CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- motovnet ebook storeEbook Store <= 5.8001 - Reflected Cross-Site Scripting6.1 Medium
- harryhe gtpayment donationsGTPayment Donations <= 1.0.0 - Stored XSS via CSRF6.1 Medium
- collizo4sky kk star ratings – rate post & collect user feedbackskk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- emlogEmlog Pro link.php cross site scripting6.9 Medium
- scriptsbundle adforestAdForest <= 5.1.6 - Authentication Bypass9.8 Critical
- sierra wireless airvantage, airvantage-capable devices: all sierra wireless devices.Exposure of Sensitive Information to an Unauthorized Actor5.3 Medium
- sierra wireless airvantage, airvantage-capable devices: all sierra wireless devices.Improper Authentication8.1 High
- feedify – web push notificationsFeedify – Web Push Notifications <= 2.4.2 - Reflected Cross-Site Scripting6.1 Medium
- sierra wireless mgosMGOS Command Injection7.8 High
- emlogEmlog Pro common.php cross site scripting5.3 Medium
- emlogEmlog Pro store.php cross site scripting6.9 Medium
- emlogEmlog Pro plugin.php cross site scripting6.9 Medium
- getgrist grist-coreCross-site Scripting vulnerability through HyperLink cells in grist-core8.1 High
- getgrist grist-coreCross-site Scripting vulnerability through svg attachment previews in grist-core8.1 High
- getgrist grist-coreCross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core8.1 High
- absolute software secure accessCross-site scripting vulnerability in the Secure Access administrative console prior to 13.525.9 Medium
- dani-garcia vaultwardenPrivilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden7.6 High
- spaceness stardustSession VNC may be accessed by other sessions on the same host in stardust9.3 Critical
- emlogEmlog Pro user.php cross site scripting6.9 Medium
- inseefrlab onyxiaRemote code execution in onyxia-api9.4 Critical
- arctic security hubServer-Side Request Forgery in Arctic Hub URL Mapper allows an unauthenticated remote attacker to exfiltrate and modify configurations and data8.8 High
- sebhildebrandt systeminformationCommand injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation7.8 High
- emlogEmlog Pro tag.php cross site scripting6.9 Medium
- delta electronics dtm softDelta Electronics DTM Soft Deserialization of Untrusted Data8.5 High
- directadmin evolution skinStored XSS in DirectAdmin Evo Skin8.6 High
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete9.8 Critical
- louislam uptime-kumaLocal File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor6.8 Medium
- joelbutcher socialstreamAccount Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream8.9 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE...5.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController...4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 password field value were accessible to users with view...5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details...4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles6.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify...5.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.12 improper access control allowed viewing details of...4.3 Medium
- ibm security directory integratorIBM Security Directory Integrator command execution6.8 Medium
- ibm cognos analyticsIBM Cognos Analytics file upload8.0 High
- ibm cognos analyticsIBM Cognos Analytics expression language injection9.0 Critical
- lleidanet pki esignaPath Traversal vulnerability in eSignaViewer Allow Unauthorized File Access2.0 Low
- kioxia cm6, pm6, pm7 +3 more +5 moreArbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM75.7 Medium
- gbsdeveloper category post sliderCategory Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- magblogapi nacc wordpress pluginNACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- outdooractive embedOutdooractive Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- spoki – chat buttons and woocommerce notificationsSpoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- carlosfrancopkt1 pkt1 centro de enviosPKT1 Centro de envios <= 1.2.1 - Reflected Cross-Site Scripting6.1 Medium
- financecalculatorwp financial calculatorFinancial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ticketsource ticket shopSell Tickets Online – TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sisoog استخراج محصولات ووکامرس برای آیسیisee-products-extractor <= 2.1.3 - Reflected Cross-Site Scripting6.1 Medium
- Show moreLoading…