CVEs published December 20, 2024
87 CVEs were published on December 20, 2024: 7 critical, 26 high.
- Published
- 87
- Critical
- 7
- High
- 26
- Medium
- 52
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- JetBrains TeamCity
- 9
- Apple macOS
- 7
- Emlog Pro
- 5
- Arista NG Firewall
- 4
- Huawei CV81-WDM FW
- 4
- gristlabs grist-core
- 3
- AirVantage, AirVantage-Capable Devices: All Sierra Wireless…
- 2
- IBM Cognos Analytics
- 2
- Oqtane.Framework · Oqtane.Server
- 2
- Piranha
- 2
Critical 7
- CVE-2024-56330Session VNC may be accessed by other sessions on the same host in stardustspaceness stardust
- CVE-2024-56333Remote code execution in onyxia-apiInseeFrLab onyxia
- CVE-2024-56337Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incompleteApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2024-51466IBM Cognos Analytics expression language injectionIBM Cognos Analytics
- CVE-2024-12571Store Locator <= 3.98.10 - Unauthenticated Local File Inclusionmoaluko Store Locator for WordPress with Google Maps – Lots…
- CVE-2022-32203There is a command injection vulnerability in Huawei terminal printer product.Huawei CV81-WDM FW
- CVE-2024-55509SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate p
High 26
- CVE-2023-31279Improper AuthenticationAirVantage, AirVantage-Capable Devices: All Sierra Wireless…
- CVE-2020-13712MGOS Command InjectionSierra Wireless MGOS
- CVE-2024-56359Cross-site Scripting vulnerability through HyperLink cells in grist-coregristlabs grist-core
- CVE-2024-56358Cross-site Scripting vulnerability through svg attachment previews in grist-coregristlabs grist-core
- CVE-2024-56357Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-coregristlabs grist-core
- CVE-2024-56335Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwardendani-garcia vaultwarden
- CVE-2024-56334Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformationsebhildebrandt systeminformation · systeminformation
- CVE-2024-56329Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstreamjoelbutcher socialstream · joelbutcher/socialstream
- CVE-2024-12867Server-Side Request Forgery in Arctic Hub URL Mapper allows an unauthenticated remote attacker to exfiltrate and modify configurations and dataArctic Security Arctic Hub
- CVE-2024-12677Delta Electronics DTM Soft Deserialization of Untrusted DataDelta Electronics DTM Soft
- CVE-2024-10385Stored XSS in DirectAdmin Evo SkinDirectAdmin Evolution Skin
- CVE-2024-40695IBM Cognos Analytics file uploadIBM Cognos Analytics
- CVE-2024-21549Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the sespatie/browsershot
- CVE-2024-44211This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2024-44231This issue was addressed through improved state management.Apple macOS
- CVE-2024-44195A logic issue was addressed with improved validation.Apple macOS
- CVE-2023-42867This issue was addressed with improved validation of the process entitlement and Team ID.Apple GarageBand
- CVE-2022-34159Huawei printers have an input verification vulnerability.Huawei CV81-WDM FW
- CVE-2022-32204There is an improper input verification vulnerability in Huawei printer product.Huawei CV81-WDM FW
- CVE-2022-32144There is an insufficient input verification vulnerability in Huawei product.Huawei CV81-WDM FW
- CVE-2024-54538A denial-of-service issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-12832Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write VulnerabilityArista NG Firewall
- CVE-2024-12830Arista NG Firewall custom_handler Directory Traversal Remote Code Execution VulnerabilityArista NG Firewall
- CVE-2024-12829Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution VulnerabilityArista NG Firewall
- CVE-2024-37758Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attackers to escalate privil
- CVE-2024-55470Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control.Oqtane.Framework · Oqtane.Server
Medium, low and unrated 54
- CVE-2023-31280Exposure of Sensitive Information to an Unauthorized ActorAirVantage, AirVantage-Capable Devices: All Sierra Wireless…
- CVE-2024-11811Feedify – Web Push Notifications <= 2.4.2 - Reflected Cross-Site ScriptingFeedify – Web Push Notifications
- CVE-2024-12845Emlog Pro common.php cross site scriptingEmlog Pro
- CVE-2024-12844Emlog Pro store.php cross site scriptingEmlog Pro
- CVE-2024-12843Emlog Pro plugin.php cross site scriptingEmlog Pro
- CVE-2024-40875Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52Absolute Software Secure Access
- CVE-2024-12842Emlog Pro user.php cross site scriptingEmlog Pro
- CVE-2024-56331Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitorlouislam uptime-kuma · uptime-kuma
- CVE-2024-12841Emlog Pro tag.php cross site scriptingEmlog Pro
- CVE-2024-56356In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attackJetBrains TeamCity
- CVE-2024-56355In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSSJetBrains TeamCity
- CVE-2024-56354In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permissionJetBrains TeamCity
- CVE-2024-56353In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookiesJetBrains TeamCity
- CVE-2024-56352In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details pageJetBrains TeamCity
- CVE-2024-56351In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user rolesJetBrains TeamCity
- CVE-2024-56350In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projectsJetBrains TeamCity
- CVE-2024-56349In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logsJetBrains TeamCity
- CVE-2024-56348In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agentsJetBrains TeamCity
- CVE-2024-28767IBM Security Directory Integrator command executionIBM Security Directory Integrator
- CVE-2024-12014Path Traversal vulnerability in eSignaViewer Allow Unauthorized File AccessLleidanet PKI eSigna
- CVE-2024-7726Arbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM7Kioxia CM6 · Kioxia PM7 +1
- CVE-2024-11878Category Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptinggbsdeveloper Category Post Slider
- CVE-2024-12506NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingmagblogapi NACC WordPress Plugin
- CVE-2024-11774Outdooractive Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingOutdooractive Embed
- CVE-2024-11783Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingfinancecalculatorwp Financial Calculator
- CVE-2024-11806PKT1 Centro de envios <= 1.2.1 - Reflected Cross-Site Scriptingcarlosfrancopkt1 PKT1 Centro de envios
- CVE-2024-11893Spoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site ScriptingSpoki – Chat Buttons and WooCommerce Notifications
- CVE-2024-11331isee-products-extractor <= 2.1.3 - Reflected Cross-Site Scriptingsisoog استخراج محصولات ووکامرس برای آیسی
- CVE-2024-11784Sell Tickets Online – TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingTicketSource Ticket Shop
- CVE-2024-9619WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadholithemes WP SHAPES
- CVE-2024-11297Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurecyberlord92 Page and Post Restriction
- CVE-2024-12509Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingrluks Embed Twine
- CVE-2024-11812Wtyczka SeoPilot dla WP <= 3.3.091 - Cross-Site Request Forgery to Stored Cross-Site ScriptingWtyczka SeoPilot dla WP
- CVE-2024-11411Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scriptingsocratous139 Spotlightr
- CVE-2024-11775Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingaasthasolutions Particle Background
- CVE-2024-9503Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Updateilyasine Maintenance & Coming Soon Redirect Animation
- CVE-2024-8968MaxButtons < 9.8.1 - Admin+ Stored XSS via Text ColorWordPress Button Plugin MaxButtons
- CVE-2024-11108Serious Slider < 1.2.7 - Contributor+ Stored XSS via ShortcodeSerious Slider
- CVE-2024-10706Download Manager < 3.3.03 - Admin+ Stored XSSDownload Manager
- CVE-2024-10555MaxButtons < 9.8.1 - Admin+ Stored XSS via Button WidthWordPress Button Plugin MaxButtons
- CVE-2024-5955Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated aTrellix ePO Onprem Sp1 Update4
- CVE-2024-44298A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-44293A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-44292A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-44223This issue was addressed through improved state management.Apple macOS
- CVE-2024-11776PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scriptingmstdev PCRecruiter Extensions
- CVE-2020-9250There is an insufficient authentication vulnerability in some Huawei smart phone.HUAWEI Mate 20 Pro
- CVE-2024-12678Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity TokensHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2024-12831Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation VulnerabilityArista NG Firewall
- CVE-2021-40959A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) <= 4.1.6 and <=5.0 was ide
- CVE-2024-55186An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messageOqtane.Framework · Oqtane.Client +2
- CVE-2024-55341A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web broPiranha
- CVE-2024-55342A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media.Piranha
- CVE-2024-55471Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController.Oqtane.Framework · Oqtane.Server