CVEs published December 17, 2024
84 CVEs were published on December 17, 2024: 11 critical, 29 high. 1 is now in CISA KEV.
- Published
- 84
- Critical
- 11
- High
- 29
- Medium
- 40
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 31
Most affected products
- Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- 14
- IBM Security Guardium Key Lifecycle Manager
- 5
- Digital Operation Services WiFiBurada
- 2
- Liferay Portal · Liferay DXP +2
- 2
- vivo Wifi
- 2
- Aiven-Open pghoard · pghoard
- 1
- amitwpdeveloper Additional Fees For WooCommerce Checkout
- 1
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 1
- Apache Software Foundation Apache Tomcat · org.apache.tomca…
- 1
- Becton Dickinson & BD BACTEC™ Blood Culture System · Bec… +4
- 1
Critical 11
- CVE-2024-8972SQLi in Mobil365 Informatics' Saha365 AppMobil365 Informatics Saha365 App
- CVE-2024-50379Apache Tomcat: RCE due to TOCTOU issue in JSP compilationApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2024-12356Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)BeyondTrust Remote Support · BeyondTrust Privileged Remote…
- CVE-2024-10205Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center AnalyzerHitachi Ops Center Analyzer · Hitachi Infrastructure Analyt…
- CVE-2024-29646Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.
- CVE-2024-31668rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta.
- CVE-2024-54662Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.
- CVE-2024-55496A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0.
- CVE-2024-55513A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90.
- CVE-2024-55515A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90.
- CVE-2024-55516A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90.
High 29
- CVE-2024-9779Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokensopen-cluster-management-io · Red Hat Advanced Cluster Ma… +1
- CVE-2024-51479Authorization bypass in Next.jsvercel next.js · next
- CVE-2024-53144Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LELinux
- CVE-2024-12671DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12670DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12669DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12200DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12199DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12198DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12197DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12194DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12179DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12193DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12192DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12191DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-10476Default credentials are used in the above listed BD Diagnostic Solutions products.Becton Dickinson & BD BACTEC™ Blood Culture System · Bec… +4
- CVE-2024-12178DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-11422DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-12024EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Namemetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-8326s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposureclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2024-12293User Role Editor <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalationshinephp User Role Editor
- CVE-2021-26280Permission bypass vulnerability in permission manager modulevivo Permission manager module
- CVE-2024-11999CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticaSchneider Electric Harmony (Formerly Magelis) HMIST6, HMIST…
- CVE-2024-38499Improper Privilege Management Vulnerability in CA Client Automation 14.5Broadcom CA Client Automation
- CVE-2024-9624WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File ImportSoflyy WP All Import Pro
- CVE-2020-12487Command Execution Vulnerability in ABE servicevivo ABE
- CVE-2024-36832A NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_1.01 allows attackers to cause a Denial of Service (DoS) via a crafted web reque
- CVE-2024-49194Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL pcom.databricks:databricks-jdbc
- CVE-2024-51175An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component.
Medium, low and unrated 44
- CVE-2024-10973Keycloak: cli option for encrypted jgroups ignoredkeycloak · Red Hat Build of Keycloak +2
- CVE-2024-52792Arbitrary config values override in lamLDAPAccountManager lam
- CVE-2024-56142Path Traversal in pghoardAiven-Open pghoard · pghoard
- CVE-2023-37940Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.Liferay Portal · Liferay DXP +2
- CVE-2024-12539Elasticsearch Incorrect AuthorizationElasticsearch · org.elasticsearch:elasticsearch
- CVE-2024-11993Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allowsLiferay Portal · Liferay DXP +2
- CVE-2024-56139A stack overflow Segmentation Fault (SEGV) and Memory Leak in pdftoolsleonhad pdftools
- CVE-2024-49816IBM Security Guardium Key Lifecycle Manager information disclosureIBM Security Guardium Key Lifecycle Manager
- CVE-2024-49820IBM Security Guardium Key Lifecycle Manager information disclosureIBM Security Guardium Key Lifecycle Manager
- CVE-2024-49819IBM Security Guardium Key Lifecycle Manager information disclosureIBM Security Guardium Key Lifecycle Manager
- CVE-2024-49818IBM Security Guardium Key Lifecycle Manager information disclosureIBM Security Guardium Key Lifecycle Manager
- CVE-2024-49817IBM Security Guardium Key Lifecycle Manager information disclosureIBM Security Guardium Key Lifecycle Manager
- CVE-2024-42194HCL BigFix Inventory is affected by an access control vulnerabilityHCL Software BigFix Inventory
- CVE-2024-9819IDOR in NextGEO's NG AnalyserNextGeography NG Analyser
- CVE-2024-10356ElementsReady Addons for Elementor <= 6.4.8 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesquomodosoft ElementsReady Addons for Elementor
- CVE-2024-54677Apache Tomcat: DoS in examples web applicationApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2024-8475Protection Mechanism Failure in Digital Operation Services' WiFiBuradaDigital Operation Services WiFiBurada
- CVE-2024-8429Improper Authentication in Digital Operation Services' WiFiBuradaDigital Operation Services WiFiBurada
- CVE-2024-52542Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability.Dell AppSync
- CVE-2024-11280PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurebuildwps PPWP – Password Protect Pages
- CVE-2024-9654Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypasssmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2024-12395WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number'amitwpdeveloper Additional Fees For WooCommerce Checkout
- CVE-2024-12601Calculated Fields Form <= 5.2.63 - Denial of Servicecodepeople Calculated Fields Form
- CVE-2024-12469WP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status Parameterpuckrobin WP BASE Booking of Appointments, Services and Eve…
- CVE-2024-12127Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parametermantrabrain Learning Management System, eLearning, Course B…
- CVE-2024-11294Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information ExposureMemberful – Membership Plugin
- CVE-2024-12220SMS for WooCommerce <= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingtheafricanboss SMS for WooCommerce
- CVE-2024-12219Stop Registration Spam <= 1.23 - Cross-Site Request Forgery to Cross-Site Scriptingtomroyal Stop Registration Spam
- CVE-2021-26281Information disclosure vulnerability in Alarm clock modulevivo Alarm clock
- CVE-2024-54125Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker tSHUEISHA "Shonen Jump+" App for Android
- CVE-2024-55864Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1.gqevu6bsiz My WP Customize Admin/Frontend
- CVE-2021-26279Information disclosure vulnerability in Weather modulevivo Weather
- CVE-2021-26278Sensitive information leakage vulnerability in wifi modulevivo Wifi
- CVE-2020-12484When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprisvivo Wifi
- CVE-2024-12239PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameterideaboxcreations PowerPack Lite for Beaver Builder
- CVE-2024-36831A NULL pointer dereference in the plugins_call_handle_uri_clean function of D-Link DAP-1520 REVA_FIRMWARE_1.10B04_BETA02_HOTFIX allows attac
- CVE-2024-37605A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2024-37606A Stack overflow vulnerability in D-Link DCS-932L REVB_FIRMWARE_2.18.01 allows attackers to cause a Denial of Service (DoS) via a crafted HT
- CVE-2024-37607A Buffer overflow vulnerability in D-Link DAP-2555 REVA_FIRMWARE_1.20 allows remote attackers to cause a Denial of Service (DoS) via a craft
- CVE-2024-55056A stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form
- CVE-2024-55057Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user
- CVE-2024-55058An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0.
- CVE-2024-55059A stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php.
- CVE-2024-55514A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90.