CVEs published December 3, 2024
83 CVEs were published on December 3, 2024: 2 critical, 30 high.
- Published
- 83
- Critical
- 2
- High
- 30
- Medium
- 47
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- IBM Cognos Controller
- 10
- element-hq synapse · matrix-synapse
- 6
- Samsung Mobile Devices
- 6
- Lorex 2K Indoor Wi-Fi Security Camera
- 5
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- 4
- OpenHarmony
- 3
- Samsung Mobile GamingHub
- 3
- Google Android
- 2
- Mobile-Security-Framework-MobSF · mobsf
- 2
- akashmalik Scratch & Win – Giveaways and Contests. Boost su…
- 1
Critical 2
High 30
- CVE-2024-54131Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)kolide launcher · github.com/kolide/launcher
- CVE-2024-51771Authenticated Remote Code Execution (RCE) via OGNL Injection in HPE Aruba Networking ClearPass Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2024-12053Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a craftGoogle Chrome
- CVE-2024-52547Lorex 2K Indoor Wi-Fi Security Camera - Stack buffer overflowLorex 2K Indoor Wi-Fi Security Camera
- CVE-2024-41777IBM Cognos Controller hard coded credentialsIBM Cognos Controller
- CVE-2024-37302Synapse denial of service through media disk space consumptionelement-hq synapse · matrix-synapse
- CVE-2024-52805Synapse allows unsupported content types to lead to memory exhaustionelement-hq synapse · matrix-synapse
- CVE-2024-52815Synapse allows a a malformed invite to break the invitee's `/sync`element-hq synapse · matrix-synapse
- CVE-2024-53863Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoderselement-hq synapse · matrix-synapse
- CVE-2024-40691IBM Cognos Controller file uploadIBM Cognos Controller
- CVE-2024-53999Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" FunctionalityMobile-Security-Framework-MobSF · mobsf
- CVE-2024-54000Mobile Security Framework (MobSF) bypass of SSRF fixMobile-Security-Framework-MobSF · mobsf
- CVE-2024-11391Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Uploadsaadiqbal Advanced File Manager – Ultimate File Manager for…
- CVE-2024-42422Dell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability.Dell NetWorker
- CVE-2024-10074Liteos_a has an use after free vulnerabilityOpenHarmony
- CVE-2024-47476Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability.Dell NetWorker Management Console
- CVE-2024-45106Apache Ozone: Improper authentication when generating S3 secretsApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2024-49420Improper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in Global allows remote attackers to launch arbitraSamsung Mobile GamingHub
- CVE-2024-49415Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2024-49413Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious Samsung Mobile Devices
- CVE-2024-45068Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVAHitachi Ops Center Common Services · Hitachi Ops Center OVA
- CVE-2024-9200A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versZyxel VMG4005-B50A firmware
- CVE-2024-8748A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through Zyxel VMG8825-T50K firmware
- CVE-2024-29404An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export pa
- CVE-2024-45757An issue was discovered in Centreon centreon-bam 24.04, 23.10, 23.04, and 22.10.
- CVE-2024-46624An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload se
- CVE-2024-46625An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers t
- CVE-2024-48080An issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request.
- CVE-2024-50948mochiMQTT v2.6.3 is vulnerable to Denial of Service (DoS) due to improper resource management.github.com/mochi-mqtt/server
- CVE-2024-51114An issue in Beijing Digital China Yunke Information Technology Co.Ltd v.7.2.6.120 allows a remote attacker to execute arbitrary code via the
Medium, low and unrated 51
- CVE-2024-53672Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2024-51773Authenticated Stored Cross-Site Scripting (XSS) in HPE Aruba Networking ClearPass Policy Manager Web-based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2024-51772Authenticated Deserialization Vulnerability in ClearPass Policy Manager Web-Based Management Interface Leading to a Remote Command Execution (RCE)Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2024-52548Lorex 2K Indoor Wi-Fi Security Camera - Code signing bypassLorex 2K Indoor Wi-Fi Security Camera
- CVE-2024-52546Lorex 2K Indoor Wi-Fi Security Camera - Null pointer dereferenceLorex 2K Indoor Wi-Fi Security Camera
- CVE-2024-52545Lorex 2K Indoor Wi-Fi Security Camera - Out of bounds heap readLorex 2K Indoor Wi-Fi Security Camera
- CVE-2024-41775IBM Cognos Controller information disclosureIBM Cognos Controller
- CVE-2024-25020IBM Cognos Controller file uploadIBM Cognos Controller
- CVE-2024-41776IBM Cognos Controller cross-site request forgeryIBM Cognos Controller
- CVE-2024-45676IBM Cognos Controller file uploadIBM Cognos Controller
- CVE-2024-37303Synapse unauthenticated writes to the media repository allow planting of problematic contentelement-hq synapse · matrix-synapse
- CVE-2024-53867Synapse Matrix has a partial room state leak via Sliding Syncelement-hq synapse · matrix-synapse
- CVE-2024-25036IBM Cognos Controller authentication bypassIBM Cognos Controller
- CVE-2024-25035IBM Cognos Controller information disclosureIBM Cognos Controller
- CVE-2024-25019IBM Cognos Controller file uploadIBM Cognos Controller
- CVE-2021-29892IBM Cognos Controller information disclosureIBM Cognos Controller
- CVE-2024-53257Vitess allows HTML injection in /debug/querylogz & /debug/envvitessio vitess · vitess.io/vitess
- CVE-2024-11200Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family'Goodlayers Core
- CVE-2024-9978Liteos_a has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2024-12082Ability Runtime has an out-of-bounds read permission bypass vulnerabilityOpenHarmony
- CVE-2024-11326Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scriptingfatcatapps Campaign Monitor Forms by Optin Cat
- CVE-2024-11782WP Mailster <= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrandtoss WP Mailster
- CVE-2024-12062Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosurenicheaddons Charity Addon for Elementor
- CVE-2024-11325AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scriptingfatcatapps AWeber Forms by Optin Cat
- CVE-2024-11866BMLT Tabbed Map <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingpaulnagle BMLT Tabbed Map
- CVE-2024-11844IdeaPush <= 8.71 - Missing Authorization to Board Term Deletionnorthernbeacheswebsites IdeaPush
- CVE-2024-11732BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parametervenutius BP Profile Shortcodes Extra
- CVE-2024-11805Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scriptingsoraco Quick License Manager – WooCommerce Plugin
- CVE-2024-11853jAlbum Bridge <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parametermlaza jAlbum Bridge
- CVE-2024-11461Form Data Collector <= 2.2.3 - Reflected Cross-Site Scriptingtaunoh Form Data Collector
- CVE-2024-11898Scratch & Win – Giveaways and Contests <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingakashmalik Scratch & Win – Giveaways and Contests. Boost su…
- CVE-2024-11707My auctions allegro <= 3.6.17 - Reflected Cross-Site Scriptingwphocus My auctions allegro
- CVE-2024-11453WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingsamdani GS Pinterest Portfolio – Pins Grid, Masonry, User P…
- CVE-2024-9058Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widgetbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-10893WP Booking Calendar < 10.6.5 - Admin+ Stored XSSWP Booking Calendar
- CVE-2024-49421Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adSamsung Mobile Quick Share Agent
- CVE-2024-49419Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers toSamsung Mobile GamingHub
- CVE-2024-49418Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers toSamsung Mobile GamingHub
- CVE-2024-49417Use of implicit intent for sensitive communication in Smart Touch Call prior to 1.0.0.8 allows local attackers to launch privileged activitiSamsung Mobile Smart Touch Call
- CVE-2024-49416Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive informatioSamsung Mobile SmartThings
- CVE-2024-49414Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access toSamsung Mobile Devices
- CVE-2024-49412Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth oSamsung Mobile Devices
- CVE-2024-49411Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenterSamsung Mobile Devices
- CVE-2024-49410Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2024-10484Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widgetbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2024-9694CMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsCMSMasters Elementor Addon
- CVE-2024-9197A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions thrZyxel VMG3625-T50B firmware
- CVE-2018-9449In process_service_search_attr_rsp of sdp_discovery.cc, there is a possible out of bound read due to a missing bounds check.Google Android
- CVE-2018-9441In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2024-53502Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.
- CVE-2024-53921An issue was discovered in the installer in Samsung Magician 8.1.0 on Windows.