CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- lizeipe flash news / post (responsive)WordPress Flash News / Post (Responsive) plugin <= 4.1 - CSRF to Privilege Escalation vulnerability9.8 Critical
- kyle m brown wp simple pay lite managerWordPress WP Simple Pay Lite Manager Plugin <= 1.4 - SQL Injection vulnerability7.6 High
- ewald harmsen mollie for contact form 7WordPress Mollie for Contact Form 7 plugin <= 5.0.0 - SQL Injection vulnerability7.6 High
- dusthazard popup surveys & polls for wordpress (mare.io)WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin <= 1.36 - Settings Change vulnerability5.4 Medium
- chris gardenberg eduadmin bookingWordPress EduAdmin Booking plugin <= 5.2.0 - Local File Inclusion vulnerability7.5 High
- alex w fowler easy site importerWordPress Easy Site Importer plugin <= 1.0.1 - Settings Change vulnerability5.4 Medium
- dave kiss vimeographyWordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability5.3 Medium
MozillaFirefoxopenSUSESecurity update for MozillaFirefoxNo score- invoiceplaneInvoicePlane 1 upload_file unrestricted upload5.3 Medium
- invoiceplaneInvoicePlane invoices.php download path traversal5.3 Medium
- mattermost, mattermost server +1 moreZipbomb DoS via Missing Slack Import Validation6.5 Medium
- mattermost, mattermost server +1 moreDoS via lack of type validation in Calls6.5 Medium
- mattermost, mattermost server +1 moreBypass of "Max failed attempts" restriction via race condition4.8 Medium
- chunghwa telecom topm-clientChunghwa Telecom topm-client - Arbitrary File Delete8.1 High
- trellix dlp extensionA Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the...5.3 Medium
- chunghwa telecom topm-clientChunghwa Telecom topm-client - Arbitrary File Read6.5 Medium
- chunghwa telecom tbm-clientChunghwa Telecom tbm-client - Arbitrary File Copy and Paste7.1 High
- chunghwa telecom tbm-clientChunghwa Telecom tbm-client - Arbitrary File Delete8.1 High
- trellix dlp extensionAn SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an...4.9 Medium
- cht tenderdoctransferChunghwa Telecom TenderDocTransfer - Arbitrary File Write8.1 High
- cht tenderdoctransferChunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE9.6 Critical
- stellarwp the events calendarThe Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure5.3 Medium
- jordangillman tithe.ly giving buttonTithe.ly Giving Button <= 1.1 - Contributor+ Stored XSS via Shortcode5.4 Medium
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gitlabIncorrect Authorization in GitLab5.3 Medium
- cyberpanelCyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical...6.1 Medium
- logpoint siemAn issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while...5.9 Medium
- logpoint siemAn issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in...7.1 High
- logpoint siemAn issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while...5.9 Medium
- logpoint universal normalizerAn issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can...7.1 High
- No product listedCognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the...8.1 High
- No product listedui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric...9.8 Critical
- No product listedIntrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.5.4 Medium
- ujcmsA URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the...5.4 Medium
- ujcmsA Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and...4.8 Medium
- phpgurukul online nurse hiring systemOnline Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities...7.2 High
- phpgurukul online nurse hiring systemOnline Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the...7.2 High
- phpgurukul online nurse hiring systemA stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online...4.8 Medium
- getsimple-ce getsimple cmsGetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in...9.8 Critical
- cyberpanelCyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell...8.8 High
- sunbirddcim dctrackA cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to...4.8 Medium
- sunbirddcim dctrackIncorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a...7.5 High
- sunbirddcim dctrackA Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers...8.0 High
- sunbirddcim dctrackAn HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as...4.8 Medium
- No product listedBuffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to...9.8 Critical
- zephyrproject zephyrBluetooth: classic: avdtp: missing buffer length check7.5 High
- radare radare2Radare2: command injection via pebble application files in radare28.6 High
- percona percona-toolkit, toolkit +1 moreMisuse of SHA256 to create an encryption key5.1 Medium
ndpiOSS-FuzzIndex-out-of-bounds in ndpi_search_dnsNo scorelibredwgOSS-FuzzIndex-out-of-bounds in dwg_decode_eedNo score- Show moreLoading…