CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- gstreamerGHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling6.8 Medium
- gstreamerGHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container5.1 Medium
- gstreamerGHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer8.6 High
- gstreamerGHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a8.6 High
- veeam service provider consoleFrom the VSPC management agent machine, under condition that the management agent is authorized...9.9 Critical
- ivanti connect secure, policy secure +1 moreAn out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote...7.5 High
- ivanti connect secure, policy secure +1 moreA heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a...7.5 High
- gstreamerGHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c8.6 High
- b3log siyuanSiYuan has an arbitrary file read via /api/template/render8.7 High
- b3log siyuanSiYuan has an arbitrary file read and path traversal via /api/export/exportResources8.7 High
- b3log siyuanSiYuan has an arbitrary file write in the host via /api/asset/upload8.7 High
- b3log siyuanSiYuan has an SSTI via /api/template/renderSprig6.9 Medium
github.com/kcp-dev/kcpGokcp's impersonation allows access to global administrative groups6.4 Medium- golang.org/x/crypto golang.org/x/crypto/sshMisuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto9.1 Critical
- cjbi wetech-cmscjbi wetech-cms TopicDao.java searchTopicByKeyword sql injection5.3 Medium
- google chromeUse after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to...8.8 High
- glpi-project glpiGLPI vulnerable to unauthenticated session hijacking9.3 Critical
- glpi-project glpiGLPI vulnerable to authenticated insecure account deletion7.2 High
- glpi-project glpiGLPI vulnerable to account takeover via the password reset feature7.5 High
- glpi-project glpiGLPI vulnerable to account takeover via API7.5 High
- drupal open socialOpen Social - Moderately critical - Access bypass - SA-CONTRIB-2024-0765.3 Medium
- ivanti application controlUnder specific circumstances, insecure permissions in Ivanti Application Control before version...7.8 High
- ivanti performance managerUnder specific circumstances, insecure permissions in Ivanti Performance Manager before version...7.8 High
- ivanti workspace controlUnder specific circumstances, insecure permissions in Ivanti Workspace Control before version 10...7.8 High
- ivanti automationUnder specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1...7.8 High
- ivanti security controlsUnder specific circumstances, insecure permissions in Ivanti Security Controls before version...7.8 High
- image access gmbh scan2netCross-Site Request-Forgery6.3 Medium
- glpi-project glpiGLPI vulnerable to account takeover without privilege escalation through the API7.6 High
- image access gmbh scan2netViolation of Least Privilege Principle6.1 Medium
- image access gmbh scan2netPrivilege escalation through sudo misconfiguration8.8 High
- apache strutsApache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks9.5 Critical
- numerix llc license server administration systemReflected Cross-Site Scripting4.7 Medium
- allow all file extensions for file fields project all file extensions for file fields, drupal allow all file extensions for file fields +1 moreAllow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-0757.3 High
- drupal git utilities for drupal, git utilities project utilities +1 moreGit Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-0746.5 Medium
- drupal login disable, login disable project disable +1 moreLogin Disable - Critical - Access bypass - SA-CONTRIB-2024-0735.4 Medium
- tickera restrict – membership, site, content and user access restrictions for wordpressRestrict – membership, site, content and user access restrictions for WordPress <= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure4.3 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure3.1 Low
- joe waymarkWaymark <= 1.4.1 - Reflected Cross-Site Scripting via 'content'6.1 Medium
- jottlieb last viewed posts by wpbeginnerLast Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure5.3 Medium
- shakee93 rapidload ai – optimize web vitals automaticallyRapidLoad – Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection7.1 High
- supercleanse members – membership & user role editor pluginMembers <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- rapid7 insight platformRapid7 Insight Platform Privilege Escalation Vulnerability5.3 Medium
- schneider electric modicon controllers m241 / m251, modicon controllers m258 / lmc058 +1 moreCWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and...9.3 Critical
- ninja team notibarWordPress Notibar plugin <= 2.1.4 - Broken Access Control vulnerability4.3 Medium
- teamviewer patch & asset managementInsufficient permissions in the TeamViewer Patch & Asset Management component7.1 High
- schneider electric powerchute serial shutdownCWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the...6.3 Medium
- thimpress wp pipesWP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter6.1 Medium
- wpclever wpc order notes for woocommerceWPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- Show moreLoading…