CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- sminozzi database backup and table integrity check with automated schedulingDatabase Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read4.9 Medium
- giuse content no cache | serve uncached partial content even when you add it to a page that is fully cached.Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure5.3 Medium
- codetides advanced floating contentAdvanced Floating Content <= 3.8.2 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- data443 tracking code managerTracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- androidbubbles wp datepickerWP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting6.1 Medium
- flippercode text prompter – unlimited chatgpt text prompts for openai tasksText Prompter – Unlimited chatgpt text prompts for openai tasks <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
vhostmdopenSUSESecurity update for vhostmdNo score- aerin loan comparisonLoan Comparison <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ulfben exhibit to wp galleryExhibit to WP Gallery <= 0.0.2 - Reflected XSS6.1 Medium
- hanwha vision co., ltd. xrn-420sStack based buffer overflow6.9 Medium
- hanwha vision co., ltd. xrn-420sNull Pointer Dereference6.9 Medium
- hanwha vision co., ltd. xrn-420sNull Pointer Dereference6.9 Medium
- hanwha vision co., ltd. xrn-420sHardcoding sensitive information5.6 Medium
- hanwha vision co., ltd. xrn-420sImproper Input Validation6.9 Medium
- fahadmahmood export customers dataExport Customers Data <= 1.2.3 - Reflected Cross-Site Scripting6.1 Medium
- mra13 simple shopping cartWordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- zia-imtiaz login page styler – custom wordpress login page customizer & securityALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation8.8 High
- getalby bitcoin lightning publisher for wordpressBitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scripting6.1 Medium
- tychesoftwares print invoice & delivery notes for woocommercePrint Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion4.3 Medium
- ninjateam wp telegram chat widgetNinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webfactory advanced google recaptchaAdvanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock5.3 Medium
- hanwha vision co., ltd. xrn-420sArbitrary File Overwrite5.1 Medium
- kkarpieszuk wc price historyWC Price History for Omnibus <= 2.1.3 - Missing Authorization5.4 Medium
- optio dentistryOptio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- marcelismus wp-appboxWP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting6.1 Medium
- denischerniatev shmapper by teplitsashMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- elextensions elex woocommerce dynamic pricing and discountsELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization6.5 Medium
- red hat service interconnect 1, service interconnect 1 for rhel 9 +1 moreSkupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service7.1 High
pagureDebianPagure: generate_archive() follows symbolic links in temporary clones8.1 HighkojiPyPIKoji: escape html tag characters in the query string5.4 Medium- webuidesigning nebulax themewebuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injection5.3 Medium
org.jboss.hal:hal-consoleMavenCross Site Scripting (XSS) vulnerability while uploading content to a new deployment6.9 Medium- adobe coldfusionColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)8.1 High
- aptrsAPTRS has SSTI vulnerability7.8 High
- navidromeNavidrome Stores JWT Secret in Plaintext in navidrome.db7.1 High
- xemle home-galleryGHSL-2024-092: Open CORS policy in home-gallery6.3 Medium
- xemle home-galleryGHSL-2024-091: DNS rebinding attack in home-gallery5.3 Medium
- shuchkin simplexlsxCross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx5.4 Medium
- pallets jinjaJinja has a sandbox breakout through indirect reference to format method5.4 Medium
- pallets jinjaJinja has a sandbox breakout through malicious filenames5.4 Medium
- apache traffic controlApache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments9.9 Critical
- apache hive, spark +1 moreApache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails5.9 Medium
- gogsGogs has a Path Traversal in file update API8.7 High
- gogsGogs has a Path Traversal in file editing UI8.7 High
- rizinorg rizinRizin has a command injection via RzBinInfo bclass due legacy code7.8 High
- acronis cyber protect 16, cyber protect cloud agent +1 moreWeak algorithm used to sign RPM package. The following products are affected: Acronis Cyber...2.5 Low
- biamp evoko home serviceIncorrect default permissions in Biamp Evoko Home7.8 High
xouscrates.ioxous has unsound usages of `core::slice::from_raw_parts`No score- global wisdom software anchorGlobal Wisdom Software ANCHOR - Undocumented Privileged Account8.4 High
- brainstorm force ultimate addons for elementor, brainstormforce elementor header \& footer builder +1 moreElementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget6.4 Medium
- Show moreLoading…