CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- tomroyal stop registration spamStop Registration Spam <= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting6.1 Medium
- vivo alarm clockInformation disclosure vulnerability in Alarm clock module5.5 Medium
- vivo permission manager modulePermission bypass vulnerability in permission manager module7.9 High
- schneider electric harmony (formerly magelis) hmist6, hmistm6, hmig3u, hmig3x, hmisto7 series with ecostruxure operator terminal expert runtime, pfxst6000, pfxstm6000, pfxsp5000, pfxgp4100 series with pro-face blue runtime +1 moreCWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause...8.7 High
- broadcom ca client automation (itcm)Improper Privilege Management Vulnerability in CA Client Automation 14.57.3 High
- shueisha inc. "shonen jump+" app for androidImproper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android...3.3 Low
- soflyy wp all import proWP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import7.6 High
- gqevu6bsiz my wp customize admin/frontendCross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver...4.8 Medium
- beyondtrust privileged remote access, privileged remote access (pra) and remote support (rs), remote support +2 moreCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)9.8 Critical
- vivo weatherInformation disclosure vulnerability in Weather module5.9 Medium
- vivo wifiSensitive information leakage vulnerability in wifi module6.3 Medium
- vivo abeCommand Execution Vulnerability in ABE service7.0 High
- vivo wifiWhen using special mode to connect to enterprise wifi, certain options are not properly...6.4 Medium
- ideaboxcreations powerpack lite for beaver builder, ideabox powerpack for beaver builder +1 morePowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter6.1 Medium
- hitachi infrastructure analytics advisor, ops center analyzer +1 moreAuthorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer9.4 Critical
- raisecom msg1200 firmware, msg2100e firmware, msg2200 firmware +1 more +3 moreA vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. The...9.1 Critical
- raisecom msg1200 firmware, msg2100e firmware, msg2200 firmware +1 more +3 moreA vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component...9.8 Critical
- raisecom msg1200 firmware, msg2100e firmware, msg2200 firmware +1 more +3 moreA vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component...6.3 Medium
- raisecom msg1200 firmware, msg2100e firmware, msg2200 firmware +1 more +3 moreA vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component...9.1 Critical
- 1000projects bookstore management systemA vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project...9.1 Critical
- phpgurukul online birth certificate systemA stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate...6.1 Medium
- phpgurukul online birth certificate systemAn insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online...4.3 Medium
- phpgurukul online birth certificate systemPhpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements...5.4 Medium
- phpgurukul online birth certificate systemA stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth...5.4 Medium
danteAlpineDante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf...9.1 Critical- No product listedAn issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the...7.5 High
com.databricks:databricks-jdbcMavenDatabricks JDBC Driver Command Injection vulnerability7.3 High- dlink dap-2555 firmwareA Buffer overflow vulnerability in D-Link DAP-2555 REVA_FIRMWARE_1.20 allows remote attackers to...6.5 Medium
- dlink dcs-932l firmwareA Stack overflow vulnerability in D-Link DCS-932L REVB_FIRMWARE_2.18.01 allows attackers to cause...6.5 Medium
- dlink dir-860l firmwareA NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to...6.5 Medium
- dlink dap-1513 firmwareA NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_1.01 allows attackers to cause a...7.5 High
- dlink dap-1520 firmwareA NULL pointer dereference in the plugins_call_handle_uri_clean function of D-Link DAP-1520...5.3 Medium
- rizinrizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set...9.1 Critical
- radare radare2Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary...9.8 Critical
- red hat fast datapath for red hat enterprise linux 8, fast datapath for red hat enterprise linux 9, fast datapath for rhel 7 +12 more +14 moreDpdk: denial of service from malicious guest on hypervisors using dpdk vhost library7.4 High
- cswaim tpg get postsTPG Get Posts <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- freeben animated countersAnimated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- slopeit slope widgetsSlope Widgets <= 4.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- logichunt portfolio – filterable masonry portfolio gallery for professionalsPortfolio – Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- crmperks crm perks – wordpress helpdesk integration – zendesk, freshdesk, helpscoutCRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tom royal stop registration spamWordPress Stop Registration Spam Plugin <= 1.23 - CSRF to Stored XSS vulnerability7.1 High
- geoserverWelcome and About GeoServer pages communicate version and revision information5.3 Medium
- metabaseMetabase sandboxed users could see filter values from other sandboxed users4.8 Medium
- invoiceplaneInvoicePlane view session expiration6.3 Medium
- classcmsClassCMS User Management Page admin insufficient privileges5.1 Medium
cosmossdk.io/x/txGo,github.com/cosmos/cosmos-sdkGo +1 moreASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion8.7 High- ruifang-tech rebuildruifang-tech Rebuild Task Comment Attachment Upload cross site scripting5.3 Medium
- ruifang-tech rebuildruifang-tech Rebuild Project Task Comment cross site scripting5.3 Medium
- plextracInsecure YAML Deserialization8.6 High
- funnyzpc mee-adminfunnyzpc Mee-Admin Login login observable response discrepancy6.3 Medium
- Show moreLoading…