# CVEs published 2024-12-19

93 CVEs were published on December 19, 2024: 10 critical, 32 high. Days are UTC.

- [CVE-2024-12700](https://cve.now/CVE-2024-12700.md): Tibbo AggreGate Network Manager Unrestricted Upload of File with Dangerous Type (CVSS 8.7, Tibbo AggreGate Network Manager)
- [CVE-2024-56327](https://cve.now/CVE-2024-56327.md): Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage (CVSS 7.7, woodruffw pyrage · pyrage)
- [CVE-2024-54009](https://cve.now/CVE-2024-54009.md): Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited (CVSS 4.0, Hewlett Packard Enterprise (HPE) HPE Alletra Storage MP B10…)
- [CVE-2024-11364](https://cve.now/CVE-2024-11364.md): Rockwell Automation Third Party Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2024-12729](https://cve.now/CVE-2024-12729.md): A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older tha (CVSS 8.8, Sophos Firewall)
- [CVE-2024-12672](https://cve.now/CVE-2024-12672.md): Rockwell Automation Third Party Vulnerability in Arena® (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2024-12175](https://cve.now/CVE-2024-12175.md): Rockwell Automation Code Execution Vulnerability in Arena (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2024-12728](https://cve.now/CVE-2024-12728.md): A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3) (CVSS 9.8, Sophos Firewall)
- [CVE-2024-11157](https://cve.now/CVE-2024-11157.md): Rockwell Automation Third Party Vulnerability in Arena (CVSS 8.5, Rockwell Automation Arena®)
- [CVE-2024-2201](https://cve.now/CVE-2024-2201.md): CVE-2024-2201 (CVSS 4.7, Xen)
- [CVE-2024-12727](https://cve.now/CVE-2024-12727.md): A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows acces (CVSS 9.8, Sophos Firewall)
- [CVE-2024-12111](https://cve.now/CVE-2024-12111.md): Potential LDAP injection vulnerability in OpenText Privileged Access Manager (CVSS 8.0, OpenText Privileged Access Manager)
- [CVE-2024-7139](https://cve.now/CVE-2024-7139.md): Denial of Service in Silicon Labs RS9116 Bluetooth SDK (CVSS 6.5, silabs.com RS9116 Bluetooth SDK)
- [CVE-2024-7138](https://cve.now/CVE-2024-7138.md): Denial of Service in Silicon Labs RS9116 Bluetooth SDK (CVSS 6.5, silabs.com RS9116 Bluetooth SDK)
- [CVE-2024-7137](https://cve.now/CVE-2024-7137.md): Denial of Service in Silicon Labs RS9116 Bluetooth SDK (CVSS 6.5, silabs.com RS9116 Bluetooth SDK)
- [CVE-2024-49765](https://cve.now/CVE-2024-49765.md): Bypass of Discourse Connect using other login paths if enabled in Discourse (CVSS 5.3, discourse)
- [CVE-2024-52589](https://cve.now/CVE-2024-52589.md): Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse (CVSS 2.2, discourse)
- [CVE-2024-52794](https://cve.now/CVE-2024-52794.md): Magnific lightbox susceptible to Cross-site Scripting in Discourse (CVSS 6.8, discourse)
- [CVE-2024-53991](https://cve.now/CVE-2024-53991.md): Potential Backup file leaked via Nginx in Discourse (CVSS 7.5, discourse)
- [CVE-2024-56159](https://cve.now/CVE-2024-56159.md): Server source code is exposed to the public if sourcemaps are enabled (CVSS 7.8, withastro astro · astro)
- [CVE-2024-56200](https://cve.now/CVE-2024-56200.md): Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy (CVSS 8.6, nexryai altair)
- [CVE-2024-54150](https://cve.now/CVE-2024-54150.md): Algorithm Confusion Vulnerability in cjwt (CVSS 8.7, xmidt-org cjwt)
- [CVE-2020-6923](https://cve.now/CVE-2020-6923.md): HP Linux Imaging and Printing Software - Potential Memory Buffer Overflow (CVSS 5.7, HP Linux Imaging and Printing Software)
- [CVE-2024-12794](https://cve.now/CVE-2024-12794.md): Codezips E-Commerce Site editorder.php sql injection (CVSS 5.3, Codezips E-Commerce Site)
- [CVE-2024-12793](https://cve.now/CVE-2024-12793.md): PbootCMS IndexController.php path traversal (CVSS 5.3, PbootCMS)
- [CVE-2023-7005](https://cve.now/CVE-2023-7005.md): CVE-2023-7005 (CVSS 7.5, Sciener TTLock App)
- [CVE-2024-12792](https://cve.now/CVE-2024-12792.md): Codezips E-Commerce Site newadmin.php sql injection (CVSS 6.9, Codezips E-Commerce Site)
- [CVE-2024-12791](https://cve.now/CVE-2024-12791.md): Codezips E-Commerce Site signin.php sql injection (CVSS 6.9, Codezips E-Commerce Site)
- [CVE-2024-49336](https://cve.now/CVE-2024-49336.md): IBM Security Guardium server-side request forgery (CVSS 6.5, IBM Security Guardium)
- [CVE-2024-52897](https://cve.now/CVE-2024-52897.md): IBM MQ information disclosure (CVSS 6.2, IBM MQ)
- [CVE-2024-38819](https://cve.now/CVE-2024-38819.md): Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks (CVSS 7.5, Spring Framework · org.springframework:spring-webflux +1)
- [CVE-2024-51471](https://cve.now/CVE-2024-51471.md): IBM MQ Appliance denial of service (CVSS 5.3, IBM MQ Appliance)
- [CVE-2024-52896](https://cve.now/CVE-2024-52896.md): IBM MQ information disclosure (CVSS 6.2, IBM MQ)
- [CVE-2024-12790](https://cve.now/CVE-2024-12790.md): code-projects Hostel Management Site room-details.php cross site scripting (CVSS 5.3, code-projects Hostel Management Site)
- [CVE-2021-22501](https://cve.now/CVE-2021-22501.md): Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. (CVSS 5.3, OpenText™ Operations Bridge Manager)
- [CVE-2024-12789](https://cve.now/CVE-2024-12789.md): PbootCMS IndexController.php code injection (CVSS 5.3, PbootCMS)
- [CVE-2024-12788](https://cve.now/CVE-2024-12788.md): Codezips Technical Discussion Forum signinpost.php sql injection (CVSS 6.9, Codezips Technical Discussion Forum)
- [CVE-2024-12801](https://cve.now/CVE-2024-12801.md): SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks (CVSS 2.4, QOS.CH Sarl logback · ch.qos.logback:logback-core)
- [CVE-2024-38864](https://cve.now/CVE-2024-38864.md): User-Readable Private Key in Windows Agent (CVSS 4.8, Checkmk)
- [CVE-2024-9154](https://cve.now/CVE-2024-9154.md): Authenticated Remote Code Execution (CVSS 8.6, HMS Networks Ewon Flexy)
- [CVE-2024-12787](https://cve.now/CVE-2024-12787.md): 1000 Projects Attendance Tracking Management System check\_student\_login.php sql injection (CVSS 6.9, 1000 Projects Attendance Tracking Management System)
- [CVE-2024-12798](https://cve.now/CVE-2024-12798.md): JaninoEventEvaluator vulnerability (CVSS 5.9, QOS.CH Sarl Logback-core · ch.qos.logback:logback-core)
- [CVE-2024-12786](https://cve.now/CVE-2024-12786.md): X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management (CVSS 8.5, X1a0He Adobe Downloader)
- [CVE-2024-12785](https://cve.now/CVE-2024-12785.md): itsourcecode Vehicle Management System sendmail.php sql injection (CVSS 5.3, itsourcecode Vehicle Management System)
- [CVE-2024-25131](https://cve.now/CVE-2024-25131.md): Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation (CVSS 8.8, must-gather-operator · github.com/openshift/must-gather)
- [CVE-2024-47093](https://cve.now/CVE-2024-47093.md): Fix various XSS issues and potential RCE (CVSS 8.8, Nagvis)
- [CVE-2024-10244](https://cve.now/CVE-2024-10244.md): SQLi in ISDO Software's Web Software (CVSS 9.8, ISDO Software Web Software)
- [CVE-2024-12784](https://cve.now/CVE-2024-12784.md): itsourcecode Vehicle Management System editbill.php sql injection (CVSS 5.3, itsourcecode Vehicle Management System)
- [CVE-2021-26102](https://cve.now/CVE-2021-26102.md): A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated (CVSS 9.8, Fortinet FortiWAN)
- [CVE-2024-9102](https://cve.now/CVE-2024-9102.md): phpLDAPadmin: Improper Neutralization of Formula Elements (CVSS 5.0, phpLDAPadmin)
- [CVE-2024-9101](https://cve.now/CVE-2024-9101.md): phpLDAPadmin: Reflected Cross-Site Scripting in entry\_chooser.php (CVSS 2.1, phpLDAPadmin)
- [CVE-2024-12783](https://cve.now/CVE-2024-12783.md): itsourcecode Vehicle Management System billaction.php cross site scripting (CVSS 5.3, itsourcecode Vehicle Management System)
- [CVE-2024-12782](https://cve.now/CVE-2024-12782.md): Fujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorization (CVSS 6.9, Fujifilm Business Innovation Apeos C3070 · Fujifilm Busi… +1)
- [CVE-2021-32589](https://cve.now/CVE-2021-32589.md): A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and (CVSS 7.7, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2024-45819](https://cve.now/CVE-2024-45819.md): libxl leaks data to PVH guests via ACPI tables (CVSS 5.5, Xen)
- [CVE-2024-45818](https://cve.now/CVE-2024-45818.md): Deadlock in x86 HVM standard VGA handling (CVSS 6.5, Xen)
- [CVE-2024-37962](https://cve.now/CVE-2024-37962.md): WordPress Fusion Page Builder plugin \<= 1.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Agency Dominion Fusion)
- [CVE-2024-12626](https://cve.now/CVE-2024-12626.md): AutomatorWP \<= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search\_field\_value (CVSS 9.6, rubengc AutomatorWP – Automator plugin for no-code automati…)
- [CVE-2024-12331](https://cve.now/CVE-2024-12331.md): File Manager Pro – Filester \<= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation (CVSS 4.3, ninjateam File Manager Pro – Filester)
- [CVE-2021-26115](https://cve.now/CVE-2021-26115.md): An OS command injection (CWE-78) vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated a (CVSS 7.6, Fortinet FortiWAN)
- [CVE-2020-15934](https://cve.now/CVE-2020-15934.md): An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. (CVSS 8.6, Fortinet FortiClientLinux)
- [CVE-2020-12820](https://cve.now/CVE-2020-12820.md): Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a rem (CVSS 5.4, Fortinet FortiOS)
- [CVE-2024-11616](https://cve.now/CVE-2024-11616.md): Double-fetch heap overflow (CVSS 5.6, Netskope Endpoint DLP)
- [CVE-2023-4617](https://cve.now/CVE-2023-4617.md): Gaining remote control over Govee devices (CVSS 10.0, Govee Home)
- [CVE-2024-12569](https://cve.now/CVE-2024-12569.md): Sensitive Information in Driver’s Log File (CVSS 5.2, Milestone Systems XProtect VMS)
- [CVE-2021-26093](https://cve.now/CVE-2021-26093.md): An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated (CVSS 6.6, Fortinet FortiWLC)
- [CVE-2020-12819](https://cve.now/CVE-2020-12819.md): A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 a (CVSS 5.4, Fortinet FortiOS)
- [CVE-2024-4230](https://cve.now/CVE-2024-4230.md): External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Soft (CVSS 7.8, Edgecross Consortium Edgecross Basic Software for Windows ·…)
- [CVE-2024-4229](https://cve.now/CVE-2024-4229.md): Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for (CVSS 7.8, Edgecross Consortium Edgecross Basic Software for Windows ·…)
- [CVE-2024-12560](https://cve.now/CVE-2024-12560.md): Button Block – Get fully customizable & multi-functional buttons \<= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication (CVSS 4.3, bplugins Button Block – Design Stylish, Interactive, and Mu…)
- [CVE-2024-11768](https://cve.now/CVE-2024-11768.md): Download manager \<= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files (CVSS 5.3, codename065 Download Manager)
- [CVE-2024-11740](https://cve.now/CVE-2024-11740.md): Download Manager \<= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, codename065 Download Manager)
- [CVE-2024-11984](https://cve.now/CVE-2024-11984.md): SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type (CVSS 9.4, SUNNET Technology Co. Corporate Training Management System)
- [CVE-2024-12121](https://cve.now/CVE-2024-12121.md): Broken Link Checker | Finder \<= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery (CVSS 5.4, cyberlord92 Broken Link Checker | Finder)
- [CVE-2024-10548](https://cve.now/CVE-2024-10548.md): WP Project Manager \<= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API (CVSS 6.5, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2024-51532](https://cve.now/CVE-2024-51532.md): Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. (CVSS 7.1, Dell PowerStore)
- [CVE-2022-27595](https://cve.now/CVE-2022-27595.md): QVPN Device Client (CVSS 7.8, QNAP Systems QVPN Windows)
- [CVE-2022-27600](https://cve.now/CVE-2022-27600.md): QTS, QuTS hero, QuTScloud (CVSS 6.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-23354](https://cve.now/CVE-2023-23354.md): QuLog Center (CVSS 7.3, QNAP Systems QuLog Center)
- [CVE-2023-23356](https://cve.now/CVE-2023-23356.md): QuFirewall (CVSS 5.5, QNAP Systems QuFirewall)
- [CVE-2023-23357](https://cve.now/CVE-2023-23357.md): QuLog Center (CVSS 4.8, QNAP Systems QuLog Center)
- [CVE-2024-35141](https://cve.now/CVE-2024-35141.md): IBM Security Verify Access privilege escalation (CVSS 7.8, IBM Security Verify Access Docker)
- [CVE-2023-30443](https://cve.now/CVE-2023-30443.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2022-33954](https://cve.now/CVE-2022-33954.md): IBM Robotic Process Automation information disclosure (CVSS 4.6, IBM Robotic Process Automation)
- [CVE-2021-39081](https://cve.now/CVE-2021-39081.md): IBM Cognos Analytics Mobile information disclosure (CVSS 5.9, IBM Cognos Analytics Mobile for Android)
- [CVE-2024-54663](https://cve.now/CVE-2024-54663.md): An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. (CVSS 7.5)
- [CVE-2024-54790](https://cve.now/CVE-2024-54790.md): A SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to exec (CVSS 7.5)
- [CVE-2024-54982](https://cve.now/CVE-2024-54982.md): An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message. (no CVSS)
- [CVE-2024-54983](https://cve.now/CVE-2024-54983.md): An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message. (CVSS 9.8)
- [CVE-2024-54984](https://cve.now/CVE-2024-54984.md): An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. (CVSS 9.8)
- [CVE-2024-55081](https://cve.now/CVE-2024-55081.md): An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitra (CVSS 9.8)
- [CVE-2024-55082](https://cve.now/CVE-2024-55082.md): A Server-Side Request Forgery (SSRF) in the endpoint http://{your-server}/url-to-pdf of Stirling-PDF 0.35.1 allows attackers to access sensi (CVSS 7.5)
- [CVE-2024-55196](https://cve.now/CVE-2024-55196.md): Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords fo (CVSS 7.5, github.com/gophish/gophish)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.