# CVEs published 2024-12-15

9 CVEs were published on December 15, 2024: 1 critical, 5 high. Days are UTC.

- [CVE-2024-8798](https://cve.now/CVE-2024-8798.md): Bluetooth: classic: avdtp: missing buffer length check (CVSS 7.5, zephyrproject-rtos Zephyr)
- [CVE-2024-11858](https://cve.now/CVE-2024-11858.md): Radare2: command injection via pebble application files in radare2 (CVSS 8.6, radare2)
- [CVE-2024-7701](https://cve.now/CVE-2024-7701.md): Misuse of SHA256 to create an encryption key (CVSS 5.1, percona-toolkit)
- [CVE-2024-55969](https://cve.now/CVE-2024-55969.md): DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an exter (CVSS 9.1)
- [CVE-2024-55970](https://cve.now/CVE-2024-55970.md): File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, a (CVSS 7.5)
- [CVE-2024-56072](https://cve.now/CVE-2024-56072.md): An issue was discovered in FastNetMon Community Edition through 1.2.7. (CVSS 7.5)
- [CVE-2024-56073](https://cve.now/CVE-2024-56073.md): An issue was discovered in FastNetMon Community Edition through 1.2.7. (CVSS 7.5)
- [CVE-2024-56074](https://cve.now/CVE-2024-56074.md): gitingest before 9996a06 mishandles symbolic links that point outside of the base directory. (CVSS 5.5)
- [CVE-2024-56082](https://cve.now/CVE-2024-56082.md): ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set (CVSS 3.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.