CVEs published December 11, 2024
155 CVEs were published on December 11, 2024: 12 critical, 48 high.
- Published
- 155
- Critical
- 12
- High
- 48
- Medium
- 88
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 107
Most affected products
- gstreamer
- 29
- Apple macOS
- 26
- code-projects Online Class and Exam Scheduling System
- 6
- Apple Safari · Apple iOS and iPadOS +5
- 5
- glpi-project glpi
- 5
- Apple iOS and iPadOS · Apple iPadOS +4
- 4
- Apple iOS and iPadOS · Apple macOS
- 4
- cjbi wetech-cms
- 4
- siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- 4
- Apple iOS and iPadOS · Apple macOS +2
- 3
Critical 12
- CVE-2024-54492This issue was addressed by using HTTPS when sending information over the network.Apple iOS and iPadOS · Apple iPadOS +2
- CVE-2024-44241The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-54506An out-of-bounds access issue was addressed with improved bounds checking.Apple macOS
- CVE-2024-44242The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-54465A logic issue was addressed with improved state management.Apple macOS
- CVE-2024-11948GFI Archiver Telerik Web UI Remote Code Execution VulnerabilityGFI Archiver
- CVE-2024-45337Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptogolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2024-42448From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform RemVeeam Service Provider Console
- CVE-2024-50339GLPI vulnerable to unauthenticated session hijackingglpi-project glpi
- CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checksApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2024-11737CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of thSchneider Electric Modicon Controllers M241 / M251 · Schnei…
- CVE-2024-55884In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhauste
High 48
- CVE-2024-44299The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-54515A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2024-54514The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-54534The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2024-54529A logic issue was addressed with improved checks.Apple macOS
- CVE-2024-54498A path handling issue was addressed with improved validation.Apple macOS
- CVE-2024-54528A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2024-44291A logic issue was addressed with improved file handling.Apple macOS
- CVE-2024-44225A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2024-44224A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44245The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +2
- CVE-2024-54479The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +5
- CVE-2024-55659SiYuan has an arbitrary file write in the host via /api/asset/uploadsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55658SiYuan has an arbitrary file read and path traversal via /api/export/exportResourcessiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55657SiYuan has an arbitrary file read via /api/template/rendersiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2024-45404OpenCTI's lack of Rate Limit lead to OTP brute forcingOpenCTI-Platform opencti · pycti
- CVE-2024-11872Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation VulnerabilityEpic Games Launcher
- CVE-2024-11949GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution VulnerabilityGFI Archiver
- CVE-2024-11947GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution VulnerabilityGFI Archiver
- CVE-2024-11950XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution VulnerabilityXnSoft XnView Classic
- CVE-2024-47613GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flushgstreamer
- CVE-2024-47615GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxergstreamer
- CVE-2024-47607GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_headergstreamer
- CVE-2024-47606GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writesgstreamer
- CVE-2024-47540GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxergstreamer
- CVE-2024-47539GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1agstreamer
- CVE-2024-47538GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packetgstreamer
- CVE-2024-37401An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial oIvanti Connect Secure
- CVE-2024-37377A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a dIvanti Connect Secure
- CVE-2024-47537GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.cgstreamer
- CVE-2024-12382Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2024-12381Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2024-48912GLPI vulnerable to authenticated insecure account deletionglpi-project glpi
- CVE-2024-47761GLPI vulnerable to account takeover via the password reset featureglpi-project glpi
- CVE-2024-47760GLPI vulnerable to account takeover via APIglpi-project glpi
- CVE-2024-11598Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allowsIvanti Application Control
- CVE-2024-11597Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allowsIvanti Performance Manager
- CVE-2024-8496Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attackIvanti Workspace Control
- CVE-2024-9845Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to aIvanti Automation
- CVE-2024-10251Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attackerIvanti Security Controls
- CVE-2024-47758GLPI vulnerable to account takeover without privilege escalation through the APIglpi-project glpi
- CVE-2024-28139Privilege escalation through sudo misconfigurationImage Access Scan2Net
- CVE-2024-11840RapidLoad – Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injectionshakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2024-12363Insufficient permissions in the TeamViewer Patch & Asset Management componentTeamViewer Patch & Asset Management
- CVE-2024-53292Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper.Dell VxRail HCI
- CVE-2024-53289Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability.Dell Wyse Proprietary OS
- CVE-2024-53290Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.Dell Wyse Proprietary OS
- CVE-2024-55587python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extractpython-libarchive
Medium, low and unrated 95
- CVE-2024-124971000 Projects Attendance Tracking Management System check_admin_login.php sql injection1000 Projects Attendance Tracking Management System
- CVE-2024-12492code-projects Farmacia visualizar-usuario.php sql injectioncode-projects Farmacia
- CVE-2024-54466An authorization issue was addressed with improved state management.Apple macOS
- CVE-2024-54489A path handling issue was addressed with improved validation.Apple macOS
- CVE-2024-54503An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2024-54493This issue was addressed through improved state management.Apple macOS
- CVE-2024-44201The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2024-54485The issue was addressed by adding additional logic.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2024-54484The issue was resolved by sanitizing logging.Apple macOS
- CVE-2024-44200This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS
- CVE-2024-54502The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +5
- CVE-2024-54471This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2024-44220The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-54505A type confusion issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2024-54513A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44246The issue was addressed with improved routing of Safari-originated requests.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-54495The issue was addressed with improved permissions logic.Apple macOS
- CVE-2024-54476The issue was addressed with improved checks.Apple macOS
- CVE-2024-54524A logic issue was addressed with improved file handling.Apple macOS
- CVE-2024-54477The issue was addressed with improved checks.Apple macOS
- CVE-2024-54508The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2024-54494A race condition was addressed with additional validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2024-54504A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-54527This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-44248This issue was addressed through improved state management.Apple macOS
- CVE-2024-54531The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-54474The issue was addressed with improved checks.Apple macOS
- CVE-2024-54526The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-44290This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-54510A race condition was addressed with improved locking.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2024-44300A logic issue was addressed with improved file handling.Apple macOS
- CVE-2024-44212A cookie management issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-54491The issue was resolved by sanitizing logging.Apple macOS
- CVE-2024-54501The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2024-54500The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2024-44243A configuration issue was addressed with additional restrictions.Apple macOS
- CVE-2024-54490This issue was addressed by enabling hardened runtime.Apple macOS
- CVE-2024-54486The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2024-55660SiYuan has an SSTI via /api/template/renderSprigsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55652PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filterspwndoc
- CVE-2024-53845AES/CBC Constant IV Vulnerability in ESPTouch v2espressif esp-idf
- CVE-2024-12490code-projects Online Class and Exam Scheduling System teacher_save.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2024-53274GHSL-2024-111: Reflected XSS in /home in habiticaHabitRPG habatica
- CVE-2024-53273GHSL-2024-110: Reflected XSS in /register in habiticaHabitRPG habatica
- CVE-2024-53272GHSL-2024-109: Reflected XSS in /login in habiticaHabitRPG habatica
- CVE-2024-12489code-projects Online Class and Exam Scheduling System term.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2024-12488code-projects Online Class and Exam Scheduling System subject_update.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2024-12487code-projects Online Class and Exam Scheduling System room_update.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2024-12486code-projects Online Class and Exam Scheduling System rank_update.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2024-12485code-projects Online Class and Exam Scheduling System department.php sql injectioncode-projects Online Class and Exam Scheduling System
- CVE-2024-12484Codezips Technical Discussion Forum signuppost.php sql injectionCodezips Technical Discussion Forum
- CVE-2024-12483Dromara UJCMS User ID id authorizationDromara UJCMS
- CVE-2024-12482cjbi wetech-cms Database Backup BackupFileUtil.java backup path traversalcjbi wetech-cms
- CVE-2024-12481cjbi wetech-cms UserDao.java findUser sql injectioncjbi wetech-cms
- CVE-2024-47834GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivategstreamer
- CVE-2024-47835GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parsergstreamer
- CVE-2024-47778GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunkgstreamer
- CVE-2024-47777GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunkgstreamer
- CVE-2024-47776GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunkgstreamer
- CVE-2024-47775GHSL-2024-261: GStreamer has an OOB-read in parse_ds64gstreamer
- CVE-2024-47774GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunkgstreamer
- CVE-2024-47603GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxergstreamer
- CVE-2024-47602GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxergstreamer
- CVE-2024-47601GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxergstreamer
- CVE-2024-47600GHSL-2024-248: GStreamer has an OOB-read in format_channel_maskgstreamer
- CVE-2024-47599GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferencesgstreamer
- CVE-2024-47598GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_tablegstreamer
- CVE-2024-47597GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samplesgstreamer
- CVE-2024-47596GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsinggstreamer
- CVE-2024-47546GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-readgstreamer
- CVE-2024-12480cjbi wetech-cms TopicDao.java searchTopic sql injectioncjbi wetech-cms
- CVE-2024-47545GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-readgstreamer
- CVE-2024-47544GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handlinggstreamer
- CVE-2024-47543GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_containergstreamer
- CVE-2024-47542GHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereferencegstreamer
- CVE-2024-47541GHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parsergstreamer
- CVE-2024-12479cjbi wetech-cms TopicDao.java searchTopicByKeyword sql injectioncjbi wetech-cms
- CVE-2024-28141Cross-Site Request-ForgeryImage Access Scan2Net
- CVE-2024-28140Violation of Least Privilege PrincipleImage Access Scan2Net
- CVE-2024-50585Reflected Cross-Site ScriptingNumerix License Server Administration System
- CVE-2024-11351Restrict – membership, site, content and user access restrictions for WordPress <= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposuretickera Restrict – membership, site, content and user acces…
- CVE-2024-51460IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-23472IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-12325Waymark <= 1.4.1 - Reflected Cross-Site Scripting via 'content'morehawes Waymark
- CVE-2024-12294Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposurejottlieb Last Viewed Posts by WPBeginner
- CVE-2024-11008Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposuresupercleanse Members – Membership & User Role Editor Plugin
- CVE-2024-11401Rapid7 Insight Platform Privilege Escalation VulnerabilityRapid7 Insight Platform
- CVE-2024-54269WordPress Notibar plugin <= 2.1.4 - Broken Access Control vulnerabilityNinja Team Notibar
- CVE-2024-10511CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwoSchneider Electric PowerChute Serial Shutdown
- CVE-2024-12283WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameterthimpress WP Pipes
- CVE-2024-12004WPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingwpclever WPC Order Notes for WooCommerce
- CVE-2024-11053netrc and redirect credential leakcurl
- CVE-2024-52537Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability.Dell Client Platform BIOS
- CVE-2023-37395IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2024-35117IBM OpenPages with Watson information disclosureIBM OpenPages with Watson