# CVEs published 2024-12-17

84 CVEs were published on December 17, 2024: 11 critical, 29 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-10973](https://cve.now/CVE-2024-10973.md): Keycloak: cli option for encrypted jgroups ignored (CVSS 5.7, keycloak · Red Hat Build of Keycloak +2)
- [CVE-2024-9779](https://cve.now/CVE-2024-9779.md): Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens (CVSS 7.5, open-cluster-management-io · Red Hat Advanced Cluster Ma… +1)
- [CVE-2024-52792](https://cve.now/CVE-2024-52792.md): Arbitrary config values override in lam (CVSS 6.5, LDAPAccountManager lam)
- [CVE-2024-56142](https://cve.now/CVE-2024-56142.md): Path Traversal in pghoard (CVSS 4.8, Aiven-Open pghoard · pghoard)
- [CVE-2023-37940](https://cve.now/CVE-2023-37940.md): Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7. (CVSS 4.8, Liferay Portal · Liferay DXP +2)
- [CVE-2024-12539](https://cve.now/CVE-2024-12539.md): Elasticsearch Incorrect Authorization (CVSS 6.0, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-11993](https://cve.now/CVE-2024-11993.md): Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows (CVSS 4.6, Liferay Portal · Liferay DXP +2)
- [CVE-2024-56139](https://cve.now/CVE-2024-56139.md): A stack overflow Segmentation Fault (SEGV) and Memory Leak in pdftools (CVSS 6.9, leonhad pdftools)
- [CVE-2024-51479](https://cve.now/CVE-2024-51479.md): Authorization bypass in Next.js (CVSS 7.5, vercel next.js · next)
- [CVE-2024-49816](https://cve.now/CVE-2024-49816.md): IBM Security Guardium Key Lifecycle Manager information disclosure (CVSS 4.9, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2024-49820](https://cve.now/CVE-2024-49820.md): IBM Security Guardium Key Lifecycle Manager information disclosure (CVSS 3.7, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2024-49819](https://cve.now/CVE-2024-49819.md): IBM Security Guardium Key Lifecycle Manager information disclosure (CVSS 4.1, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2024-49818](https://cve.now/CVE-2024-49818.md): IBM Security Guardium Key Lifecycle Manager information disclosure (CVSS 4.3, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2024-49817](https://cve.now/CVE-2024-49817.md): IBM Security Guardium Key Lifecycle Manager information disclosure (CVSS 4.4, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2024-42194](https://cve.now/CVE-2024-42194.md): HCL BigFix Inventory is affected by an access control vulnerability (CVSS 3.1, HCL Software BigFix Inventory)
- [CVE-2024-53144](https://cve.now/CVE-2024-53144.md): Bluetooth: hci\_event: Align BR/EDR JUST\_WORKS paring with LE (CVSS 8.8, Linux)
- [CVE-2024-12671](https://cve.now/CVE-2024-12671.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12670](https://cve.now/CVE-2024-12670.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12669](https://cve.now/CVE-2024-12669.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12200](https://cve.now/CVE-2024-12200.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12199](https://cve.now/CVE-2024-12199.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12198](https://cve.now/CVE-2024-12198.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12197](https://cve.now/CVE-2024-12197.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12194](https://cve.now/CVE-2024-12194.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12179](https://cve.now/CVE-2024-12179.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12193](https://cve.now/CVE-2024-12193.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12192](https://cve.now/CVE-2024-12192.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-12191](https://cve.now/CVE-2024-12191.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-10476](https://cve.now/CVE-2024-10476.md): Default credentials are used in the above listed BD Diagnostic Solutions products. (CVSS 8.0, Becton Dickinson & BD BACTEC™ Blood Culture System · Bec… +4)
- [CVE-2024-12178](https://cve.now/CVE-2024-12178.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-11422](https://cve.now/CVE-2024-11422.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-8972](https://cve.now/CVE-2024-8972.md): SQLi in Mobil365 Informatics' Saha365 App (CVSS 9.8, Mobil365 Informatics Saha365 App)
- [CVE-2024-9819](https://cve.now/CVE-2024-9819.md): IDOR in NextGEO's NG Analyser (CVSS 6.5, NextGeography NG Analyser)
- [CVE-2024-10356](https://cve.now/CVE-2024-10356.md): ElementsReady Addons for Elementor \<= 6.4.8 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2024-54677](https://cve.now/CVE-2024-54677.md): Apache Tomcat: DoS in examples web application (CVSS 5.3, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2024-50379](https://cve.now/CVE-2024-50379.md): Apache Tomcat: RCE due to TOCTOU issue in JSP compilation (CVSS 9.8, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2024-8475](https://cve.now/CVE-2024-8475.md): Protection Mechanism Failure in Digital Operation Services' WiFiBurada (CVSS 6.5, Digital Operation Services WiFiBurada)
- [CVE-2024-8429](https://cve.now/CVE-2024-8429.md): Improper Authentication in Digital Operation Services' WiFiBurada (CVSS 4.3, Digital Operation Services WiFiBurada)
- [CVE-2024-52542](https://cve.now/CVE-2024-52542.md): Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. (CVSS 4.4, Dell AppSync)
- [CVE-2024-11280](https://cve.now/CVE-2024-11280.md): PPWP – Password Protect Pages \<= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, buildwps PPWP – Password Protect Pages)
- [CVE-2024-9654](https://cve.now/CVE-2024-9654.md): Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass (CVSS 3.7, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2024-12395](https://cve.now/CVE-2024-12395.md): WooCommerce Additional Fees On Checkout (Free) \<= 1.4.7 - Reflected Cross-Site Scripting via 'number' (CVSS 6.1, amitwpdeveloper Additional Fees For WooCommerce Checkout)
- [CVE-2024-12601](https://cve.now/CVE-2024-12601.md): Calculated Fields Form \<= 5.2.63 - Denial of Service (CVSS 5.3, codepeople Calculated Fields Form)
- [CVE-2024-12469](https://cve.now/CVE-2024-12469.md): WP BASE Booking of Appointments, Services and Events \<= 4.9.1 - Reflected Cross-Site Scripting via status Parameter (CVSS 6.1, puckrobin WP BASE Booking of Appointments, Services and Eve…)
- [CVE-2024-12127](https://cve.now/CVE-2024-12127.md): Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS \<= 0.0.21 - Reflected Cross-Site Scripting via page Parameter (CVSS 6.1, mantrabrain Learning Management System, eLearning, Course B…)
- [CVE-2024-12024](https://cve.now/CVE-2024-12024.md): EventPrime – Events Calendar, Bookings and Tickets \<= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name (CVSS 7.2, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-8326](https://cve.now/CVE-2024-8326.md): s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions \<= 241114 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 8.8, clavaque s2Member – Excellent for All Kinds of Memberships,…)
- [CVE-2024-12293](https://cve.now/CVE-2024-12293.md): User Role Editor \<= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation (CVSS 8.8, shinephp User Role Editor)
- [CVE-2024-11294](https://cve.now/CVE-2024-11294.md): Memberful \<= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, Memberful – Membership Plugin)
- [CVE-2024-12220](https://cve.now/CVE-2024-12220.md): SMS for WooCommerce \<= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, theafricanboss SMS for WooCommerce)
- [CVE-2024-12219](https://cve.now/CVE-2024-12219.md): Stop Registration Spam \<= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 6.1, tomroyal Stop Registration Spam)
- [CVE-2021-26281](https://cve.now/CVE-2021-26281.md): Information disclosure vulnerability in Alarm clock module (CVSS 5.5, vivo Alarm clock)
- [CVE-2021-26280](https://cve.now/CVE-2021-26280.md): Permission bypass vulnerability in permission manager module (CVSS 7.9, vivo Permission manager module)
- [CVE-2024-11999](https://cve.now/CVE-2024-11999.md): CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authentica (CVSS 8.7, Schneider Electric Harmony (Formerly Magelis) HMIST6, HMIST…)
- [CVE-2024-38499](https://cve.now/CVE-2024-38499.md): Improper Privilege Management Vulnerability in CA Client Automation 14.5 (CVSS 7.3, Broadcom CA Client Automation)
- [CVE-2024-54125](https://cve.now/CVE-2024-54125.md): Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker t (CVSS 3.3, SHUEISHA "Shonen Jump+" App for Android)
- [CVE-2024-9624](https://cve.now/CVE-2024-9624.md): WP All Import Pro \<= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import (CVSS 7.6, Soflyy WP All Import Pro)
- [CVE-2024-55864](https://cve.now/CVE-2024-55864.md): Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. (CVSS 4.8, gqevu6bsiz My WP Customize Admin/Frontend)
- [CVE-2024-12356](https://cve.now/CVE-2024-12356.md): Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA) (CVSS 9.8, KEV, BeyondTrust Remote Support · BeyondTrust Privileged Remote…)
- [CVE-2021-26279](https://cve.now/CVE-2021-26279.md): Information disclosure vulnerability in Weather module (CVSS 5.9, vivo Weather)
- [CVE-2021-26278](https://cve.now/CVE-2021-26278.md): Sensitive information leakage vulnerability in wifi module (CVSS 6.3, vivo Wifi)
- [CVE-2020-12487](https://cve.now/CVE-2020-12487.md): Command Execution Vulnerability in ABE service (CVSS 7.0, vivo ABE)
- [CVE-2020-12484](https://cve.now/CVE-2020-12484.md): When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterpris (CVSS 6.4, vivo Wifi)
- [CVE-2024-12239](https://cve.now/CVE-2024-12239.md): PowerPack Lite for Beaver Builder \<= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter (CVSS 6.1, ideaboxcreations PowerPack Lite for Beaver Builder)
- [CVE-2024-10205](https://cve.now/CVE-2024-10205.md): Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer (CVSS 9.4, Hitachi Ops Center Analyzer · Hitachi Infrastructure Analyt…)
- [CVE-2024-29646](https://cve.now/CVE-2024-29646.md): Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields. (CVSS 9.8)
- [CVE-2024-31668](https://cve.now/CVE-2024-31668.md): rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta\_set function in librz/analysis/meta. (CVSS 9.1)
- [CVE-2024-36831](https://cve.now/CVE-2024-36831.md): A NULL pointer dereference in the plugins\_call\_handle\_uri\_clean function of D-Link DAP-1520 REVA\_FIRMWARE\_1.10B04\_BETA02\_HOTFIX allows attac (CVSS 5.3)
- [CVE-2024-36832](https://cve.now/CVE-2024-36832.md): A NULL pointer dereference in D-Link DAP-1513 REVA\_FIRMWARE\_1.01 allows attackers to cause a Denial of Service (DoS) via a crafted web reque (CVSS 7.5)
- [CVE-2024-37605](https://cve.now/CVE-2024-37605.md): A NULL pointer dereference in D-Link DIR-860L REVB\_FIRMWARE\_2.04.B04\_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted (CVSS 6.5)
- [CVE-2024-37606](https://cve.now/CVE-2024-37606.md): A Stack overflow vulnerability in D-Link DCS-932L REVB\_FIRMWARE\_2.18.01 allows attackers to cause a Denial of Service (DoS) via a crafted HT (CVSS 6.5)
- [CVE-2024-37607](https://cve.now/CVE-2024-37607.md): A Buffer overflow vulnerability in D-Link DAP-2555 REVA\_FIRMWARE\_1.20 allows remote attackers to cause a Denial of Service (DoS) via a craft (CVSS 6.5)
- [CVE-2024-49194](https://cve.now/CVE-2024-49194.md): Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL p (CVSS 7.3, com.databricks:databricks-jdbc)
- [CVE-2024-51175](https://cve.now/CVE-2024-51175.md): An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component. (CVSS 7.5)
- [CVE-2024-54662](https://cve.now/CVE-2024-54662.md): Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod. (CVSS 9.1)
- [CVE-2024-55056](https://cve.now/CVE-2024-55056.md): A stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form (CVSS 5.4)
- [CVE-2024-55057](https://cve.now/CVE-2024-55057.md): Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user (CVSS 5.4)
- [CVE-2024-55058](https://cve.now/CVE-2024-55058.md): An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. (CVSS 4.3)
- [CVE-2024-55059](https://cve.now/CVE-2024-55059.md): A stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php. (CVSS 6.1)
- [CVE-2024-55496](https://cve.now/CVE-2024-55496.md): A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0. (CVSS 9.1)
- [CVE-2024-55513](https://cve.now/CVE-2024-55513.md): A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. (CVSS 9.1)
- [CVE-2024-55514](https://cve.now/CVE-2024-55514.md): A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. (CVSS 6.3)
- [CVE-2024-55515](https://cve.now/CVE-2024-55515.md): A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. (CVSS 9.8)
- [CVE-2024-55516](https://cve.now/CVE-2024-55516.md): A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.