CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- bunBun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo7.7 High
unisharp/laravel-filemanagerPackagistUniSharp Laravel Filemanager Code Injection vulnerability9.3 Critical- plex media serverAuthorization bypass through user-controlled key vulnerability in streaming service in Synology...7.5 High
- stylemix cost calculator builderCost Calculator Builder < 3.2.43 - Settings update via CSRF5.4 Medium
- red hat openshift container platform 4.18Ose-olm-catalogd-container: incomplete fix for rapid reset (cve-2023-39325/cve-2023-44487)6.5 Medium
- nicheaddons events addon for elementorEvents Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms +1 moreLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion4.3 Medium
- videowhisper video share vod – turnkey video site builder scriptVideo Share VOD – Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- zealopensource accept authorize.net payments using contact form 7Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure5.3 Medium
- sweetdaisy86 repairbuddy – repair shop crm & booking plugin for wordpressCRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation8.8 High
- robfelty collapsing categoriesCollapsing Categories <= 3.0.8 - Unauthenticated SQL Injection7.5 High
- ampforwp accelerated mobile pages, mohammed kaludi amp for wp – accelerated mobile pages +1 moreAMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting6.1 Medium
- wpclever wpc shop as a customer for woocommerceWPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key8.1 High
- rewardsfuel contests by rewards fuelContests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- philantro – donations and donor managementPhilantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tymotey easy waveform playerEasy Waveform Player <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- taeggie feedTaeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- aklaren scancircleScanCircle <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- dell inventory collector client, inventory collector +1 moreDell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution...7.8 High
sigstore-javaOSS-FuzzSecurity exception in com.google.gson.internal.bind.TypeAdapters$28.writeNo score- matterIn Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user...7.5 High
- matterIn raw\TCP.cpp in Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before 27ca6ec,...7.5 High
- matterIn Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes...7.5 High
- optimizely configured commerceIn Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and...6.1 Medium
- optimizely configured commerceIn Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and...8.1 High
- optimizely configured commerceIn Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and...4.7 Medium
- nicmx fort-validatorA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests...5.3 Medium
- nicmx fort validatorA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying...5.3 Medium
- amiro amiro.cmsA Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to...8.8 High
- amiro amiro.cmsA vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to...6.1 Medium
- codeastro complaint management systemAn IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates)...8.8 High
- codeastro complaint management systemAn issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate...8.8 High
- magicwinmail winmail serverWinmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).6.1 Medium
- seacmsSeaCMS <=13.0 is vulnerable to command execution in phome.php via the function...9.8 Critical
- portabilis i-educarA reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality...5.4 Medium
- phpgurukul online notes sharing management systemAn IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing...5.4 Medium
- phpgurukul online notes sharing management systemAn IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management...4.3 Medium
- rhymixRhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data...4.1 Medium
- getsimple-ce getsimple cmsGetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin...8.8 High
- getsimple-ce getsimple cmsIn the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be...7.2 High
- es iperf3, netapp hci compute node, ontap 9 +2 moreiperf v3.17.1 was discovered to contain a segmentation violation via the...7.5 High
- No product listedKeyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned...7.6 High
- No product listedKeyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows...4.3 Medium
- threatquotient threatqIn ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary...8.7 High
- No product listedInsecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before...4.6 Medium
- red hat build of keycloak, jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 moreKeycloak: cli option for encrypted jgroups ignored5.7 Medium
- red hat advanced cluster management for kubernetes 2Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens7.5 High
- ldapaccountmanager lamArbitrary config values override in lam6.5 Medium
- aiven-open pghoardPath Traversal in pghoard4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page4.8 Medium
- Show moreLoading…