CVEs published December 19, 2024
93 CVEs were published on December 19, 2024: 10 critical, 32 high.
- Published
- 93
- Critical
- 10
- High
- 32
- Medium
- 47
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- discourse
- 4
- Rockwell Automation Arena®
- 4
- Codezips E-Commerce Site
- 3
- itsourcecode Vehicle Management System
- 3
- silabs.com RS9116 Bluetooth SDK
- 3
- Sophos Firewall
- 3
- Xen
- 3
- codename065 Download Manager
- 2
- Edgecross Consortium Edgecross Basic Software for Windows ·…
- 2
- Fortinet FortiOS
- 2
Critical 10
- CVE-2024-12728A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3)Sophos Firewall
- CVE-2024-12727A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows accesSophos Firewall
- CVE-2024-10244SQLi in ISDO Software's Web SoftwareISDO Software Web Software
- CVE-2021-26102A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated Fortinet FortiWAN
- CVE-2024-12626AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_valuerubengc AutomatorWP – Automator plugin for no-code automati…
- CVE-2023-4617Gaining remote control over Govee devicesGovee Home
- CVE-2024-11984SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous TypeSUNNET Technology Co. Corporate Training Management System
- CVE-2024-54983An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message.
- CVE-2024-54984An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message.
- CVE-2024-55081An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitra
High 32
- CVE-2024-12700Tibbo AggreGate Network Manager Unrestricted Upload of File with Dangerous TypeTibbo AggreGate Network Manager
- CVE-2024-56327Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyragewoodruffw pyrage · pyrage
- CVE-2024-11364Rockwell Automation Third Party Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2024-12729A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older thaSophos Firewall
- CVE-2024-12672Rockwell Automation Third Party Vulnerability in Arena®Rockwell Automation Arena®
- CVE-2024-12175Rockwell Automation Code Execution Vulnerability in ArenaRockwell Automation Arena®
- CVE-2024-11157Rockwell Automation Third Party Vulnerability in ArenaRockwell Automation Arena®
- CVE-2024-12111Potential LDAP injection vulnerability in OpenText Privileged Access ManagerOpenText Privileged Access Manager
- CVE-2024-53991Potential Backup file leaked via Nginx in Discoursediscourse
- CVE-2024-56159Server source code is exposed to the public if sourcemaps are enabledwithastro astro · astro
- CVE-2024-56200Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxynexryai altair
- CVE-2024-54150Algorithm Confusion Vulnerability in cjwtxmidt-org cjwt
- CVE-2023-7005CVE-2023-7005Sciener TTLock App
- CVE-2024-38819Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksSpring Framework · org.springframework:spring-webflux +1
- CVE-2024-9154Authenticated Remote Code ExecutionHMS Networks Ewon Flexy
- CVE-2024-12786X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges managementX1a0He Adobe Downloader
- CVE-2024-25131Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalationmust-gather-operator · github.com/openshift/must-gather
- CVE-2024-47093Fix various XSS issues and potential RCENagvis
- CVE-2021-32589A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 andFortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2021-26115An OS command injection (CWE-78) vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated aFortinet FortiWAN
- CVE-2020-15934An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0.Fortinet FortiClientLinux
- CVE-2024-4230External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic SoftEdgecross Consortium Edgecross Basic Software for Windows ·…
- CVE-2024-4229Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software forEdgecross Consortium Edgecross Basic Software for Windows ·…
- CVE-2024-11740Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Executioncodename065 Download Manager
- CVE-2024-51532Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability.Dell PowerStore
- CVE-2022-27595QVPN Device ClientQNAP Systems QVPN Windows
- CVE-2023-23354QuLog CenterQNAP Systems QuLog Center
- CVE-2024-35141IBM Security Verify Access privilege escalationIBM Security Verify Access Docker
- CVE-2024-54663An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.
- CVE-2024-54790A SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to exec
- CVE-2024-55082A Server-Side Request Forgery (SSRF) in the endpoint http://{your-server}/url-to-pdf of Stirling-PDF 0.35.1 allows attackers to access sensi
- CVE-2024-55196Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords fogithub.com/gophish/gophish
Medium, low and unrated 51
- CVE-2024-54009Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited Hewlett Packard Enterprise (HPE) HPE Alletra Storage MP B10…
- CVE-2024-2201CVE-2024-2201Xen
- CVE-2024-7139Denial of Service in Silicon Labs RS9116 Bluetooth SDKsilabs.com RS9116 Bluetooth SDK
- CVE-2024-7138Denial of Service in Silicon Labs RS9116 Bluetooth SDKsilabs.com RS9116 Bluetooth SDK
- CVE-2024-7137Denial of Service in Silicon Labs RS9116 Bluetooth SDKsilabs.com RS9116 Bluetooth SDK
- CVE-2024-49765Bypass of Discourse Connect using other login paths if enabled in Discoursediscourse
- CVE-2024-52589Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discoursediscourse
- CVE-2024-52794Magnific lightbox susceptible to Cross-site Scripting in Discoursediscourse
- CVE-2020-6923HP Linux Imaging and Printing Software - Potential Memory Buffer OverflowHP Linux Imaging and Printing Software
- CVE-2024-12794Codezips E-Commerce Site editorder.php sql injectionCodezips E-Commerce Site
- CVE-2024-12793PbootCMS IndexController.php path traversalPbootCMS
- CVE-2024-12792Codezips E-Commerce Site newadmin.php sql injectionCodezips E-Commerce Site
- CVE-2024-12791Codezips E-Commerce Site signin.php sql injectionCodezips E-Commerce Site
- CVE-2024-49336IBM Security Guardium server-side request forgeryIBM Security Guardium
- CVE-2024-52897IBM MQ information disclosureIBM MQ
- CVE-2024-51471IBM MQ Appliance denial of serviceIBM MQ Appliance
- CVE-2024-52896IBM MQ information disclosureIBM MQ
- CVE-2024-12790code-projects Hostel Management Site room-details.php cross site scriptingcode-projects Hostel Management Site
- CVE-2021-22501Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation.OpenText™ Operations Bridge Manager
- CVE-2024-12789PbootCMS IndexController.php code injectionPbootCMS
- CVE-2024-12788Codezips Technical Discussion Forum signinpost.php sql injectionCodezips Technical Discussion Forum
- CVE-2024-12801SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacksQOS.CH Sarl logback · ch.qos.logback:logback-core
- CVE-2024-38864User-Readable Private Key in Windows AgentCheckmk
- CVE-2024-127871000 Projects Attendance Tracking Management System check_student_login.php sql injection1000 Projects Attendance Tracking Management System
- CVE-2024-12798JaninoEventEvaluator vulnerabilityQOS.CH Sarl Logback-core · ch.qos.logback:logback-core
- CVE-2024-12785itsourcecode Vehicle Management System sendmail.php sql injectionitsourcecode Vehicle Management System
- CVE-2024-12784itsourcecode Vehicle Management System editbill.php sql injectionitsourcecode Vehicle Management System
- CVE-2024-9102phpLDAPadmin: Improper Neutralization of Formula ElementsphpLDAPadmin
- CVE-2024-9101phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.phpphpLDAPadmin
- CVE-2024-12783itsourcecode Vehicle Management System billaction.php cross site scriptingitsourcecode Vehicle Management System
- CVE-2024-12782Fujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorizationFujifilm Business Innovation Apeos C3070 · Fujifilm Busi… +1
- CVE-2024-45819libxl leaks data to PVH guests via ACPI tablesXen
- CVE-2024-45818Deadlock in x86 HVM standard VGA handlingXen
- CVE-2024-37962WordPress Fusion Page Builder plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityAgency Dominion Fusion
- CVE-2024-12331File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installationninjateam File Manager Pro – Filester
- CVE-2020-12820Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remFortinet FortiOS
- CVE-2024-11616Double-fetch heap overflowNetskope Endpoint DLP
- CVE-2024-12569Sensitive Information in Driver’s Log FileMilestone Systems XProtect VMS
- CVE-2021-26093An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticatedFortinet FortiWLC
- CVE-2020-12819A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 aFortinet FortiOS
- CVE-2024-12560Button Block – Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplicationbplugins Button Block – Design Stylish, Interactive, and Mu…
- CVE-2024-11768Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Filescodename065 Download Manager
- CVE-2024-12121Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgerycyberlord92 Broken Link Checker | Finder
- CVE-2024-10548WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST APIwedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2022-27600QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-23356QuFirewallQNAP Systems QuFirewall
- CVE-2023-23357QuLog CenterQNAP Systems QuLog Center
- CVE-2023-30443IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2022-33954IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2021-39081IBM Cognos Analytics Mobile information disclosureIBM Cognos Analytics Mobile for Android
- CVE-2024-54982An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message.