CVEs published December 5, 2024
110 CVEs were published on December 5, 2024: 19 critical, 45 high.
- Published
- 110
- Critical
- 19
- High
- 45
- Medium
- 41
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- ABB ASPECT-Enterprise · ABB NEXUS Series +1
- 24
- Google Android
- 5
- SonicWall SMA100
- 5
- Rockwell Automation Arena®
- 4
- I-O DATA DEVICE UD-LT1 · I-O DATA DEVICE UD-LT1/EX
- 3
- PHPGurukul Complaint Management System
- 3
- 1000 Projects Library Management System
- 2
- Canonical LXD · github.com/canonical/lxd
- 2
- Drupal Core · drupal/core
- 2
- nasa-jpl ION-DTN
- 2
Critical 19
- CVE-2024-54129Improper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7nasa-jpl ION-DTN
- CVE-2024-54130Segmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public)nasa-jpl ION-DTN
- CVE-2024-51555Force Change of Default CredentialsABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51551Default CredentialsABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51550Data Validation / SanitizationABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51549Absolute Path TraversalABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51545Username EnumerationABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48845Weak Password Rules/StrengthABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48840Unauthorized AccessABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48839Remote Code Execution, RCEABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-11317PHP Session FixationABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-6516Cross Site Scripting XSSABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2023-48010STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface.
- CVE-2023-50913Oxide control plane software before 5 allows SSRF.
- CVE-2024-37861Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl proc
- CVE-2024-37863Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl proc
- CVE-2024-38920Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl proce
- CVE-2024-41579DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vuln
- CVE-2024-53442whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.
High 45
- CVE-2024-52798path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xpillarjs path-to-regexp · path-to-regexp
- CVE-2018-9388In store_upgrade and store_cmd of drivers/input/touchscreen/stm/ftm4_pdc.c, there are out of bound writes due to missing bounds checks or inGoogle Android
- CVE-2024-11148OpenBSD httpd(8) null dereferenceOpenBSD
- CVE-2024-12130Rockwell Automation Arena® Out of Bounds Read VulnerabilityRockwell Automation Arena®
- CVE-2024-11158Rockwell Automation Arena® Uninitialized VulnerabilityRockwell Automation Arena®
- CVE-2024-11156Rockwell Automation Arena® Out of Bounds Write VulnerabilityRockwell Automation Arena®
- CVE-2024-11155Rockwell Automation Arena® Use After Free VulnerabilityRockwell Automation Arena®
- CVE-2024-53856rPGP Panics on Malformed Untrusted Inputrpgp · pgp
- CVE-2024-53857rPGP Potential Resource Exhaustion when handling Untrusted Messagesrpgp · pgp
- CVE-2024-11941Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001Drupal Core · drupal/core
- CVE-2024-53703A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web servSonicWall SMA100
- CVE-2024-52271PDF Document Spoofing in DocumensoDocumenso
- CVE-2024-45318A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potSonicWall SMA100
- CVE-2024-40763Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy.SonicWall SMA100
- CVE-2024-51554off-by-one-errorABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51548Dangerous File UploadABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51546Credentails DisclosureABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51544Service ControlABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51543Information DisclosureABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51542Configuration DownloadABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51541Local File InclusionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48847MD5 bypass operationABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48846Cross Side Request Forgery, CSRFABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48844Denial of Service, DoSABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-48843Denial of Service, DoSABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-11316Filesize CheckABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-6784SSRF Server Side Request ForgeryABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-6515unauthorized file accessABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-54126Insufficient Integrity Verification Vulnerability in TP-Link Archer C50TP-Link Archer C50 Wireless Router
- CVE-2024-52270PDF Document Spoofing in DropBox Sign(HelloSign)DropBox(HelloSign) DropBox Sign
- CVE-2022-41137Apache Hive: Deserialization of untrusted data when fetching partitions from the MetastoreApache Software Foundation Apache Hive · org.apache.hive:hi…
- CVE-2024-52564Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 anI-O DATA DEVICE UD-LT1 · I-O DATA DEVICE UD-LT1/EX
- CVE-2024-47133UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administratI-O DATA DEVICE UD-LT1 · I-O DATA DEVICE UD-LT1/EX
- CVE-2024-11429Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials <= 3.3.3 - Authenticated (Contributor+) Local File Inclusionpremio Stars Testimonials — Responsive Reviews & Star Ratin…
- CVE-2024-30961Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allow
- CVE-2024-30962Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a l
- CVE-2024-30963Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a l
- CVE-2024-30964Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allow
- CVE-2024-37860Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker
- CVE-2024-37862Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local a
- CVE-2024-38910Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process.
- CVE-2024-53472WeGIA v3.2.0 was discovered to contain a Cross-Site Request Forgery (CSRF).
- CVE-2024-53490Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java.
- CVE-2024-53523JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function.
- CVE-2024-53589GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files.
Medium, low and unrated 46
- CVE-2024-6219Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restCanonical LXD · github.com/canonical/lxd
- CVE-2024-6156Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust storCanonical LXD · github.com/canonical/lxd
- CVE-2018-9391In update_gps_sv and output_vzw_debug of vendor/mediatek/proprietary/hardware/connectivity/gps/gps_hal/src/gpshal_wor ker.c, there iGoogle Android
- CVE-2018-9390In procfile_write of gl_proc.c, there is a possible out of bounds read of a function pointer due to an incorrect bounds check.Google Android
- CVE-2018-9386In reboot_block_command of htc reboot_block driver, there is a possible stack buffer overflow due to a missing bounds check.Google Android
- CVE-2024-54140sigstore-java has a vulnerability with bundle verificationsigstore-java · dev.sigstore:sigstore-java
- CVE-2017-13308In tscpu_write_GPIO_out and mtkts_Abts_write of mtk_ts_Abts.c, there is a possible buffer overflow in an sscanf due to improper input validaGoogle Android
- CVE-2024-10933OpenBSD readdir directory traversalOpenBSD
- CVE-2024-12235Shenzhen Dashi Tongzhou Information Technology AgileBPM AuthorizationTokenCheckFilter.java doFilter access controlShenzhen Dashi Tongzhou Information Technology AgileBPM
- CVE-2024-53846ssl fails to validate incorrect extened key usageerlang otp
- CVE-2024-122341000 Projects Beauty Parlour Management System edit-customer-detailed.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-54128Directus has an HTML Injection in Commentdirectus · @directus/app
- CVE-2024-12233code-projects Online Notice Board Profile Picture registration.php unrestricted uploadcode-projects Online Notice Board
- CVE-2024-12232code-projects Simple CRUD Functionality index.php cross site scriptingcode-projects Simple CRUD Functionality
- CVE-2024-12231CodeZips Project Management System index.php sql injectionCodeZips Project Management System
- CVE-2024-10716Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.Pegasystems Pega Infinity
- CVE-2024-12247Improper propagation of permission scheme updates across cluster nodesMattermost
- CVE-2024-54001Kanboard allows a persistent HTML injection site scripting in settings page date formatkanboard
- CVE-2024-11942Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002Drupal Core · drupal/core
- CVE-2024-12230PHPGurukul Complaint Management System subcategory.php sql injectionPHPGurukul Complaint Management System
- CVE-2024-12229PHPGurukul Complaint Management System complaint-search.php sql injectionPHPGurukul Complaint Management System
- CVE-2024-53702Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that,SonicWall SMA100
- CVE-2024-45319A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can cirSonicWall SMA100
- CVE-2024-12228PHPGurukul Complaint Management System user-search.php sql injectionPHPGurukul Complaint Management System
- CVE-2024-12227MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereferenceMSI Dragon Center
- CVE-2024-12094Information Disclosure Vulnerability in TinxyMogify Infotech Tinxy Android app · Mogify Infotech Tinxy i…
- CVE-2024-54127Exposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50TP-Link Archer C50 Wireless Router
- CVE-2024-45841Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9I-O DATA DEVICE UD-LT1 · I-O DATA DEVICE UD-LT1/EX
- CVE-2024-11324Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scriptingbastho Accounting for WooCommerce
- CVE-2024-10777AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosurewpvibes Dynific Addons for Elementor
- CVE-2024-10056Contact Form Builder <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcodeeyale-vc Contact Form Builder by vcita
- CVE-2024-11779WIP WooCarousel Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingalexvtn WIP WooCarousel Lite
- CVE-2024-10848NewsMunch <= 1.0.35 - Authenticated (Contributor+) Stored Cross-Site Scriptingdesertthemes NewsMunch
- CVE-2024-11341Simple Redirection <= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirectagencenous Simple Redirection
- CVE-2024-11420Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
- CVE-2024-10937Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.58 - Sensitive Information ExposureRelated Posts By PickPlugins
- CVE-2024-42195HCL DevOps Deploy / HCL Launch is vulnerable to HTML injectionHCL Software DevOps Deploy / Launch
- CVE-2024-10178Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetGutentor – Gutenberg Blocks – Page Builder for Gutenberg Ed…
- CVE-2024-10881LUNA RADIO PLAYER <= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesodah LUNA RADIO PLAYER
- CVE-2024-54014Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.SKYLARK HOLDINGS CO. 'Skylark' App for Android · SKYLARK HO…
- CVE-2024-121881000 Projects Library Management System stu.php sql injection1000 Projects Library Management System
- CVE-2024-121871000 Projects Library Management System showbook.php sql injection1000 Projects Library Management System
- CVE-2024-53457A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to executelibrenms/librenms
- CVE-2024-53470Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/gateway_pagamento.php of WeGIA v3.2.0 allows attac
- CVE-2024-53471Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/meio_pagamento.php of WeGIA v3.2.0 allows attacker
- CVE-2024-54679CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.