# CVEs published 2024-12-20

87 CVEs were published on December 20, 2024: 7 critical, 26 high. Days are UTC.

- [CVE-2023-31280](https://cve.now/CVE-2023-31280.md): Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, AirVantage, AirVantage-Capable Devices: All Sierra Wireless…)
- [CVE-2023-31279](https://cve.now/CVE-2023-31279.md): Improper Authentication (CVSS 8.1, AirVantage, AirVantage-Capable Devices: All Sierra Wireless…)
- [CVE-2024-11811](https://cve.now/CVE-2024-11811.md): Feedify – Web Push Notifications \<= 2.4.2 - Reflected Cross-Site Scripting (CVSS 6.1, Feedify – Web Push Notifications)
- [CVE-2020-13712](https://cve.now/CVE-2020-13712.md): MGOS Command Injection (CVSS 7.8, Sierra Wireless MGOS)
- [CVE-2024-12845](https://cve.now/CVE-2024-12845.md): Emlog Pro common.php cross site scripting (CVSS 5.3, Emlog Pro)
- [CVE-2024-12844](https://cve.now/CVE-2024-12844.md): Emlog Pro store.php cross site scripting (CVSS 6.9, Emlog Pro)
- [CVE-2024-12843](https://cve.now/CVE-2024-12843.md): Emlog Pro plugin.php cross site scripting (CVSS 6.9, Emlog Pro)
- [CVE-2024-56359](https://cve.now/CVE-2024-56359.md): Cross-site Scripting vulnerability through HyperLink cells in grist-core (CVSS 8.1, gristlabs grist-core)
- [CVE-2024-56358](https://cve.now/CVE-2024-56358.md): Cross-site Scripting vulnerability through svg attachment previews in grist-core (CVSS 8.1, gristlabs grist-core)
- [CVE-2024-56357](https://cve.now/CVE-2024-56357.md): Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core (CVSS 8.1, gristlabs grist-core)
- [CVE-2024-40875](https://cve.now/CVE-2024-40875.md): Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52 (CVSS 5.9, Absolute Software Secure Access)
- [CVE-2024-56335](https://cve.now/CVE-2024-56335.md): Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden (CVSS 7.6, dani-garcia vaultwarden)
- [CVE-2024-56334](https://cve.now/CVE-2024-56334.md): Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation (CVSS 7.8, sebhildebrandt systeminformation · systeminformation)
- [CVE-2024-56330](https://cve.now/CVE-2024-56330.md): Session VNC may be accessed by other sessions on the same host in stardust (CVSS 9.3, spaceness stardust)
- [CVE-2024-12842](https://cve.now/CVE-2024-12842.md): Emlog Pro user.php cross site scripting (CVSS 6.9, Emlog Pro)
- [CVE-2024-56329](https://cve.now/CVE-2024-56329.md): Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream (CVSS 8.9, joelbutcher socialstream · joelbutcher/socialstream)
- [CVE-2024-56333](https://cve.now/CVE-2024-56333.md): Remote code execution in onyxia-api (CVSS 9.4, InseeFrLab onyxia)
- [CVE-2024-56331](https://cve.now/CVE-2024-56331.md): Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's \`Real-Browser\` monitor (CVSS 6.8, louislam uptime-kuma · uptime-kuma)
- [CVE-2024-12867](https://cve.now/CVE-2024-12867.md): Server-Side Request Forgery in Arctic Hub URL Mapper allows an unauthenticated remote attacker to exfiltrate and modify configurations and data (CVSS 8.8, Arctic Security Arctic Hub)
- [CVE-2024-12841](https://cve.now/CVE-2024-12841.md): Emlog Pro tag.php cross site scripting (CVSS 6.9, Emlog Pro)
- [CVE-2024-12677](https://cve.now/CVE-2024-12677.md): Delta Electronics DTM Soft Deserialization of Untrusted Data (CVSS 7.8, Delta Electronics DTM Soft)
- [CVE-2024-10385](https://cve.now/CVE-2024-10385.md): Stored XSS in DirectAdmin Evo Skin (CVSS 8.6, DirectAdmin Evolution Skin)
- [CVE-2024-56337](https://cve.now/CVE-2024-56337.md): Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete (CVSS 9.8, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2024-56356](https://cve.now/CVE-2024-56356.md): In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack (CVSS 5.9, JetBrains TeamCity)
- [CVE-2024-56355](https://cve.now/CVE-2024-56355.md): In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS (CVSS 4.6, JetBrains TeamCity)
- [CVE-2024-56354](https://cve.now/CVE-2024-56354.md): In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission (CVSS 5.5, JetBrains TeamCity)
- [CVE-2024-56353](https://cve.now/CVE-2024-56353.md): In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies (CVSS 5.5, JetBrains TeamCity)
- [CVE-2024-56352](https://cve.now/CVE-2024-56352.md): In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page (CVSS 4.6, JetBrains TeamCity)
- [CVE-2024-56351](https://cve.now/CVE-2024-56351.md): In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles (CVSS 6.3, JetBrains TeamCity)
- [CVE-2024-56350](https://cve.now/CVE-2024-56350.md): In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects (CVSS 4.3, JetBrains TeamCity)
- [CVE-2024-56349](https://cve.now/CVE-2024-56349.md): In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs (CVSS 5.3, JetBrains TeamCity)
- [CVE-2024-56348](https://cve.now/CVE-2024-56348.md): In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents (CVSS 4.3, JetBrains TeamCity)
- [CVE-2024-28767](https://cve.now/CVE-2024-28767.md): IBM Security Directory Integrator command execution (CVSS 6.8, IBM Security Directory Integrator)
- [CVE-2024-40695](https://cve.now/CVE-2024-40695.md): IBM Cognos Analytics file upload (CVSS 8.0, IBM Cognos Analytics)
- [CVE-2024-51466](https://cve.now/CVE-2024-51466.md): IBM Cognos Analytics expression language injection (CVSS 9.0, IBM Cognos Analytics)
- [CVE-2024-12014](https://cve.now/CVE-2024-12014.md): Path Traversal vulnerability in eSignaViewer Allow Unauthorized File Access (CVSS 2.0, Lleidanet PKI eSigna)
- [CVE-2024-7726](https://cve.now/CVE-2024-7726.md): Arbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM7 (CVSS 5.7, Kioxia CM6 · Kioxia PM7 +1)
- [CVE-2024-11878](https://cve.now/CVE-2024-11878.md): Category Post Slider \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gbsdeveloper Category Post Slider)
- [CVE-2024-12506](https://cve.now/CVE-2024-12506.md): NACC WordPress Plugin \<= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, magblogapi NACC WordPress Plugin)
- [CVE-2024-11774](https://cve.now/CVE-2024-11774.md): Outdooractive Embed \<= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Outdooractive Embed)
- [CVE-2024-11783](https://cve.now/CVE-2024-11783.md): Financial Calculator \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, financecalculatorwp Financial Calculator)
- [CVE-2024-11806](https://cve.now/CVE-2024-11806.md): PKT1 Centro de envios \<= 1.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, carlosfrancopkt1 PKT1 Centro de envios)
- [CVE-2024-11893](https://cve.now/CVE-2024-11893.md): Spoki – Chat Buttons and WooCommerce Notifications \<= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Spoki – Chat Buttons and WooCommerce Notifications)
- [CVE-2024-11331](https://cve.now/CVE-2024-11331.md): isee-products-extractor \<= 2.1.3 - Reflected Cross-Site Scripting (CVSS 6.1, sisoog استخراج محصولات ووکامرس برای آیسی)
- [CVE-2024-11784](https://cve.now/CVE-2024-11784.md): Sell Tickets Online – TicketSource Ticket Shop for WordPress \<= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, TicketSource Ticket Shop)
- [CVE-2024-9619](https://cve.now/CVE-2024-9619.md): WP SHAPES \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, holithemes WP SHAPES)
- [CVE-2024-11297](https://cve.now/CVE-2024-11297.md): Page Restriction WordPress (WP) – Protect WP Pages/Post \<= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, cyberlord92 Page and Post Restriction)
- [CVE-2024-12509](https://cve.now/CVE-2024-12509.md): Embed Twine \<= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rluks Embed Twine)
- [CVE-2024-11812](https://cve.now/CVE-2024-11812.md): Wtyczka SeoPilot dla WP \<= 3.3.091 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, Wtyczka SeoPilot dla WP)
- [CVE-2024-12571](https://cve.now/CVE-2024-12571.md): Store Locator \<= 3.98.10 - Unauthenticated Local File Inclusion (CVSS 9.8, moaluko Store Locator for WordPress with Google Maps – Lots…)
- [CVE-2024-11411](https://cve.now/CVE-2024-11411.md): Spotlightr \<= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, socratous139 Spotlightr)
- [CVE-2024-11775](https://cve.now/CVE-2024-11775.md): Particle Background \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, aasthasolutions Particle Background)
- [CVE-2024-9503](https://cve.now/CVE-2024-9503.md): Maintenance & Coming Soon Redirect Animation \<= 2.1.3 - Missing Authorization to Settings Update (CVSS 4.3, ilyasine Maintenance & Coming Soon Redirect Animation)
- [CVE-2024-8968](https://cve.now/CVE-2024-8968.md): MaxButtons \< 9.8.1 - Admin+ Stored XSS via Text Color (CVSS 4.7, WordPress Button Plugin MaxButtons)
- [CVE-2024-11108](https://cve.now/CVE-2024-11108.md): Serious Slider \< 1.2.7 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Serious Slider)
- [CVE-2024-10706](https://cve.now/CVE-2024-10706.md): Download Manager \< 3.3.03 - Admin+ Stored XSS (CVSS 4.8, Download Manager)
- [CVE-2024-10555](https://cve.now/CVE-2024-10555.md): MaxButtons \< 9.8.1 - Admin+ Stored XSS via Button Width (CVSS 4.8, WordPress Button Plugin MaxButtons)
- [CVE-2024-5955](https://cve.now/CVE-2024-5955.md): Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated a (CVSS 5.4, Trellix ePO Onprem Sp1 Update4)
- [CVE-2024-21549](https://cve.now/CVE-2024-21549.md): Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the se (CVSS 7.7, spatie/browsershot)
- [CVE-2024-44298](https://cve.now/CVE-2024-44298.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2024-44293](https://cve.now/CVE-2024-44293.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2024-44211](https://cve.now/CVE-2024-44211.md): This issue was addressed with improved validation of symlinks. (CVSS 7.5, Apple macOS)
- [CVE-2024-44231](https://cve.now/CVE-2024-44231.md): This issue was addressed through improved state management. (CVSS 7.5, Apple macOS)
- [CVE-2024-44292](https://cve.now/CVE-2024-44292.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2024-44195](https://cve.now/CVE-2024-44195.md): A logic issue was addressed with improved validation. (CVSS 7.5, Apple macOS)
- [CVE-2024-44223](https://cve.now/CVE-2024-44223.md): This issue was addressed through improved state management. (CVSS 4.6, Apple macOS)
- [CVE-2023-42867](https://cve.now/CVE-2023-42867.md): This issue was addressed with improved validation of the process entitlement and Team ID. (CVSS 7.8, Apple GarageBand)
- [CVE-2024-11776](https://cve.now/CVE-2024-11776.md): PCRecruiter Extensions \<= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mstdev PCRecruiter Extensions)
- [CVE-2022-34159](https://cve.now/CVE-2022-34159.md): Huawei printers have an input verification vulnerability. (CVSS 7.5, Huawei CV81-WDM FW)
- [CVE-2022-32204](https://cve.now/CVE-2022-32204.md): There is an improper input verification vulnerability in Huawei printer product. (CVSS 7.5, Huawei CV81-WDM FW)
- [CVE-2022-32203](https://cve.now/CVE-2022-32203.md): There is a command injection vulnerability in Huawei terminal printer product. (CVSS 9.8, Huawei CV81-WDM FW)
- [CVE-2022-32144](https://cve.now/CVE-2022-32144.md): There is an insufficient input verification vulnerability in Huawei product. (CVSS 8.6, Huawei CV81-WDM FW)
- [CVE-2020-9250](https://cve.now/CVE-2020-9250.md): There is an insufficient authentication vulnerability in some Huawei smart phone. (CVSS 3.3, HUAWEI Mate 20 Pro)
- [CVE-2024-12678](https://cve.now/CVE-2024-12678.md): Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens (CVSS 6.5, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2024-54538](https://cve.now/CVE-2024-54538.md): A denial-of-service issue was addressed with improved input validation. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-12831](https://cve.now/CVE-2024-12831.md): Arista NG Firewall uvm\_login Incorrect Authorization Privilege Escalation Vulnerability (CVSS 6.6, Arista NG Firewall)
- [CVE-2024-12832](https://cve.now/CVE-2024-12832.md): Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability (CVSS 8.3, Arista NG Firewall)
- [CVE-2024-12830](https://cve.now/CVE-2024-12830.md): Arista NG Firewall custom\_handler Directory Traversal Remote Code Execution Vulnerability (CVSS 8.1, Arista NG Firewall)
- [CVE-2024-12829](https://cve.now/CVE-2024-12829.md): Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability (CVSS 7.2, Arista NG Firewall)
- [CVE-2021-40959](https://cve.now/CVE-2021-40959.md): A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall (AIWAF) \<= 4.1.6 and \<=5.0 was ide (CVSS 6.1)
- [CVE-2024-37758](https://cve.now/CVE-2024-37758.md): Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attackers to escalate privil (CVSS 8.8)
- [CVE-2024-55186](https://cve.now/CVE-2024-55186.md): An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox message (CVSS 4.3, Oqtane.Framework · Oqtane.Client +2)
- [CVE-2024-55341](https://cve.now/CVE-2024-55341.md): A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web bro (CVSS 4.7, Piranha)
- [CVE-2024-55342](https://cve.now/CVE-2024-55342.md): A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. (CVSS 4.7, Piranha)
- [CVE-2024-55470](https://cve.now/CVE-2024-55470.md): Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. (CVSS 7.5, Oqtane.Framework · Oqtane.Server)
- [CVE-2024-55471](https://cve.now/CVE-2024-55471.md): Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. (CVSS 6.5, Oqtane.Framework · Oqtane.Server)
- [CVE-2024-55509](https://cve.now/CVE-2024-55509.md): SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate p (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.