CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- ibm aix, vios +1 moreIBM AIX denial of service5.5 Medium
- gitlabExposure of Sensitive Information Due to Incompatible Policies in GitLab3.7 Low
- dell supportassist for business pcs, supportassist for home pcs +1 moreDell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs...7.1 High
- ibm engineering insights, engineering lifecycle optimization - engineering insights +1 moreIBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing6.1 Medium
- ibm engineering insights, engineering lifecycle optimization - engineering insights +1 moreIBM Engineering Lifecycle Optimization - Engineering Insights information disclosure5.3 Medium
- arne informatics piramit automationSQLi in Arne Informatics' Piramit Automation9.9 Critical
httpdTuxCare,mod_sessionTuxCare,httpd-develTuxCare +5 more +7 moreUpdate of httpdNo score- apache minaApache MINA: MINA applications using unbounded deserialization may allow RCE10.0 Critical
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection4.9 Medium
- theme-fusion avada builder, themefusion avada (fusion) builder +1 moreAvada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure4.3 Medium
- webkul woocommerce point of saleWooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change9.8 Critical
- automattic jetpackJetpack 13.0-14.0 - Unauthenticated DOM-XSS6.1 Medium
- peterschulznl wp data access – app builder for tables, forms, charts, maps & dashboardsWP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection7.5 High
- wplegalpages privacy policy generator – wplp legal pagesPrivacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.2.7 - Cross-Site Request Forgery4.3 Medium
- wptravelengine wp travel engine – elementor widgets | create travel booking website using wordpress and elementorWP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion8.8 High
- bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builderContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submissio…4.3 Medium
- webwizardsdev marketking — ultimate woocommerce multivendor marketplace solutionMarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization5.3 Medium
- themefic tourfic, tourfic – travel booking, hotel booking & car rental wordpress plugin +1 moreTourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- oppo oppp storeOPPO Store APP has a WebView component privilege escalation vulnerability.8.7 High
- xiph theoraoc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid...9.8 Critical
- openfheOpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe...2.9 Low
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved memory handling. This issue is fixed in visionOS 2.2, tvOS...8.8 High
- oracle istoreVulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart)....8.2 High
- amazon redshift odbc driverSQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.08.6 High
- amazon redshift python connector, redshift connector +1 moreSQL Injection in the Amazon Redshift Python Connector affecting v2.1.48.6 High
- amazon redshift jdbc driver, web services redshift java database connectivity driver +1 moreSQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.318.6 High
- apache hugegraph, apache software foundation hugegraph-server +1 moreApache HugeGraph-Server: Fixed JWT Token(Secret)9.8 Critical
- linux, linux kernel +1 morecrypto: qat/qat_420xx - fix off by one in uof_get_name()5.5 Medium
- linux, linux kernel +1 morecrypto: qat/qat_4xxx - fix off by one in uof_get_name()7.1 High
- linux, linux kernel +1 moreEDAC/bluefield: Fix potential integer overflow5.5 Medium
- linux, linux kernel +1 morercu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu4.7 Medium
- linux, linux kernel +1 moresoc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()5.5 Medium
- linux, linux kernel +1 morefirmware: arm_scpi: Check the DVFS OPP count returned by the firmware5.5 Medium
- linux, linux kernel +1 morewifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()7.8 High
- linux, linux kernel +1 moreocfs2: fix uninitialized value in ocfs2_file_read_iter()7.1 High
- linux, linux kernel +1 moreclk: clk-apple-nco: Add NULL check in applnco_probe5.5 Medium
- linux, linux kernel +1 morePCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()5.5 Medium
- linux, linux kernel +1 morePCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()5.5 Medium
- linux, linux kernel +1 moresvcrdma: Address an integer overflow7.5 High
- debian linux, linux kernel +1 moreALSA: usb-audio: Fix out of bounds reads when finding clock sources7.1 High
- linux, linux kernel +1 moreusb: typec: ucsi: glink: fix off-by-one in connector_status4.6 Medium
- linux, linux kernel +1 morecomedi: Flush partial mappings in error case7.8 High
- linux, linux kernel +1 moreexfat: fix out-of-bounds access of directory entries7.8 High
- linux, linux kernel +1 moreNFSD: Prevent a potential integer overflow9.1 Critical
- linux, linux kernel +1 moreum: Fix potential integer overflow during physmem setup5.5 Medium
- reputeinfosystems appointment booking calendar plugin and scheduling plugin – bookingpressAppointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection6.5 Medium
- wpdevart booking calendar, booking calendar, appointment booking system +1 moreBooking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection6.5 Medium
- cyberchimps responsive blocks, responsive blocks – page builder for blocks & patterns +1 moreResponsive Blocks – WordPress Gutenberg Blocks <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- designinvento directorypress, directorypress – business directory and classified ad listing +1 moreDirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting5.4 Medium
- giuse plugversions – easily roll back to previous versions of your plugins.PlugVersions – Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation8.8 High
- Show moreLoading…