CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- ibm cognos analyticsIBM Cognos Analytics cross-site scripting5.4 Medium
- ibm cognos analyticsIBM Cognos Analytics HTTP open redirection6.8 Medium
- ibm cognos analyticsIBM Cognos Analytics HTML injection5.4 Medium
- foxit reader, pdf editor, pdf reader +2 moreA use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox...8.8 High
- foxit reader, pdf editor, pdf reader +2 moreA use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page...8.8 High
hd-walletcrates.io,slip-10crates.io +1 more`Slip10Like` derivation method instantiated with certain curves may allow attacker to find derivation path which results into very long derivation (possible DoS)No scorejsiinpmPrototype pollution in jsii.configureCategories3.7 Low- rockwell automation pm1k 1408-bc3a-485, pm1k 1408-bc3a-ent, pm1k 1408-em1a-485 +11 more +13 moreRockwell Automation PowerMonitor™ 1000 Denial of Service9.3 Critical
- rockwell automation pm1k 1408-bc3a-485, pm1k 1408-bc3a-ent, pm1k 1408-em1a-485 +11 more +13 moreRockwell Automation PowerMonitor™ 1000 Denial of Service9.3 Critical
- ibm storage defender - resiliency service, storage defender resiliency service +1 moreIBM Storage Defender - Resiliency Service information disclosure5.7 Medium
- ibm storage defender - resiliency service, storage defender resiliency service +1 moreIBM Storage Defender - Resiliency Service information disclosure4.4 Medium
- ibm storage defender - resiliency service, storage defender resiliency service +1 moreIBM Storage Defender - Resiliency Service improper certificate validation5.9 Medium
- rockwell automation pm1k 1408-bc3a-485, pm1k 1408-bc3a-ent, pm1k 1408-em1a-485 +11 more +13 moreRockwell Automation PowerMonitor™ 1000 Remote Code Execution9.3 Critical
- astroBypass of CSRF Middleware in Astro5.9 Medium
- apache kafkaApache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption5.3 Medium
- fortinet forticlient, forticlientlinux, forticlientwindows +1 more +3 moreA Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0...4.9 Medium
- fortinet fortimanager, fortimanager cloud +1 moreAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...7.2 High
- fortinet fortiwlmA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5...9.6 Critical
agecrates.io,ragecrates.io +1 morerage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary executionNo score- yudiz solutions ltd. wp menu imageWordPress WP Menu Image plugin <= 2.2 - Broken Access Control vulnerability6.5 Medium
- web chunky order delivery & pickup location date timeWordPress Order Delivery & Pickup Location Date Time plugin <= 1.1.0 - Settings Change vulnerability6.5 Medium
- saoshyant element, saoshyant1994 saoshyant element +1 moreWordPress Saoshyant Element plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- david cramer bootstrap buttonsWordPress Bootstrap Buttons plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pierre lannoy device detectorWordPress Device Detector Plugin <= 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hjyl hmdWordPress hmd theme <= 2.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- maartenhemmes image mapperWordPress Image Mapper plugin <= 0.2.5.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rohit urane dr affiliateWordPress Dr Affiliate plugin <= 1.2.3 - SQL Injection vulnerability8.5 High
- susheelhbti saksh escrow systemWordPress Saksh Escrow System plugin <= 2.4 - SQL Injection vulnerability8.5 High
- derek hamilton powerformbuilderWordPress PowerFormBuilder plugin <= 1.0.6 - SQL Injection vulnerability8.5 High
- ydesignservices yds support ticket systemWordPress YDS Support Ticket System plugin <= 1.0 - SQL Injection vulnerability8.5 High
- denniskravetstns vrpconnectorWordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability9.8 Critical
- axeptioWordPress Axeptio plugin <= 2.5.4 - Local File Inclusion vulnerability8.1 High
- farinspace partnersWordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability9.8 Critical
- spreadr woocommerceWordPress Spreadr Woocommerce plugin <= 1.0.4 - Arbitrary Content Deletion vulnerability7.5 High
- asseco business solutions s.a. wapro erp desktopHardcoded Password in Wapro ERP Desktop9.3 Critical
- asseco business solutions s.a. wapro erp desktopProtocol Downgrade in Wapro ERP Desktop9.1 Critical
- shinetheme travel booking wordpress themeTraveler <= 3.1.6 - Unauthenticated SQL Injection via order_id7.5 High
- shinetheme travel booking wordpress themeTraveler <= 3.1.6 - Missing Authorization in Several AJAX Actions6.5 Medium
- cozmoslabs paid membership subscriptions – effortless memberships, recurring payments & content restriction, membership \& content restriction - paid member subscriptions +1 morePaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- ibm iIBM i incorrect privilege assignment6.8 Medium
- pkthree peter’s custom anti-spamPeter’s Custom Anti-Spam <= 3.2.3 - Cross-Site Request Forgery via cas_register_post Function5.4 Medium
- iovamihai affiliate program suite — slicewp affiliatesAffiliate Program Suite — SliceWP Affiliates <= 1.1.23 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- wealcoder animation addons for elementor – gsap motion elementor addons & website templatesAnimation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template4.3 Medium
- plugins and snippets simple page access restrictionSimple Page Access Restriction <= 1.0.29 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- mikado-themes biagiotti membershipBiagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user9.8 Critical
- fxc inc. ae1021, ae1021pe +1 moreInclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0...7.2 High
- fxc inc. ae1021, ae1021pe +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...7.2 High
- fxc inc. ae1021, ae1021pe +1 moreWeak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE...7.5 High
- oppo store appOPPO Store app include remote account token hijacking and sensitive information leakage8.7 High
spatie/browsershotPackagistSpatie Browsershot Directory Traversal vulnerability8.7 High- Show moreLoading…