# CVEs published 2024-12-11 155 CVEs were published on December 11, 2024: 12 critical, 48 high. Days are UTC. - [CVE-2024-12497](https://cve.now/CVE-2024-12497.md): 1000 Projects Attendance Tracking Management System check\_admin\_login.php sql injection (CVSS 6.9, 1000 Projects Attendance Tracking Management System) - [CVE-2024-12492](https://cve.now/CVE-2024-12492.md): code-projects Farmacia visualizar-usuario.php sql injection (CVSS 5.3, code-projects Farmacia) - [CVE-2024-44299](https://cve.now/CVE-2024-44299.md): The issue was addressed with improved bounds checks. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS) - [CVE-2024-54466](https://cve.now/CVE-2024-54466.md): An authorization issue was addressed with improved state management. (CVSS 6.5, Apple macOS) - [CVE-2024-54489](https://cve.now/CVE-2024-54489.md): A path handling issue was addressed with improved validation. (CVSS 5.3, Apple macOS) - [CVE-2024-54503](https://cve.now/CVE-2024-54503.md): An inconsistent user interface issue was addressed with improved state management. (CVSS 3.3, Apple iOS and iPadOS) - [CVE-2024-54515](https://cve.now/CVE-2024-54515.md): A logic issue was addressed with improved restrictions. (CVSS 7.8, Apple macOS) - [CVE-2024-54493](https://cve.now/CVE-2024-54493.md): This issue was addressed through improved state management. (CVSS 3.3, Apple macOS) - [CVE-2024-44201](https://cve.now/CVE-2024-44201.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +1) - [CVE-2024-54485](https://cve.now/CVE-2024-54485.md): The issue was addressed by adding additional logic. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +1) - [CVE-2024-54484](https://cve.now/CVE-2024-54484.md): The issue was resolved by sanitizing logging. (CVSS 5.5, Apple macOS) - [CVE-2024-44200](https://cve.now/CVE-2024-44200.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS) - [CVE-2024-54492](https://cve.now/CVE-2024-54492.md): This issue was addressed by using HTTPS when sending information over the network. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +2) - [CVE-2024-44241](https://cve.now/CVE-2024-44241.md): The issue was addressed with improved bounds checks. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS) - [CVE-2024-54514](https://cve.now/CVE-2024-54514.md): The issue was addressed with improved checks. (CVSS 8.2, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-54502](https://cve.now/CVE-2024-54502.md): The issue was addressed with improved checks. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +5) - [CVE-2024-54471](https://cve.now/CVE-2024-54471.md): This issue was addressed with additional entitlement checks. (CVSS 5.5, Apple macOS) - [CVE-2024-54534](https://cve.now/CVE-2024-54534.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +5) - [CVE-2024-44220](https://cve.now/CVE-2024-44220.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple macOS) - [CVE-2024-54505](https://cve.now/CVE-2024-54505.md): A type confusion issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +5) - [CVE-2024-54513](https://cve.now/CVE-2024-54513.md): A permissions issue was addressed with additional restrictions. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2024-44246](https://cve.now/CVE-2024-44246.md): The issue was addressed with improved routing of Safari-originated requests. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2024-54495](https://cve.now/CVE-2024-54495.md): The issue was addressed with improved permissions logic. (CVSS 5.5, Apple macOS) - [CVE-2024-54529](https://cve.now/CVE-2024-54529.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple macOS) - [CVE-2024-54476](https://cve.now/CVE-2024-54476.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS) - [CVE-2024-54524](https://cve.now/CVE-2024-54524.md): A logic issue was addressed with improved file handling. (CVSS 5.5, Apple macOS) - [CVE-2024-54477](https://cve.now/CVE-2024-54477.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS) - [CVE-2024-54498](https://cve.now/CVE-2024-54498.md): A path handling issue was addressed with improved validation. (CVSS 8.8, Apple macOS) - [CVE-2024-54508](https://cve.now/CVE-2024-54508.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +5) - [CVE-2024-54528](https://cve.now/CVE-2024-54528.md): A logic issue was addressed with improved restrictions. (CVSS 7.1, Apple macOS) - [CVE-2024-54494](https://cve.now/CVE-2024-54494.md): A race condition was addressed with additional validation. (CVSS 5.9, Apple iOS and iPadOS · Apple iPadOS +4) - [CVE-2024-54504](https://cve.now/CVE-2024-54504.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS) - [CVE-2024-44291](https://cve.now/CVE-2024-44291.md): A logic issue was addressed with improved file handling. (CVSS 7.8, Apple macOS) - [CVE-2024-54527](https://cve.now/CVE-2024-54527.md): This issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-44248](https://cve.now/CVE-2024-44248.md): This issue was addressed through improved state management. (CVSS 6.5, Apple macOS) - [CVE-2024-54531](https://cve.now/CVE-2024-54531.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS) - [CVE-2024-54474](https://cve.now/CVE-2024-54474.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS) - [CVE-2024-44225](https://cve.now/CVE-2024-44225.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple iPadOS +3) - [CVE-2024-44224](https://cve.now/CVE-2024-44224.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS) - [CVE-2024-54526](https://cve.now/CVE-2024-54526.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-44290](https://cve.now/CVE-2024-44290.md): This issue was addressed with improved redaction of sensitive information. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +1) - [CVE-2024-54506](https://cve.now/CVE-2024-54506.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 9.8, Apple macOS) - [CVE-2024-54510](https://cve.now/CVE-2024-54510.md): A race condition was addressed with improved locking. (CVSS 5.1, Apple iOS and iPadOS · Apple iPadOS +3) - [CVE-2024-44300](https://cve.now/CVE-2024-44300.md): A logic issue was addressed with improved file handling. (CVSS 5.5, Apple macOS) - [CVE-2024-44245](https://cve.now/CVE-2024-44245.md): The issue was addressed with improved memory handling. (CVSS 7.1, Apple iOS and iPadOS · Apple iPadOS +2) - [CVE-2024-54479](https://cve.now/CVE-2024-54479.md): The issue was addressed with improved checks. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +5) - [CVE-2024-44212](https://cve.now/CVE-2024-44212.md): A cookie management issue was addressed with improved state management. (CVSS 5.3, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2024-54491](https://cve.now/CVE-2024-54491.md): The issue was resolved by sanitizing logging. (CVSS 5.5, Apple macOS) - [CVE-2024-44242](https://cve.now/CVE-2024-44242.md): The issue was addressed with improved bounds checks. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS) - [CVE-2024-54501](https://cve.now/CVE-2024-54501.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4) - [CVE-2024-54500](https://cve.now/CVE-2024-54500.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4) - [CVE-2024-44243](https://cve.now/CVE-2024-44243.md): A configuration issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS) - [CVE-2024-54490](https://cve.now/CVE-2024-54490.md): This issue was addressed by enabling hardened runtime. (CVSS 5.5, Apple macOS) - [CVE-2024-54486](https://cve.now/CVE-2024-54486.md): The issue was addressed with improved checks. (CVSS 6.5, Apple iOS and iPadOS · Apple iPadOS +4) - [CVE-2024-54465](https://cve.now/CVE-2024-54465.md): A logic issue was addressed with improved state management. (CVSS 9.8, Apple macOS) - [CVE-2024-55660](https://cve.now/CVE-2024-55660.md): SiYuan has an SSTI via /api/template/renderSprig (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel) - [CVE-2024-55659](https://cve.now/CVE-2024-55659.md): SiYuan has an arbitrary file write in the host via /api/asset/upload (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel) - [CVE-2024-55658](https://cve.now/CVE-2024-55658.md): SiYuan has an arbitrary file read and path traversal via /api/export/exportResources (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel) - [CVE-2024-55657](https://cve.now/CVE-2024-55657.md): SiYuan has an arbitrary file read via /api/template/render (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel) - [CVE-2024-55652](https://cve.now/CVE-2024-55652.md): PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters (CVSS 6.5, pwndoc) - [CVE-2024-53845](https://cve.now/CVE-2024-53845.md): AES/CBC Constant IV Vulnerability in ESPTouch v2 (CVSS 6.6, espressif esp-idf) - [CVE-2024-12490](https://cve.now/CVE-2024-12490.md): code-projects Online Class and Exam Scheduling System teacher\_save.php sql injection (CVSS 5.3, code-projects Online Class and Exam Scheduling System) - [CVE-2024-53274](https://cve.now/CVE-2024-53274.md): GHSL-2024-111: Reflected XSS in /home in habitica (CVSS 2.0, HabitRPG habatica) - [CVE-2024-53273](https://cve.now/CVE-2024-53273.md): GHSL-2024-110: Reflected XSS in /register in habitica (CVSS 5.0, HabitRPG habatica) - [CVE-2024-53272](https://cve.now/CVE-2024-53272.md): GHSL-2024-109: Reflected XSS in /login in habitica (CVSS 5.0, HabitRPG habatica) - [CVE-2024-45404](https://cve.now/CVE-2024-45404.md): OpenCTI's lack of Rate Limit lead to OTP brute forcing (CVSS 8.1, OpenCTI-Platform opencti · pycti) - [CVE-2024-12489](https://cve.now/CVE-2024-12489.md): code-projects Online Class and Exam Scheduling System term.php sql injection (CVSS 5.3, code-projects Online Class and Exam Scheduling System) - [CVE-2024-11872](https://cve.now/CVE-2024-11872.md): Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability (CVSS 7.8, Epic Games Launcher) - [CVE-2024-11949](https://cve.now/CVE-2024-11949.md): GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.8, GFI Archiver) - [CVE-2024-11948](https://cve.now/CVE-2024-11948.md): GFI Archiver Telerik Web UI Remote Code Execution Vulnerability (CVSS 9.8, GFI Archiver) - [CVE-2024-11947](https://cve.now/CVE-2024-11947.md): GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.8, GFI Archiver) - [CVE-2024-11950](https://cve.now/CVE-2024-11950.md): XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability (CVSS 7.8, XnSoft XnView Classic) - [CVE-2024-12488](https://cve.now/CVE-2024-12488.md): code-projects Online Class and Exam Scheduling System subject\_update.php sql injection (CVSS 5.3, code-projects Online Class and Exam Scheduling System) - [CVE-2024-12487](https://cve.now/CVE-2024-12487.md): code-projects Online Class and Exam Scheduling System room\_update.php sql injection (CVSS 5.3, code-projects Online Class and Exam Scheduling System) - [CVE-2024-12486](https://cve.now/CVE-2024-12486.md): code-projects Online Class and Exam Scheduling System rank\_update.php sql injection (CVSS 5.3, code-projects Online Class and Exam Scheduling System) - [CVE-2024-12485](https://cve.now/CVE-2024-12485.md): code-projects Online Class and Exam Scheduling System department.php sql injection (CVSS 5.3, code-projects Online Class and Exam Scheduling System) - [CVE-2024-12484](https://cve.now/CVE-2024-12484.md): Codezips Technical Discussion Forum signuppost.php sql injection (CVSS 6.9, Codezips Technical Discussion Forum) - [CVE-2024-12483](https://cve.now/CVE-2024-12483.md): Dromara UJCMS User ID id authorization (CVSS 6.3, Dromara UJCMS) - [CVE-2024-12482](https://cve.now/CVE-2024-12482.md): cjbi wetech-cms Database Backup BackupFileUtil.java backup path traversal (CVSS 5.3, cjbi wetech-cms) - [CVE-2024-12481](https://cve.now/CVE-2024-12481.md): cjbi wetech-cms UserDao.java findUser sql injection (CVSS 5.3, cjbi wetech-cms) - [CVE-2024-47834](https://cve.now/CVE-2024-47834.md): GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate (CVSS 5.1, gstreamer) - [CVE-2024-47835](https://cve.now/CVE-2024-47835.md): GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser (CVSS 6.8, gstreamer) - [CVE-2024-47778](https://cve.now/CVE-2024-47778.md): GHSL-2024-258: GStreamer has an OOB-read in gst\_wavparse\_adtl\_chunk (CVSS 5.1, gstreamer) - [CVE-2024-47777](https://cve.now/CVE-2024-47777.md): GHSL-2024-259: GStreamer has an OOB-read in gst\_wavparse\_smpl\_chunk (CVSS 5.1, gstreamer) - [CVE-2024-47776](https://cve.now/CVE-2024-47776.md): GHSL-2024-260: GStreamer has a OOB-read in gst\_wavparse\_cue\_chunk (CVSS 5.1, gstreamer) - [CVE-2024-47775](https://cve.now/CVE-2024-47775.md): GHSL-2024-261: GStreamer has an OOB-read in parse\_ds64 (CVSS 5.1, gstreamer) - [CVE-2024-47774](https://cve.now/CVE-2024-47774.md): GHSL-2024-262: GStreamer has an OOB-read in gst\_avi\_subtitle\_parse\_gab2\_chunk (CVSS 5.1, gstreamer) - [CVE-2024-47613](https://cve.now/CVE-2024-47613.md): GHSL-2024-118: GStreamer has a null pointer dereference in gst\_gdk\_pixbuf\_dec\_flush (CVSS 8.6, gstreamer) - [CVE-2024-47615](https://cve.now/CVE-2024-47615.md): GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer (CVSS 8.6, gstreamer) - [CVE-2024-47607](https://cve.now/CVE-2024-47607.md): GHSL-2024-116: Stack-buffer overflow in gst\_opus\_dec\_parse\_header (CVSS 8.6, gstreamer) - [CVE-2024-47606](https://cve.now/CVE-2024-47606.md): GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes (CVSS 8.6, gstreamer) - [CVE-2024-47603](https://cve.now/CVE-2024-47603.md): GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer (CVSS 6.8, gstreamer) - [CVE-2024-47602](https://cve.now/CVE-2024-47602.md): GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (CVSS 6.8, gstreamer) - [CVE-2024-47601](https://cve.now/CVE-2024-47601.md): GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer (CVSS 6.8, gstreamer) - [CVE-2024-47600](https://cve.now/CVE-2024-47600.md): GHSL-2024-248: GStreamer has an OOB-read in format\_channel\_mask (CVSS 5.1, gstreamer) - [CVE-2024-47599](https://cve.now/CVE-2024-47599.md): GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (CVSS 6.8, gstreamer) - [CVE-2024-47598](https://cve.now/CVE-2024-47598.md): GHSL-2024-246: GStreamer has an OOB-read in qtdemux\_merge\_sample\_table (CVSS 5.1, gstreamer) - [CVE-2024-47597](https://cve.now/CVE-2024-47597.md): GHSL-2024-245: GStreamer has an OOB-read in qtdemux\_parse\_samples (CVSS 5.1, gstreamer) - [CVE-2024-47596](https://cve.now/CVE-2024-47596.md): GHSL-2024-244: GStreamer has an OOB-read in FOURCC\_SMI\_ parsing (CVSS 5.1, gstreamer) - [CVE-2024-47546](https://cve.now/CVE-2024-47546.md): GHSL-2024-243: GStreamer has an integer underflow in extract\_cc\_from\_data leading to OOB-read (CVSS 6.9, gstreamer) - [CVE-2024-12480](https://cve.now/CVE-2024-12480.md): cjbi wetech-cms TopicDao.java searchTopic sql injection (CVSS 5.3, cjbi wetech-cms) - [CVE-2024-47545](https://cve.now/CVE-2024-47545.md): GHSL-2024-242: GStreamer has an integer underflow in FOURCC\_strf parsing leading to OOB-read (CVSS 6.9, gstreamer) - [CVE-2024-47544](https://cve.now/CVE-2024-47544.md): GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVSS 6.8, gstreamer) - [CVE-2024-45337](https://cve.now/CVE-2024-45337.md): Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto (CVSS 9.1, golang.org/x/crypto/ssh · golang.org/x/crypto) - [CVE-2024-47543](https://cve.now/CVE-2024-47543.md): GHSL-2024-236: GStreamer has an OOB-read in qtdemux\_parse\_container (CVSS 5.1, gstreamer) - [CVE-2024-47542](https://cve.now/CVE-2024-47542.md): GHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference (CVSS 6.8, gstreamer) - [CVE-2024-47541](https://cve.now/CVE-2024-47541.md): GHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parser (CVSS 6.9, gstreamer) - [CVE-2024-47540](https://cve.now/CVE-2024-47540.md): GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer (CVSS 8.6, gstreamer) - [CVE-2024-47539](https://cve.now/CVE-2024-47539.md): GHSL-2024-195: GStreamer has an OOB-write in convert\_to\_s334\_1a (CVSS 8.6, gstreamer) - [CVE-2024-47538](https://cve.now/CVE-2024-47538.md): GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis\_handle\_identification\_packet (CVSS 8.6, gstreamer) - [CVE-2024-37401](https://cve.now/CVE-2024-37401.md): An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial o (CVSS 7.5, Ivanti Connect Secure) - [CVE-2024-42448](https://cve.now/CVE-2024-42448.md): From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Rem (CVSS 9.9, Veeam Service Provider Console) - [CVE-2024-37377](https://cve.now/CVE-2024-37377.md): A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a d (CVSS 7.5, Ivanti Connect Secure) - [CVE-2024-47537](https://cve.now/CVE-2024-47537.md): GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c (CVSS 8.6, gstreamer) - [CVE-2024-12479](https://cve.now/CVE-2024-12479.md): cjbi wetech-cms TopicDao.java searchTopicByKeyword sql injection (CVSS 5.3, cjbi wetech-cms) - [CVE-2024-12382](https://cve.now/CVE-2024-12382.md): Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome) - [CVE-2024-12381](https://cve.now/CVE-2024-12381.md): Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome) - [CVE-2024-50339](https://cve.now/CVE-2024-50339.md): GLPI vulnerable to unauthenticated session hijacking (CVSS 9.3, glpi-project glpi) - [CVE-2024-48912](https://cve.now/CVE-2024-48912.md): GLPI vulnerable to authenticated insecure account deletion (CVSS 7.2, glpi-project glpi) - [CVE-2024-47761](https://cve.now/CVE-2024-47761.md): GLPI vulnerable to account takeover via the password reset feature (CVSS 7.5, glpi-project glpi) - [CVE-2024-47760](https://cve.now/CVE-2024-47760.md): GLPI vulnerable to account takeover via API (CVSS 7.5, glpi-project glpi) - [CVE-2024-11598](https://cve.now/CVE-2024-11598.md): Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows (CVSS 7.8, Ivanti Application Control) - [CVE-2024-11597](https://cve.now/CVE-2024-11597.md): Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows (CVSS 7.8, Ivanti Performance Manager) - [CVE-2024-8496](https://cve.now/CVE-2024-8496.md): Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attack (CVSS 7.8, Ivanti Workspace Control) - [CVE-2024-9845](https://cve.now/CVE-2024-9845.md): Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to a (CVSS 7.8, Ivanti Automation) - [CVE-2024-10251](https://cve.now/CVE-2024-10251.md): Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker (CVSS 7.8, Ivanti Security Controls) - [CVE-2024-28141](https://cve.now/CVE-2024-28141.md): Cross-Site Request-Forgery (CVSS 6.3, Image Access Scan2Net) - [CVE-2024-47758](https://cve.now/CVE-2024-47758.md): GLPI vulnerable to account takeover without privilege escalation through the API (CVSS 7.6, glpi-project glpi) - [CVE-2024-28140](https://cve.now/CVE-2024-28140.md): Violation of Least Privilege Principle (CVSS 6.1, Image Access Scan2Net) - [CVE-2024-28139](https://cve.now/CVE-2024-28139.md): Privilege escalation through sudo misconfiguration (CVSS 8.8, Image Access Scan2Net) - [CVE-2024-53677](https://cve.now/CVE-2024-53677.md): Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks (CVSS 9.5, Apache Software Foundation Apache Struts · org.apache.strut…) - [CVE-2024-50585](https://cve.now/CVE-2024-50585.md): Reflected Cross-Site Scripting (CVSS 4.7, Numerix License Server Administration System) - [CVE-2024-11351](https://cve.now/CVE-2024-11351.md): Restrict – membership, site, content and user access restrictions for WordPress \<= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, tickera Restrict – membership, site, content and user acces…) - [CVE-2024-51460](https://cve.now/CVE-2024-51460.md): IBM InfoSphere Information Server information disclosure (CVSS 4.3, IBM InfoSphere Information Server) - [CVE-2023-23472](https://cve.now/CVE-2023-23472.md): IBM InfoSphere Information Server information disclosure (CVSS 3.1, IBM InfoSphere Information Server) - [CVE-2024-12325](https://cve.now/CVE-2024-12325.md): Waymark \<= 1.4.1 - Reflected Cross-Site Scripting via 'content' (CVSS 6.1, morehawes Waymark) - [CVE-2024-12294](https://cve.now/CVE-2024-12294.md): Last Viewed Posts by WPBeginner \<= 1.0.1 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, jottlieb Last Viewed Posts by WPBeginner) - [CVE-2024-11840](https://cve.now/CVE-2024-11840.md): RapidLoad – Optimize Web Vitals Automatically \<= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection (CVSS 7.1, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2024-11008](https://cve.now/CVE-2024-11008.md): Members \<= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, supercleanse Members – Membership & User Role Editor Plugin) - [CVE-2024-11401](https://cve.now/CVE-2024-11401.md): Rapid7 Insight Platform Privilege Escalation Vulnerability (CVSS 5.3, Rapid7 Insight Platform) - [CVE-2024-11737](https://cve.now/CVE-2024-11737.md): CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of th (CVSS 9.3, Schneider Electric Modicon Controllers M241 / M251 · Schnei…) - [CVE-2024-54269](https://cve.now/CVE-2024-54269.md): WordPress Notibar plugin \<= 2.1.4 - Broken Access Control vulnerability (CVSS 4.3, Ninja Team Notibar) - [CVE-2024-12363](https://cve.now/CVE-2024-12363.md): Insufficient permissions in the TeamViewer Patch & Asset Management component (CVSS 7.1, TeamViewer Patch & Asset Management) - [CVE-2024-10511](https://cve.now/CVE-2024-10511.md): CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwo (CVSS 6.3, Schneider Electric PowerChute Serial Shutdown) - [CVE-2024-12283](https://cve.now/CVE-2024-12283.md): WP Pipes \<= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter (CVSS 6.1, thimpress WP Pipes) - [CVE-2024-12004](https://cve.now/CVE-2024-12004.md): WPC Order Notes for WooCommerce \<= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, wpclever WPC Order Notes for WooCommerce) - [CVE-2024-53292](https://cve.now/CVE-2024-53292.md): Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. (CVSS 7.2, Dell VxRail HCI) - [CVE-2024-53289](https://cve.now/CVE-2024-53289.md): Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. (CVSS 7.8, Dell Wyse Proprietary OS) - [CVE-2024-53290](https://cve.now/CVE-2024-53290.md): Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. (CVSS 8.4, Dell Wyse Proprietary OS) - [CVE-2024-11053](https://cve.now/CVE-2024-11053.md): netrc and redirect credential leak (CVSS 3.4, curl) - [CVE-2024-52537](https://cve.now/CVE-2024-52537.md): Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. (CVSS 6.3, Dell Client Platform BIOS) - [CVE-2023-37395](https://cve.now/CVE-2023-37395.md): IBM Aspera Faspex information disclosure (CVSS 2.5, IBM Aspera Faspex) - [CVE-2024-35117](https://cve.now/CVE-2024-35117.md): IBM OpenPages with Watson information disclosure (CVSS 4.4, IBM OpenPages with Watson) - [CVE-2024-55587](https://cve.now/CVE-2024-55587.md): python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract (CVSS 8.8, python-libarchive) - [CVE-2024-55884](https://cve.now/CVE-2024-55884.md): In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhauste (CVSS 9.0) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-12-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.