in SAP Product Lifecycle Costing3.3 Low
- sap businessobjects business intelligence platformInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform5.3 Medium
shadercOSS-FuzzUNKNOWN READ in glslang::TInfoSinkBase::locationNo scoreunrarOSS-FuzzUse-of-uninitialized-value in Archive::UnexpEndArcMsgNo scoreshadercOSS-FuzzHeap-buffer-overflow in glslang::HlslGrammar::acceptDeclarationNo scoreshadercOSS-FuzzUNKNOWN READ in glslang::HlslTokenStream::advanceTokenNo score- No product listedWithdrawn Advisory: Nette Database SQL injection9.8 Critical
- mitel micollabMitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative...2.7 Low
whistlenpmAvenwu Whistle Cross-Site Request Forgery (CSRF)8.8 High- No product listedCOMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc...9.8 Critical
- No product listedAn injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core...7.6 High
- crushftpCrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account...9.8 Critical
- phpgurukul beauty parlour management systemA Cross Site Scripting (XSS) vulnerability in the profile.php of PHPGurukul Beauty Parlour...6.1 Medium
- phpgurukul beauty parlour management systemPhpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php`...9.8 Critical
- ketr jepaasSQL injection vulnerability in JEPAAS7.2.8, via /je/rbac/rbac/loadLoginCount in the dateVal...7.5 High
- silabs z-wave software development kitSilicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.4.6 Medium
- silabs z-wave software development kitAn issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.8.8 High
- silabs z-wave software development kitInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers...6.2 Medium
- silabs z-wave software development kitInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers...6.5 Medium
- silabs z-wave software development kitInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers...6.5 Medium
- silabs z-wave software development kitInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers...6.5 Medium
- silabs z-wave software development kitInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers...8.8 High
- tp-link tl-wr845n firmwareTP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were...8.0 High
- artifex mupdfArtifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component ...5.5 Medium
- No product listedAn issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication...9.8 Critical
- Show moreLoading…