# CVEs published 2024-12-10

335 CVEs were published on December 10, 2024: 23 critical, 130 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-55655](https://cve.now/CVE-2024-55655.md): sigstore-python has insufficient validation of integration timestamp during verification (CVSS 2.7, sigstore-python · sigstore)
- [CVE-2024-55653](https://cve.now/CVE-2024-55653.md): pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS) (CVSS 6.5, pwndoc)
- [CVE-2024-54133](https://cve.now/CVE-2024-54133.md): Possible Content Security Policy bypass in Action Dispatch (CVSS 2.3, rails · actionpack)
- [CVE-2024-52865](https://cve.now/CVE-2024-52865.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52848](https://cve.now/CVE-2024-52848.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43713](https://cve.now/CVE-2024-43713.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43715](https://cve.now/CVE-2024-43715.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43717](https://cve.now/CVE-2024-43717.md): Adobe Experience Manager | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Experience Manager)
- [CVE-2024-52836](https://cve.now/CVE-2024-52836.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52860](https://cve.now/CVE-2024-52860.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43727](https://cve.now/CVE-2024-43727.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52838](https://cve.now/CVE-2024-52838.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52862](https://cve.now/CVE-2024-52862.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43738](https://cve.now/CVE-2024-43738.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43748](https://cve.now/CVE-2024-43748.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43719](https://cve.now/CVE-2024-43719.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52817](https://cve.now/CVE-2024-52817.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43732](https://cve.now/CVE-2024-43732.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 4.6, Adobe Experience Manager)
- [CVE-2024-52861](https://cve.now/CVE-2024-52861.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52816](https://cve.now/CVE-2024-52816.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52826](https://cve.now/CVE-2024-52826.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43726](https://cve.now/CVE-2024-43726.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43742](https://cve.now/CVE-2024-43742.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43718](https://cve.now/CVE-2024-43718.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52846](https://cve.now/CVE-2024-52846.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43720](https://cve.now/CVE-2024-43720.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52839](https://cve.now/CVE-2024-52839.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43752](https://cve.now/CVE-2024-43752.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52850](https://cve.now/CVE-2024-52850.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52822](https://cve.now/CVE-2024-52822.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43730](https://cve.now/CVE-2024-43730.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52855](https://cve.now/CVE-2024-52855.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43745](https://cve.now/CVE-2024-43745.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43743](https://cve.now/CVE-2024-43743.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43737](https://cve.now/CVE-2024-43737.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43712](https://cve.now/CVE-2024-43712.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43724](https://cve.now/CVE-2024-43724.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52828](https://cve.now/CVE-2024-52828.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43723](https://cve.now/CVE-2024-43723.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43740](https://cve.now/CVE-2024-43740.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52831](https://cve.now/CVE-2024-52831.md): Adobe Experience Manager | Improper Input Validation (CWE-20) (CVSS 3.5, Adobe Experience Manager)
- [CVE-2024-52830](https://cve.now/CVE-2024-52830.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43750](https://cve.now/CVE-2024-43750.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52864](https://cve.now/CVE-2024-52864.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52818](https://cve.now/CVE-2024-52818.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52832](https://cve.now/CVE-2024-52832.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52825](https://cve.now/CVE-2024-52825.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52835](https://cve.now/CVE-2024-52835.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43725](https://cve.now/CVE-2024-43725.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52849](https://cve.now/CVE-2024-52849.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52859](https://cve.now/CVE-2024-52859.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52852](https://cve.now/CVE-2024-52852.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52827](https://cve.now/CVE-2024-52827.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52823](https://cve.now/CVE-2024-52823.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52858](https://cve.now/CVE-2024-52858.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52824](https://cve.now/CVE-2024-52824.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52840](https://cve.now/CVE-2024-52840.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52992](https://cve.now/CVE-2024-52992.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52834](https://cve.now/CVE-2024-52834.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43746](https://cve.now/CVE-2024-43746.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43721](https://cve.now/CVE-2024-43721.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43754](https://cve.now/CVE-2024-43754.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52837](https://cve.now/CVE-2024-52837.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52853](https://cve.now/CVE-2024-52853.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43734](https://cve.now/CVE-2024-43734.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52829](https://cve.now/CVE-2024-52829.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43755](https://cve.now/CVE-2024-43755.md): Adobe Experience Manager | Improper Input Validation (CWE-20) (CVSS 3.5, Adobe Experience Manager)
- [CVE-2024-52847](https://cve.now/CVE-2024-52847.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52991](https://cve.now/CVE-2024-52991.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43751](https://cve.now/CVE-2024-43751.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52845](https://cve.now/CVE-2024-52845.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43729](https://cve.now/CVE-2024-43729.md): Adobe Experience Manager | Improper Authorization (CWE-285) (CVSS 6.5, Adobe Experience Manager)
- [CVE-2024-43722](https://cve.now/CVE-2024-43722.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52993](https://cve.now/CVE-2024-52993.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52854](https://cve.now/CVE-2024-52854.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52843](https://cve.now/CVE-2024-52843.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52842](https://cve.now/CVE-2024-52842.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43733](https://cve.now/CVE-2024-43733.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52844](https://cve.now/CVE-2024-52844.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53960](https://cve.now/CVE-2024-53960.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43735](https://cve.now/CVE-2024-43735.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43728](https://cve.now/CVE-2024-43728.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52857](https://cve.now/CVE-2024-52857.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43714](https://cve.now/CVE-2024-43714.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52851](https://cve.now/CVE-2024-52851.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43739](https://cve.now/CVE-2024-43739.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43744](https://cve.now/CVE-2024-43744.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43716](https://cve.now/CVE-2024-43716.md): Adobe Experience Manager | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Experience Manager)
- [CVE-2024-43731](https://cve.now/CVE-2024-43731.md): Adobe Experience Manager | Improper Authorization (CWE-285) (CVSS 4.3, Adobe Experience Manager)
- [CVE-2024-43736](https://cve.now/CVE-2024-43736.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52841](https://cve.now/CVE-2024-52841.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43747](https://cve.now/CVE-2024-43747.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43749](https://cve.now/CVE-2024-43749.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53959](https://cve.now/CVE-2024-53959.md): Adobe Framemaker | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Framemaker)
- [CVE-2024-53958](https://cve.now/CVE-2024-53958.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-53957](https://cve.now/CVE-2024-53957.md): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-53956](https://cve.now/CVE-2024-53956.md): Premiere Pro | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Premiere Pro)
- [CVE-2024-53955](https://cve.now/CVE-2024-53955.md): Bridge | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Bridge)
- [CVE-2024-52833](https://cve.now/CVE-2024-52833.md): Substance3D - Modeler | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance3D - Modeler)
- [CVE-2024-53004](https://cve.now/CVE-2024-53004.md): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Modeler)
- [CVE-2024-53002](https://cve.now/CVE-2024-53002.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2024-53000](https://cve.now/CVE-2024-53000.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2024-53006](https://cve.now/CVE-2024-53006.md): Substance3D - Modeler | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance3D - Modeler)
- [CVE-2024-53001](https://cve.now/CVE-2024-53001.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2024-53003](https://cve.now/CVE-2024-53003.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2024-53005](https://cve.now/CVE-2024-53005.md): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Modeler)
- [CVE-2024-52999](https://cve.now/CVE-2024-52999.md): Substance3D - Modeler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2024-52997](https://cve.now/CVE-2024-52997.md): Photoshop Desktop | Use After Free (CWE-416) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2024-52996](https://cve.now/CVE-2024-52996.md): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2024-52994](https://cve.now/CVE-2024-52994.md): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2024-52995](https://cve.now/CVE-2024-52995.md): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2024-49513](https://cve.now/CVE-2024-49513.md): Not a product | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Not a product)
- [CVE-2024-53951](https://cve.now/CVE-2024-53951.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49547](https://cve.now/CVE-2024-49547.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-53952](https://cve.now/CVE-2024-53952.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49548](https://cve.now/CVE-2024-49548.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49544](https://cve.now/CVE-2024-49544.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-49549](https://cve.now/CVE-2024-49549.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49546](https://cve.now/CVE-2024-49546.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49545](https://cve.now/CVE-2024-49545.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-49543](https://cve.now/CVE-2024-49543.md): InDesign Desktop | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-54048](https://cve.now/CVE-2024-54048.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54050](https://cve.now/CVE-2024-54050.md): Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54045](https://cve.now/CVE-2024-54045.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54037](https://cve.now/CVE-2024-54037.md): Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 8.1, Adobe Connect)
- [CVE-2024-54043](https://cve.now/CVE-2024-54043.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54040](https://cve.now/CVE-2024-54040.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Connect)
- [CVE-2024-54049](https://cve.now/CVE-2024-54049.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54036](https://cve.now/CVE-2024-54036.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2024-54041](https://cve.now/CVE-2024-54041.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Connect)
- [CVE-2024-54051](https://cve.now/CVE-2024-54051.md): Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54039](https://cve.now/CVE-2024-54039.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Connect)
- [CVE-2024-54042](https://cve.now/CVE-2024-54042.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54034](https://cve.now/CVE-2024-54034.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2024-54044](https://cve.now/CVE-2024-54044.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-49550](https://cve.now/CVE-2024-49550.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54047](https://cve.now/CVE-2024-54047.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-54038](https://cve.now/CVE-2024-54038.md): Adobe Connect | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Connect)
- [CVE-2024-54032](https://cve.now/CVE-2024-54032.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2024-54046](https://cve.now/CVE-2024-54046.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2024-52985](https://cve.now/CVE-2024-52985.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate)
- [CVE-2024-45155](https://cve.now/CVE-2024-45155.md): Animate | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52987](https://cve.now/CVE-2024-52987.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate)
- [CVE-2024-45156](https://cve.now/CVE-2024-45156.md): Animate | NULL Pointer Dereference (CWE-476) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52982](https://cve.now/CVE-2024-52982.md): Animate | Improper Input Validation (CWE-20) (CVSS 7.8, Adobe Animate)
- [CVE-2024-53953](https://cve.now/CVE-2024-53953.md): Animate | Use After Free (CWE-416) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52989](https://cve.now/CVE-2024-52989.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52990](https://cve.now/CVE-2024-52990.md): Animate | Buffer Underwrite ('Buffer Underflow') (CWE-124) (CVSS 7.8, Adobe Animate)
- [CVE-2024-53954](https://cve.now/CVE-2024-53954.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52983](https://cve.now/CVE-2024-52983.md): Animate | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52988](https://cve.now/CVE-2024-52988.md): Animate | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52984](https://cve.now/CVE-2024-52984.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate)
- [CVE-2024-52986](https://cve.now/CVE-2024-52986.md): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Animate)
- [CVE-2024-49538](https://cve.now/CVE-2024-49538.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-49541](https://cve.now/CVE-2024-49541.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-49537](https://cve.now/CVE-2024-49537.md): After Effects | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe After Effects)
- [CVE-2024-49553](https://cve.now/CVE-2024-49553.md): Media Encoder | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Media Encoder)
- [CVE-2024-49554](https://cve.now/CVE-2024-49554.md): Media Encoder | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Media Encoder)
- [CVE-2024-49552](https://cve.now/CVE-2024-49552.md): Media Encoder | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Media Encoder)
- [CVE-2024-49551](https://cve.now/CVE-2024-49551.md): Media Encoder | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Media Encoder)
- [CVE-2024-49105](https://cve.now/CVE-2024-49105.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2024-49532](https://cve.now/CVE-2024-49532.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-49534](https://cve.now/CVE-2024-49534.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-49531](https://cve.now/CVE-2024-49531.md): Acrobat Reader | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-49533](https://cve.now/CVE-2024-49533.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-49535](https://cve.now/CVE-2024-49535.md): Acrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 6.3, Adobe Acrobat Reader)
- [CVE-2024-49530](https://cve.now/CVE-2024-49530.md): Acrobat Reader | Use After Free (CWE-416) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-11773](https://cve.now/CVE-2024-11773.md): SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to ru (CVSS 9.1, Ivanti Cloud Services Application)
- [CVE-2024-11772](https://cve.now/CVE-2024-11772.md): Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges t (CVSS 9.1, Ivanti Cloud Services Application)
- [CVE-2024-11639](https://cve.now/CVE-2024-11639.md): An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative (CVSS 10.0, Ivanti Cloud Services Application)
- [CVE-2024-7572](https://cve.now/CVE-2024-7572.md): Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. (CVSS 7.1, Ivanti Desktop and Server Management)
- [CVE-2024-8540](https://cve.now/CVE-2024-8540.md): Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive a (CVSS 8.8, Ivanti Sentry)
- [CVE-2024-11634](https://cve.now/CVE-2024-11634.md): Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenti (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-11633](https://cve.now/CVE-2024-11633.md): Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve (CVSS 9.1, Ivanti Connect Secure)
- [CVE-2024-9844](https://cve.now/CVE-2024-9844.md): Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticat (CVSS 7.1, Ivanti Connect Secure)
- [CVE-2024-10256](https://cve.now/CVE-2024-10256.md): Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. (CVSS 7.1, Ivanti Patch SDK · Ivanti Endpoint Manager +4)
- [CVE-2024-54008](https://cve.now/CVE-2024-54008.md): Authenticated Remote Code Execution (RCE) in HPE Aruba Networking AirWave Management Platform (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking AirWa…)
- [CVE-2024-53244](https://cve.now/CVE-2024-53244.md): Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameter (CVSS 5.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-53246](https://cve.now/CVE-2024-53246.md): Sensitive Information Disclosure through SPL commands (CVSS 5.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-53243](https://cve.now/CVE-2024-53243.md): Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway (CVSS 4.3, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2024-53245](https://cve.now/CVE-2024-53245.md): Information Disclosure due to Username Collision with a Role that has the same Name as the User (CVSS 3.1, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-53247](https://cve.now/CVE-2024-53247.md): Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app (CVSS 8.8, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2024-49138](https://cve.now/CVE-2024-49138.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-49128](https://cve.now/CVE-2024-49128.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-49127](https://cve.now/CVE-2024-49127.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-49118](https://cve.now/CVE-2024-49118.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-49116](https://cve.now/CVE-2024-49116.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-49114](https://cve.now/CVE-2024-49114.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49113](https://cve.now/CVE-2024-49113.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-49112](https://cve.now/CVE-2024-49112.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2024-49110](https://cve.now/CVE-2024-49110.md): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-49109](https://cve.now/CVE-2024-49109.md): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2024-49095](https://cve.now/CVE-2024-49095.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-49090](https://cve.now/CVE-2024-49090.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49088](https://cve.now/CVE-2024-49088.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49083](https://cve.now/CVE-2024-49083.md): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-49082](https://cve.now/CVE-2024-49082.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-49081](https://cve.now/CVE-2024-49081.md): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2024-49080](https://cve.now/CVE-2024-49080.md): Windows IP Routing Management Snapin Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-49079](https://cve.now/CVE-2024-49079.md): Input Method Editor (IME) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49078](https://cve.now/CVE-2024-49078.md): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-49077](https://cve.now/CVE-2024-49077.md): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-49076](https://cve.now/CVE-2024-49076.md): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49075](https://cve.now/CVE-2024-49075.md): Windows Remote Desktop Services Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-49072](https://cve.now/CVE-2024-49072.md): Windows Task Scheduler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49065](https://cve.now/CVE-2024-49065.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2024-49063](https://cve.now/CVE-2024-49063.md): Microsoft/Muzic Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Muzic)
- [CVE-2024-49062](https://cve.now/CVE-2024-49062.md): Microsoft SharePoint Information Disclosure Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-43600](https://cve.now/CVE-2024-43600.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Office)
- [CVE-2024-49142](https://cve.now/CVE-2024-49142.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2024-49132](https://cve.now/CVE-2024-49132.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-49129](https://cve.now/CVE-2024-49129.md): Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-49126](https://cve.now/CVE-2024-49126.md): Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-49125](https://cve.now/CVE-2024-49125.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-49124](https://cve.now/CVE-2024-49124.md): Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-49123](https://cve.now/CVE-2024-49123.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-49122](https://cve.now/CVE-2024-49122.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-49121](https://cve.now/CVE-2024-49121.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-49120](https://cve.now/CVE-2024-49120.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-49119](https://cve.now/CVE-2024-49119.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-49117](https://cve.now/CVE-2024-49117.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-49115](https://cve.now/CVE-2024-49115.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-49111](https://cve.now/CVE-2024-49111.md): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2024-49108](https://cve.now/CVE-2024-49108.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-49107](https://cve.now/CVE-2024-49107.md): WmsRepair Service Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-49106](https://cve.now/CVE-2024-49106.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-49104](https://cve.now/CVE-2024-49104.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-49103](https://cve.now/CVE-2024-49103.md): Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2024-49102](https://cve.now/CVE-2024-49102.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-49101](https://cve.now/CVE-2024-49101.md): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2024-49099](https://cve.now/CVE-2024-49099.md): Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2024-49098](https://cve.now/CVE-2024-49098.md): Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2024-49097](https://cve.now/CVE-2024-49097.md): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-49096](https://cve.now/CVE-2024-49096.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-49094](https://cve.now/CVE-2024-49094.md): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2024-49093](https://cve.now/CVE-2024-49093.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-49092](https://cve.now/CVE-2024-49092.md): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-49091](https://cve.now/CVE-2024-49091.md): Windows Domain Name Service Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-49089](https://cve.now/CVE-2024-49089.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2024-49087](https://cve.now/CVE-2024-49087.md): Windows Mobile Broadband Driver Information Disclosure Vulnerability (CVSS 4.6, Microsoft Windows)
- [CVE-2024-49086](https://cve.now/CVE-2024-49086.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-49085](https://cve.now/CVE-2024-49085.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-49084](https://cve.now/CVE-2024-49084.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-49074](https://cve.now/CVE-2024-49074.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49073](https://cve.now/CVE-2024-49073.md): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-49070](https://cve.now/CVE-2024-49070.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 7.4, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-49069](https://cve.now/CVE-2024-49069.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2024-49068](https://cve.now/CVE-2024-49068.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-49064](https://cve.now/CVE-2024-49064.md): Microsoft SharePoint Information Disclosure Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-49059](https://cve.now/CVE-2024-49059.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2024-49057](https://cve.now/CVE-2024-49057.md): Microsoft Defender for Endpoint on Android Spoofing Vulnerability (CVSS 8.1, Microsoft Defender for Endpoint for Android)
- [CVE-2024-43594](https://cve.now/CVE-2024-43594.md): Microsoft System Center Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft System Center)
- [CVE-2024-12286](https://cve.now/CVE-2024-12286.md): MOBATIME Network Master Clock has a use of default credentials vulnerability (CVSS 9.3, MOBATIME Network Master Clock - DTS)
- [CVE-2024-53866](https://cve.now/CVE-2024-53866.md): pnpm vulnerable to no-script global cache poisoning via overrides / \`ignore-scripts\` evasion (CVSS 5.8, pnpm)
- [CVE-2024-55602](https://cve.now/CVE-2024-55602.md): PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal (CVSS 7.6, pwndoc)
- [CVE-2024-55548](https://cve.now/CVE-2024-55548.md): Denial of Service (CVSS 6.9, ORing IAP-420)
- [CVE-2024-55547](https://cve.now/CVE-2024-55547.md): Remote Command Execution via SNMP (CVSS 9.3, ORing IAP-420)
- [CVE-2024-55546](https://cve.now/CVE-2024-55546.md): Stored Cross-Site Scripting (CVSS 7.1, ORing IAP-420)
- [CVE-2024-55545](https://cve.now/CVE-2024-55545.md): Reflected Cross-Site Scripting (CVSS 7.1, ORing IAP-420)
- [CVE-2024-55544](https://cve.now/CVE-2024-55544.md): Authenticated Command Injection (CVSS 8.7, ORing IAP-420)
- [CVE-2024-10496](https://cve.now/CVE-2024-10496.md): Out of bounds read in BuildFontMap in fontmgr.cpp in NI LabVIEW (CVSS 7.8, NI LabVIEW)
- [CVE-2024-10495](https://cve.now/CVE-2024-10495.md): Out of bounds read when loading the font table in fontmgr.cpp in NI LabVIEW (CVSS 7.8, NI LabVIEW)
- [CVE-2024-10494](https://cve.now/CVE-2024-10494.md): Out of bounds read in HeapObjMapImpl.cpp in NI LabVIEW (CVSS 7.8, NI LabVIEW)
- [CVE-2024-54152](https://cve.now/CVE-2024-54152.md): Angular Expressions - Remote Code Execution when using locals (CVSS 9.3, peerigon angular-expressions · angular-expressions)
- [CVE-2024-12236](https://cve.now/CVE-2024-12236.md): Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration (CVSS 6.8, Google Cloud Platform Vertex Gemini API)
- [CVE-2024-12323](https://cve.now/CVE-2024-12323.md): turboSMTP \<= 4.6 - Reflected Cross-Site Scripting via 'page' (CVSS 6.1, turboSMTP)
- [CVE-2024-5660](https://cve.now/CVE-2024-5660.md): Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A (CVSS 9.8, Arm Cortex-A77 · Arm Neoverse +10)
- [CVE-2024-54095](https://cve.now/CVE-2024-54095.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2024)
- [CVE-2024-54094](https://cve.now/CVE-2024-54094.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 5). (CVSS 7.8, Siemens Solid Edge SE2024)
- [CVE-2024-54093](https://cve.now/CVE-2024-54093.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 5). (CVSS 7.8, Siemens Solid Edge SE2024)
- [CVE-2024-54091](https://cve.now/CVE-2024-54091.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 12), Solid Edge SE2025 (All versions \< V225.0 Update (CVSS 7.8, Siemens Solid Edge SE2024 · Siemens Solid Edge SE2025)
- [CVE-2024-54005](https://cve.now/CVE-2024-54005.md): A vulnerability has been identified in COMOS V10.3 (All versions \< V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), (CVSS 5.1, Siemens COMOS)
- [CVE-2024-53832](https://cve.now/CVE-2024-53832.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V05.30). (CVSS 4.6, Siemens CPCI85 Central Processing/Communication)
- [CVE-2024-53242](https://cve.now/CVE-2024-53242.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-53041](https://cve.now/CVE-2024-53041.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52051](https://cve.now/CVE-2024-52051.md): A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 (CVSS 7.3, Siemens SIMATIC S7-PLCSIM · Siemens SIMATIC STEP 7 Safe… +10)
- [CVE-2024-49849](https://cve.now/CVE-2024-49849.md): A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (CVSS 7.8, Siemens SIMATIC S7-PLCSIM · Siemens SIMATIC STEP 7 Safety +9)
- [CVE-2024-49704](https://cve.now/CVE-2024-49704.md): A vulnerability has been identified in COMOS V10.3 (All versions \< V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), (CVSS 5.5, Siemens COMOS)
- [CVE-2020-28398](https://cve.now/CVE-2020-28398.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.16.0), RUGGEDCOM ROX MX5000RE (All versions \< V2.16.0), RUGGE (CVSS 8.8, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9)
- [CVE-2024-47117](https://cve.now/CVE-2024-47117.md): IBM Carbon Design System cross-site scripting (CVSS 5.4, IBM Carbon Charts)
- [CVE-2024-11868](https://cve.now/CVE-2024-11868.md): LearnPress – WordPress LMS Plugin \<= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API (CVSS 5.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-10959](https://cve.now/CVE-2024-10959.md): Active Products Tables for WooCommerce. Use constructor to create tables \<= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot\_get\_smth (CVSS 7.3, realmag777 Active Products Tables for WooCommerce. Use cons…)
- [CVE-2024-11106](https://cve.now/CVE-2024-11106.md): Simple Restrict \<= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, wpchill Simple Restrict)
- [CVE-2024-11928](https://cve.now/CVE-2024-11928.md): iChart – Easy Charts and Graphs \<= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (CVSS 6.4, quantumcloud iChart – Easy Charts and Graphs)
- [CVE-2024-47977](https://cve.now/CVE-2024-47977.md): Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization (CVSS 7.1, Dell Avamar)
- [CVE-2024-47484](https://cve.now/CVE-2024-47484.md): Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization (CVSS 8.2, Dell Avamar)
- [CVE-2024-52538](https://cve.now/CVE-2024-52538.md): Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization (CVSS 7.6, Dell Avamar)
- [CVE-2024-11945](https://cve.now/CVE-2024-11945.md): Email Reminders \<= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, wpdevelop Email Reminders)
- [CVE-2024-11973](https://cve.now/CVE-2024-11973.md): Quran multilanguage Text & Audio \<= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters (CVSS 6.1, karim42 Quran multilanguage Text & Audio)
- [CVE-2024-8256](https://cve.now/CVE-2024-8256.md): Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches (CVSS 5.9, Teltonika Networks RUTOS · Teltonika Networks TSWOS)
- [CVE-2024-11940](https://cve.now/CVE-2024-11940.md): Property Hive Mortgage Calculator \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via price Parameter (CVSS 6.4, propertyhive Property Hive Mortgage Calculator)
- [CVE-2024-45709](https://cve.now/CVE-2024-45709.md): SolarWinds Web Help Desk Local File Read Vulnerability (CVSS 5.3, SolarWinds Web Help Desk)
- [CVE-2024-47946](https://cve.now/CVE-2024-47946.md): OS Command Execution through Arbitrary File Upload (CVSS 7.2, Image Access Scan2Net)
- [CVE-2024-28138](https://cve.now/CVE-2024-28138.md): OS Command Injection (CVSS 7.3, Image Access Scan2Net)
- [CVE-2024-11107](https://cve.now/CVE-2024-11107.md): System Dashboard \< 2.8.15 - Unauthenticated Stored XSS (CVSS 6.1, System Dashboard)
- [CVE-2024-10708](https://cve.now/CVE-2024-10708.md): System Dashboard \< 2.8.15 - Admin+ Path Traversal (CVSS 4.9, System Dashboard)
- [CVE-2023-6947](https://cve.now/CVE-2023-6947.md): Best WordPress Gallery Plugin – FooGallery \<= 2.4.16 - Authenticated (Contributor+) Directory Traversal (CVSS 7.7, https://fooplugins.com FooGallery Premium)
- [CVE-2024-21542](https://cve.now/CVE-2024-21542.md): Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destinat (CVSS 7.7, luigi)
- [CVE-2024-11205](https://cve.now/CVE-2024-11205.md): WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation (CVSS 8.5, smub WPForms – Easy Form Builder for WordPress – Contact Fo…)
- [CVE-2024-37143](https://cve.now/CVE-2024-37143.md): Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x t (CVSS 10.0, Dell PowerFlex appliance · Dell PowerFlex rack +3)
- [CVE-2024-37144](https://cve.now/CVE-2024-37144.md): Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x t (CVSS 8.2, Dell PowerFlex appliance · Dell PowerFlex rack +3)
- [CVE-2024-54198](https://cve.now/CVE-2024-54198.md): Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP (CVSS 8.5, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2024-54197](https://cve.now/CVE-2024-54197.md): Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview) (CVSS 7.2, SAP\_SE SAP NetWeaver Administrator)
- [CVE-2024-47585](https://cve.now/CVE-2024-47585.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-47582](https://cve.now/CVE-2024-47582.md): XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA (CVSS 5.3, SAP\_SE SAP NetWeaver AS JAVA)
- [CVE-2024-47581](https://cve.now/CVE-2024-47581.md): Missing Authorization check in SAP HCM (Approve Timesheets version 4) (CVSS 4.3, SAP\_SE SAP HCM)
- [CVE-2024-47580](https://cve.now/CVE-2024-47580.md): Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services) (CVSS 6.8, SAP\_SE SAP NetWeaver AS for JAVA)
- [CVE-2024-47579](https://cve.now/CVE-2024-47579.md): Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services) (CVSS 6.8, SAP\_SE SAP NetWeaver AS for JAVA)
- [CVE-2024-47578](https://cve.now/CVE-2024-47578.md): Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services) (CVSS 9.1, SAP\_SE SAP NetWeaver AS for JAVA)
- [CVE-2024-47577](https://cve.now/CVE-2024-47577.md): Information Disclosure vulnerability in SAP Commerce Cloud (CVSS 2.7, SAP\_SE SAP Commerce Cloud)
- [CVE-2024-47576](https://cve.now/CVE-2024-47576.md): DLL Hijacking vulnerability in SAP Product Lifecycle Costing (CVSS 3.3, SAP\_SE SAP Product Lifecycle Costing)
- [CVE-2024-32732](https://cve.now/CVE-2024-32732.md): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform (CVSS 5.3, SAP\_SE SAP BusinessObjects Business Intelligence platform)
- [CVE-2024-45493](https://cve.now/CVE-2024-45493.md): An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). (CVSS 9.8)
- [CVE-2024-45494](https://cve.now/CVE-2024-45494.md): An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). (CVSS 9.8)
- [CVE-2024-46340](https://cve.now/CVE-2024-46340.md): TL-WR845N(UN)\_V4\_201214, TP-Link TL-WR845N(UN)\_V4\_200909, and TL-WR845N(UN)\_V4\_190219 was discovered to transmit user credentials in plainte (CVSS 9.8)
- [CVE-2024-46341](https://cve.now/CVE-2024-46341.md): TP-Link TL-WR845N(UN)\_V4\_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker ex (CVSS 8.0)
- [CVE-2024-46442](https://cve.now/CVE-2024-46442.md): An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack. (CVSS 9.8)
- [CVE-2024-46657](https://cve.now/CVE-2024-46657.md): Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. (CVSS 5.5)
- [CVE-2024-50699](https://cve.now/CVE-2024-50699.md): TP-Link TL-WR845N(UN)\_V4\_201214, TL-WR845N(UN)\_V4\_200909 and TL-WR845N(UN)\_V4\_190219 were discovered to contain weak default credentials for (CVSS 8.0)
- [CVE-2024-50920](https://cve.now/CVE-2024-50920.md): Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted (CVSS 8.8)
- [CVE-2024-50921](https://cve.now/CVE-2024-50921.md): Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repea (CVSS 6.5)
- [CVE-2024-50924](https://cve.now/CVE-2024-50924.md): Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the (CVSS 6.5)
- [CVE-2024-50928](https://cve.now/CVE-2024-50928.md): Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices (CVSS 6.5)
- [CVE-2024-50929](https://cve.now/CVE-2024-50929.md): Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the (CVSS 6.2)
- [CVE-2024-50930](https://cve.now/CVE-2024-50930.md): An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. (CVSS 8.8)
- [CVE-2024-50931](https://cve.now/CVE-2024-50931.md): Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. (CVSS 4.6)
- [CVE-2024-51165](https://cve.now/CVE-2024-51165.md): SQL injection vulnerability in JEPAAS7.2.8, via /je/rbac/rbac/loadLoginCount in the dateVal parameter, which could allow a remote user to su (CVSS 7.5)
- [CVE-2024-53480](https://cve.now/CVE-2024-53480.md): Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in \`login.php\` via the \`emailcont\` parameter. (CVSS 9.8)
- [CVE-2024-53481](https://cve.now/CVE-2024-53481.md): A Cross Site Scripting (XSS) vulnerability in the profile.php of PHPGurukul Beauty Parlour Management System v1.1 allows remote attackers to (CVSS 6.1)
- [CVE-2024-53552](https://cve.now/CVE-2024-53552.md): CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. (CVSS 9.8)
- [CVE-2024-53919](https://cve.now/CVE-2024-53919.md): An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, all (CVSS 7.6)
- [CVE-2024-54751](https://cve.now/CVE-2024-54751.md): COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as (CVSS 9.8)
- [CVE-2024-55500](https://cve.now/CVE-2024-55500.md): Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the ex (CVSS 8.8, whistle)
- [CVE-2024-55550](https://cve.now/CVE-2024-55550.md): Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insu (CVSS 4.4, KEV)
- [CVE-2024-55586](https://cve.now/CVE-2024-55586.md): Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where m (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.