# CVEs published 2024-12-22

16 CVEs were published on December 22, 2024: 0 critical, 3 high. Days are UTC.

- [CVE-2024-12897](https://cve.now/CVE-2024-12897.md): Intelbras VIP S4320 G2 Web Interface Sha1Account1 path traversal (CVSS 5.3, Intelbras VIP S3020 G2 · Intelbras VIP S4020 G2 +2)
- [CVE-2024-12896](https://cve.now/CVE-2024-12896.md): Intelbras VIP S4320 G2 Web Interface webCapsConfig information disclosure (CVSS 6.9, Intelbras VIP S3020 G2 · Intelbras VIP S4020 G2 +2)
- [CVE-2024-12895](https://cve.now/CVE-2024-12895.md): TreasureHuntGame TreasureHunt checkflag.php console\_log sql injection (CVSS 5.3, TreasureHuntGame TreasureHunt)
- [CVE-2024-12894](https://cve.now/CVE-2024-12894.md): TreasureHuntGame TreasureHunt acesso.php sql injection (CVSS 5.3, TreasureHuntGame TreasureHunt)
- [CVE-2024-12893](https://cve.now/CVE-2024-12893.md): Portabilis i-Educar Tipo de Usuário Page 2 cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2024-12892](https://cve.now/CVE-2024-12892.md): code-projects Online Exam Mastering System sign.php cross site scripting (CVSS 5.3, code-projects Online Exam Mastering System)
- [CVE-2024-12891](https://cve.now/CVE-2024-12891.md): code-projects Online Exam Mastering System account.php sql injection (CVSS 5.3, code-projects Online Exam Mastering System)
- [CVE-2024-12890](https://cve.now/CVE-2024-12890.md): code-projects Online Exam Mastering System update.php sql injection (CVSS 5.3, code-projects Online Exam Mastering System)
- [CVE-2024-11852](https://cve.now/CVE-2024-11852.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.12 - Missing Authorization (CVSS 4.3, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-56310](https://cve.now/CVE-2024-56310.md): REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. (CVSS 8.8)
- [CVE-2024-56311](https://cve.now/CVE-2024-56311.md): REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) att (CVSS 8.8)
- [CVE-2024-56312](https://cve.now/CVE-2024-56312.md): A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to injec (CVSS 5.4)
- [CVE-2024-56313](https://cve.now/CVE-2024-56313.md): A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject mali (CVSS 5.4)
- [CVE-2024-56314](https://cve.now/CVE-2024-56314.md): A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject maliciou (CVSS 5.4)
- [CVE-2024-56375](https://cve.now/CVE-2024-56375.md): An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. (CVSS 7.5, nicmx fort-validator)
- [CVE-2024-56378](https://cve.now/CVE-2024-56378.md): libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. (CVSS 4.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.