CVEs published December 16, 2024
207 CVEs were published on December 16, 2024: 26 critical, 104 high.
- Published
- 207
- Critical
- 26
- High
- 104
- Medium
- 77
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- IObit Advanced SystemCare Utimate
- 6
- Dassault Systèmes ENOVIA Collaborative Industry Innovator
- 4
- FabulaTech USB over Network
- 4
- InvoicePlane
- 3
- SeedProd Pro
- 3
- Chunghwa Telecom tbm-client
- 2
- Chunghwa Telecom TenderDocTransfer
- 2
- Chunghwa Telecom topm-client
- 2
- GitLab
- 2
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 2
Critical 26
- CVE-2024-55949Privilege escalation in IAM import API in MinIOminio · github.com/minio/minio
- CVE-2024-54285WordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerabilitySeedProd Pro
- CVE-2024-54280WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerabilityIqonic Design WPBookit
- CVE-2024-43234WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerabilityWofficeIO Woffice
- CVE-2024-54229WordPress SV100 Companion plugin <= 2.0.02 - Privilege Escalation vulnerabilitystraightvisions SV100 Companion
- CVE-2024-49775A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V250Siemens Opcenter Execution Foundation · Siemens Opcenter… +5
- CVE-2024-54361WordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerabilitytenteeglobal Instant Appointment
- CVE-2024-54363WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerabilitysaiful.total Wp NssUser Register
- CVE-2024-54367WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerabilityUltimate Member ForumWP
- CVE-2024-54368WordPress GitSync plugin <= 1.1.0 - CSRF to Remote Code Execution vulnerabilityrubengarzajr GitSync
- CVE-2024-54369WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerabilityThemeHunk Zita Site Builder
- CVE-2024-54370WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.0 - Arbitrary File Upload vulnerabilitySuitePlugins Video & Photo Gallery for Ultimate Member
- CVE-2024-55972WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerabilitychriscarvache eTemplates
- CVE-2024-55976WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerabilitymikeleembruggen Critical Site Intel
- CVE-2024-55977WordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerabilityBinaryCarpenter LaunchPage.app Importer
- CVE-2024-55978WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerabilityWalletStation Code Generator Pro
- CVE-2024-55980WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerabilityrobindkumar Wr Age Verification
- CVE-2024-55981WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerabilityNabajit Roy Nabz Image Gallery
- CVE-2024-55982WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerabilityrichteam Share Buttons – Social Media
- CVE-2024-55988WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerabilityAmol Nirmala Waman Navayan CSV Export
- CVE-2024-54372WordPress Insertify plugin <= 1.1.4 - CSRF to Remote Code Execution vulnerabilitySourov Amin Insertify
- CVE-2024-56012WordPress Flash News / Post (Responsive) plugin <= 4.1 - CSRF to Privilege Escalation vulnerabilitylizeipe Flash News / Post
- CVE-2024-12641Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCEChunghwa Telecom TenderDocTransfer
- CVE-2024-29671Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request h
- CVE-2024-55085GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which ca
- CVE-2024-55557ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.
High 104
- CVE-2024-56017WordPress Stop Registration Spam Plugin <= 1.23 - CSRF to Stored XSS vulnerabilityTom Royal Stop Registration Spam
- CVE-2024-12687Insecure YAML DeserializationPlexTrac
- CVE-2024-8058An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary Lenovo FileZ Client
- CVE-2024-6001An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an upLenovo Accessories and Display Manager
- CVE-2024-4762An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escLenovo Accessories and Display Manager · Lenovo Display Con…
- CVE-2024-11144Race Condition with LightFTPLightFTP
- CVE-2024-10095Progress UI for WPF format provider unsafe deserialization vulnerabilityProgress Software Telerik UI for WPF
- CVE-2024-54376WordPress EazyDocs plugin <= 2.8.0 - Local File Inclusion vulnerabilitySpider Themes EazyDocs
- CVE-2024-54284WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerabilitySeedProd Pro
- CVE-2024-54283WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerabilitySeedProd Pro
- CVE-2024-54279WordPress WP-NERD Toolkit plugin <= 1.1 - Sensitive Data Exposure vulnerabilityTobias Keller WP-NERD Toolkit
- CVE-2024-54257WordPress tydskrif theme <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMolefed tydskrif
- CVE-2024-54249WordPress Advanced Options Editor plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityJules Colle Advanced Options Editor
- CVE-2024-12092Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2024-12091Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2024-12090Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2024-12089Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2024-12668Velocidex WinPmem Out of Bounds Write VulnerabilityVelocidex WinPmem
- CVE-2024-10972WinPmem Improper Input Validation vulnerabilityVelocidex WinPmem
- CVE-2024-56015WordPress Tidy Up Plugin <= 1.3 - CSRF to Reflected Cross-Site Scripting vulnerabilityJohn Godley Tidy Up
- CVE-2024-54358WordPress 3D Avatar User Profile plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEnrico Cantori 3D Avatar User Profile
- CVE-2024-54359WordPress Banner System plugin <= 1.0.0 - Broken Access Control vulnerabilitySaul Morales Pacheco Banner System
- CVE-2024-54364WordPress Feedpress Generator plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityspartac Feedpress Generator
- CVE-2024-54365WordPress KH Easy User Settings plugin <= 1.0.0 - Privilege Escalation vulnerabilityKnowhalim KH Easy User Settings
- CVE-2024-54374WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerabilitySabri Sogrid
- CVE-2024-54375WordPress Woolook plugin <= 1.7.0 - Local File Inclusion vulnerabilitySabri Woolook
- CVE-2024-54378WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerabilityQuietly Insights
- CVE-2024-54379WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerabilityblokhauswp Minterpress
- CVE-2024-54380WordPress WP Cookies Enabler plugin <= 1.0.1 - Local File Inclusion vulnerabilityFilippo Bodei WP Cookies Enabler
- CVE-2024-54385WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerabilityprinceahmed Radio Player
- CVE-2024-54387WordPress Posts Date Ranges plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityJaytesh Barange Posts Date Ranges
- CVE-2024-54390WordPress TagGator plugin <= 1.54 - Reflected Cross Site Scripting (XSS) vulnerabilityBouzid Nazim Zitouni TagGator
- CVE-2024-54395WordPress Increase Sociability plugin <= 1.3.0 - Reflected Cross Site Request Forgery (CSRF) vulnerabilitypreblogging Increase Sociability
- CVE-2024-54403WordPress Visual Recent Posts plugin <= 1.2.3 - Reflected Cross Site Request Forgery (CSRF) vulnerabilityoktoberfive Visual Recent Posts
- CVE-2024-54406WordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilitymoallemi Comments On Feed
- CVE-2024-54422WordPress Evernote Sync plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitytgw365 Evernote Sync
- CVE-2024-55973WordPress TSB Occasion Editor plugin <= 1.2.1 - SQL Injection vulnerabilityrnystrom TSB Occasion Editor
- CVE-2024-55974WordPress Mimoos plugin <= 1.2 - SQL Injection vulnerabilityMartí Batlles Martinez Mimoos
- CVE-2024-55979WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerabilityrobindkumar Wr Age Verification
- CVE-2024-55986WordPress Service plugin <= 1.0.4 - SQL Injection vulnerabilitytiny13 Service
- CVE-2024-55987WordPress Advanced What should we write next about plugin <= 1.0.3 - SQL Injection vulnerabilityRitesh Sanap Advanced What should we write next about
- CVE-2024-56013WordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerabilityWovax IDX
- CVE-2024-54331WordPress I Plant A Tree plugin <= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerabilityMicha I Plant A Tree
- CVE-2024-54352WordPress Sogrid plugin <= 1.5.2 - CSRF to Privilege Escalation vulnerabilitySabri Sogrid
- CVE-2024-54332WordPress WP Currency Exchange Rates plugin <= 1.2.0 - CSRF to Stored XSS vulnerabilityWPFactory WP Currency Exchange Rates
- CVE-2024-54353WordPress Hack-Info plugin <= 3.17 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilitywpgear Hack-Info
- CVE-2024-54386WordPress Push Monkey Pro plugin <= 3.9 - CSRF to Stored XSS vulnerabilitypushmonkey Push Monkey Pro – Web Push Notifications and Woo…
- CVE-2024-54388WordPress Multiple Admin Emails plugin <= 1.0 - CSRF to Stored XSS vulnerabilityPhuc Pham Multiple Admin Emails
- CVE-2024-54389WordPress addWeather plugin <= 2.5.1 - CSRF to Stored XSS vulnerabilityEduardo addWeather
- CVE-2024-54391WordPress WordPress Filter plugin <= 1.4.1 - CSRF to Stored XSS vulnerabilitymattwalters WordPress Filter
- CVE-2024-54392WordPress WP微信机器人 plugin <= 5.3.5 - CSRF to Stored XSS vulnerabilitymidoks WP微信机器人
- CVE-2024-54393WordPress WP Fiddle plugin <= 1.0 - CSRF to Stored XSS vulnerabilitySheikh Heera WP Fiddle
- CVE-2024-54394WordPress Mandrill WP plugin <= 1.0.5 - CSRF to Stored XSS vulnerabilitykhubbaib Mandrill WP
- CVE-2024-54397WordPress Go Animate plugin <= 1.0 - CSRF to Stored XSS vulnerabilityantonio.gocaj Go Animate
- CVE-2024-54398WordPress Flaming Forms plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityjcaruso001 Flaming Forms
- CVE-2024-54399WordPress CRUDLab Google Plus Button plugin <= 1.0.2 - CSRF to Stored XSS vulnerabilityCRUDLab Google Plus Button
- CVE-2024-54400WordPress AppMaps plugin <= 1.1 - CSRF to Stored XSS vulnerabilitymeloniq AppMaps
- CVE-2024-54401WordPress Advanced Fancybox plugin <= 1.1.1 - CSRF to Stored XSS vulnerabilityCiprian Turcu Advanced Fancybox
- CVE-2024-54404WordPress MDC Comment Toolbar plugin <= 1.1 - CSRF to Stored XSS vulnerabilityNazmul Ahsan MDC Comment Toolbar
- CVE-2024-54405WordPress ECT Social Share plugin <= 1.3 - CSRF to Stored XSS vulnerabilityetemplates ECT Social Share
- CVE-2024-54407WordPress CK and SyntaxHighlighter plugin <= 3.4.2 - CSRF to Stored XSS vulnerabilitya328496647 CK and SyntaxHighlighter
- CVE-2024-54409WordPress XPD Reduce Image Filesize plugin <= 1.0 - CSRF to Stored XSS vulnerabilityfzmaster XPD Reduce Image Filesize
- CVE-2024-54410WordPress SOPA Blackout plugin <= 1.4 - CSRF to Stored XSS vulnerabilityeagerterrier SOPA Blackout
- CVE-2024-54411WordPress WP Controller plugin <= 3.2.0 - CSRF to Stored Cross-Site Scripting vulnerabilityhosting.io WP Controller
- CVE-2024-54412WordPress ECT Product Carousel plugin <= 1.9 - CSRF to Stored Cross-Site Scripting vulnerabilityetemplates ECT Product Carousel
- CVE-2024-54413WordPress Display Future Posts plugin <= 0.2.3 - CSRF to Stored Cross-Site Scripting vulnerabilitybrandt-net Display Future Posts
- CVE-2024-54414WordPress Geoportail Shortcode plugin <= 2.4.4 - CSRF to Stored Cross-Site Scripting vulnerabilitygeoWP Geoportail Shortcode
- CVE-2024-54415WordPress WP-HideThat plugin <= 1.2 - CSRF to Stored Cross-Site Scripting vulnerabilitycconoly WP-HideThat
- CVE-2024-54416WordPress Wp Login with Ajax plugin <= 0.6 - CSRF to Stored Cross-Site Scripting vulnerabilityNavdeep Wp Login with Ajax
- CVE-2024-54420WordPress Metrika plugin <= 1.2 - CSRF to Stored XSS vulnerabilityAleksandr Novikov Metrika
- CVE-2024-54421WordPress Floating Video Player plugin <= 1.0 - CSRF to Stored XSS vulnerabilitySanjay_Negi Floating Video Player
- CVE-2024-54423WordPress Social Media Sharing plugin <= 1.1 - CSRF to Stored XSS vulnerabilityJesse Overright Social Media Sharing
- CVE-2024-54424WordPress Like in Vk.com plugin <= 0.5.2 - CSRF to Stored Cross-Site Scripting vulnerabilityilya_compman Like in Vk.com
- CVE-2024-54425WordPress LionScripts: Site Maintenance plugin <= 2.1 - CSRF to Stored Cross-Site Scripting vulnerabilityLionScripts.com LionScripts: Site Maintenance & Noindex Nof…
- CVE-2024-54426WordPress LeaderBoard Plugin plugin <= 1.2.4 - CSRF to Stored Cross-Site Scripting vulnerabilitycrossfitatgg LeaderBoard Plugin
- CVE-2024-54427WordPress Category of Posts plugin <= 1.0 - CSRF to Stored XSS vulnerabilityljmacphee Category of Posts
- CVE-2024-54428WordPress Add image to Post plugin <= 0.6 - CSRF to Stored XSS vulnerabilityonigetoc Add image to Post
- CVE-2024-54429WordPress Aphorismus plugin <= 1.2.0 - CSRF to Stored XSS vulnerabilityivan-ovsyannikov Aphorismus
- CVE-2024-54431WordPress Admin Customization plugin <= 2.2 - CSRF to Stored XSS vulnerabilityphpdevp Admin Customization
- CVE-2024-54432WordPress WP Flipkart Importer plugin <= 1.4 - CSRF to Stored XSS vulnerabilityShambhu Patnaik WP Flipkart Importer
- CVE-2024-54433WordPress Simple Booking – Widget plugin <= 1.1 - CSRF to Stored XSS vulnerabilityMarcel CL Simple Booking Widget
- CVE-2024-54434WordPress phZoom plugin <= 1.2.92 - CSRF to Stored XSS vulnerabilityBenJemin phZoom
- CVE-2024-54435WordPress Onlywire Multi Autosubmitter plugin <= 1.2.4 - CSRF to Stored XSS vulnerabilityThomas Hoefter Onlywire Multi Autosubmitter
- CVE-2024-54436WordPress Jet Footer Code plugin <= 1.4 - CSRF to Stored XSS vulnerabilitymilordk Jet Footer Code
- CVE-2024-54437WordPress jCarousel for WordPress plugin <= 1.0 - CSRF to Stored XSS vulnerabilitykoolkatwebdesigns jCarousel
- CVE-2024-54438WordPress Gaxx Keywords plugin <= 0.2 - CSRF to Stored XSS vulnerabilityGaxx Keywords
- CVE-2024-54439WordPress Amazon Product Price plugin <= 1.1 - CSRF to Stored XSS vulnerabilityAlok Tiwari Amazon Product Price
- CVE-2024-54440WordPress WP-Ban-User plugin <= 1.0 - CSRF to Stored XSS vulnerabilityblueskyy WP-Ban-User
- CVE-2024-55989WordPress WP Simple Pay Lite Manager Plugin <= 1.4 - SQL Injection vulnerabilityKyle M Brown WP Simple Pay Lite Manager
- CVE-2024-55990WordPress Mollie for Contact Form 7 plugin <= 5.0.0 - SQL Injection vulnerabilitytsjippy Mollie for Contact Form
- CVE-2024-54373WordPress EduAdmin Booking plugin <= 5.2.0 - Local File Inclusion vulnerabilityChris Gardenberg EduAdmin Booking
- CVE-2024-12646Chunghwa Telecom topm-client - Arbitrary File DeleteChunghwa Telecom topm-client
- CVE-2024-12644Chunghwa Telecom tbm-client - Arbitrary File Copy and PasteChunghwa Telecom tbm-client
- CVE-2024-12643Chunghwa Telecom tbm-client - Arbitrary File DeleteChunghwa Telecom tbm-client
- CVE-2024-12642Chunghwa Telecom TenderDocTransfer - Arbitrary File WriteChunghwa Telecom TenderDocTransfer
- CVE-2024-37774A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an
- CVE-2024-37775Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC
- CVE-2024-52949iptraf-ng 1.2.1 has a stack-based buffer overflow.
- CVE-2024-53376CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field t
- CVE-2024-55103Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname
- CVE-2024-55104Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via t
- CVE-2024-56083Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.de
- CVE-2024-56084An issue was discovered in Logpoint UniversalNormalizer before 5.7.0.
- CVE-2024-56086An issue was discovered in Logpoint before 7.5.0.
Medium, low and unrated 77
- CVE-2024-11906TPG Get Posts <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingcswaim TPG Get Posts
- CVE-2024-11905Animated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingfreeben Animated Counters
- CVE-2024-11902Slope Widgets <= 4.2.12 - Authenticated (Contributor+) Stored Cross-Site Scriptingslopeit Slope Widgets
- CVE-2024-11900Portfolio – Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinglogichunt Portfolio – Filterable Masonry Portfolio Gallery…
- CVE-2024-12443CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingcrmperks CRM Perks – WordPress HelpDesk Integration – Zende…
- CVE-2024-35230Welcome and About GeoServer pages communicate version and revision informationgeoserver · org.geoserver.web:gs-web-app +1
- CVE-2024-55951Metabase sandboxed users could see filter values from other sandboxed usersmetabase
- CVE-2024-12667InvoicePlane view session expirationInvoicePlane
- CVE-2024-12666ClassCMS User Management Page admin insufficient privilegesClassCMS
- CVE-2024-12665ruifang-tech Rebuild Task Comment Attachment Upload cross site scriptingruifang-tech Rebuild
- CVE-2024-12664ruifang-tech Rebuild Project Task Comment cross site scriptingruifang-tech Rebuild
- CVE-2024-12663funnyzpc Mee-Admin Login login observable response discrepancyfunnyzpc Mee-Admin
- CVE-2024-12662IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E040 null pointer dereferenceIObit Advanced SystemCare Utimate
- CVE-2024-12661IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E024 null pointer dereferenceIObit Advanced SystemCare Utimate
- CVE-2024-12660IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E018 null pointer dereferenceIObit Advanced SystemCare Utimate
- CVE-2024-12659IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E004 null pointer dereferenceIObit Advanced SystemCare Utimate
- CVE-2024-12658IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E01C null pointer dereferenceIObit Advanced SystemCare Utimate
- CVE-2024-12657IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E000 null pointer dereferenceIObit Advanced SystemCare Utimate
- CVE-2024-12656FabulaTech USB over Network IOCT ftusbbus2.sys 0x220448 null pointer dereferenceFabulaTech USB over Network
- CVE-2024-12655FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereferenceFabulaTech USB over Network
- CVE-2024-11358Insecure Android File Provider PathsMattermost
- CVE-2024-12654FabulaTech USB over Network IOCT ftusbbus2.sys 0x220408 null pointer dereferenceFabulaTech USB over Network
- CVE-2024-54357WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerabilityThemeFusion Avada
- CVE-2024-56003WordPress Caldera SMTP Mailer plugin <= 1.0.1 - Broken Access Control vulnerabilityDavid Cramer Caldera SMTP Mailer
- CVE-2024-55999WordPress XML Multilanguage Sitemap Generator plugin <= 2.0.6 - Broken Access Control vulnerabilityMarco Giannini XML Multilanguage Sitemap Generator
- CVE-2024-54348WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityyaycommerce Brand
- CVE-2024-12653FabulaTech USB over Network IOCT ftusbbus2.sys 0x22040C null pointer dereferenceFabulaTech USB over Network
- CVE-2024-37251WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerabilityWPENGINE Advanced Custom Fields PRO
- CVE-2024-54354WordPress Termin-Kalender plugin <= 0.99.47 - Broken Access Control vulnerabilitybeat.k Termin-Kalender
- CVE-2024-54382WordPress Bold Page Builder plugin <= 5.1.5 - Path Traversal vulnerabilityboldthemes Bold Page Builder
- CVE-2024-55996WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerabilityDreamfox Media Payment gateway per Product for Woocommerce
- CVE-2024-54384WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.8.3 - Broken Access Control vulnerabilityAnh Tran Falcon – WordPress Optimizations & Tweaks
- CVE-2024-54417WordPress PixProof plugin <= 2.0.1 - Broken Access Control vulnerabilitypixelgrade PixProof
- CVE-2024-55992WordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerabilityOpen Tools WooCommerce Basic Ordernumbers
- CVE-2024-55993WordPress Job Board Manager plugin <= 2.1.61 - Broken Access Control vulnerabilityPickPlugins Job Board Manager
- CVE-2024-55994WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerabilitysohu 畅言评论系统
- CVE-2024-56001WordPress Ksher plugin <= 1.1.1 - Broken Access Control vulnerabilityksher thailand Ksher
- CVE-2024-56007WordPress Leader plugin <= 2.6.1 - Broken Access Control vulnerabilityleader codes Leader
- CVE-2024-56009WordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerabilitySpreadr Woocommerce
- CVE-2024-54360WordPress Gutensee plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilitypremila Gutensee
- CVE-2024-54441WordPress Utech World Time Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityMeini Utech World Time
- CVE-2024-54442WordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerabilitycortesfrau Better WP Login Page
- CVE-2024-54443WordPress Advanced Data Table For Elementor plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityPluginsCafe Advanced Data Table For Elementor
- CVE-2024-56011WordPress Responsive Google Maps | by imbaa plugin <= 1.2.5 - Stored Cross Site Scripting (XSS) vulnerabilityIlja Zaglov Responsive Google Maps | by imbaa
- CVE-2024-54355WordPress WP Mailster plugin <= 1.8.17.0 - Cross Site Request Forgery (CSRF) vulnerabilitybrandtoss WP Mailster
- CVE-2024-54356WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2024-54396WordPress Bet sport Free plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityelmervillanueva Bet sport Free
- CVE-2024-54418WordPress DTC Documents plugin <= 1.1.05 - Cross Site Request Forgery (CSRF) vulnerabilityDiversified Technology DTC Documents
- CVE-2024-54419WordPress Ui Slider Filter By Price plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerabilitychenyenming Ui Slider Filter By Price
- CVE-2024-56005WordPress Posti Shipping Plugin <= 3.10.3 - CSRF to Settings Change vulnerabilityPosti Shipping
- CVE-2024-54402WordPress Arabic Webfonts plugin <= 1.4.6 - Broken Access Control vulnerabilityMohamed Abd Elhalim Arabic Webfonts
- CVE-2024-54408WordPress Youtube Video Grid plugin <= 1.9 - CSRF to Settings Change vulnerabilitycodehandling Youtube Video Grid
- CVE-2024-54430WordPress EELV Newsletter plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerabilityEurope Ecologie Les Verts EELV Newsletter
- CVE-2024-55998WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin <= 1.36 - Settings Change vulnerabilityEric Sloan Popup Surveys & Polls for WordPress
- CVE-2024-56004WordPress Easy Site Importer plugin <= 1.0.1 - Settings Change vulnerabilityawfowler Easy Site Importer
- CVE-2024-54366WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerabilityvideogallery Vimeography
- CVE-2024-12478InvoicePlane 1 upload_file unrestricted uploadInvoicePlane
- CVE-2024-12362InvoicePlane invoices.php download path traversalInvoicePlane
- CVE-2024-54682Zipbomb DoS via Missing Slack Import ValidationMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-54083DoS via lack of type validation in CallsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-48872Bypass of "Max failed attempts" restriction via race conditionMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-9679A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user creTrellix DLP Extension
- CVE-2024-12645Chunghwa Telecom topm-client - Arbitrary File ReadChunghwa Telecom topm-client
- CVE-2024-9678An SQL Injection vulnerability existed in DLP Extension 11.11.1.3.Trellix DLP Extension
- CVE-2024-5333The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event DisclosureThe Events Calendar
- CVE-2024-11841Tithe.ly Giving Button <= 1.1 - Contributor+ Stored XSS via ShortcodeTithe.ly Giving Button
- CVE-2024-8116Incorrect Authorization in GitLabGitLab
- CVE-2024-8650Incorrect Authorization in GitLabGitLab
- CVE-2024-37773An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code
- CVE-2024-37776A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a cr
- CVE-2024-55100A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to
- CVE-2024-55451A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3.
- CVE-2024-55452A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel
- CVE-2024-55554Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.
- CVE-2024-56085An issue was discovered in Logpoint before 7.5.0.
- CVE-2024-56087An issue was discovered in Logpoint before 7.5.0.
- CVE-2024-56112CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.