CVEs published December 23, 2024
28 CVEs were published on December 23, 2024: 3 critical, 10 high.
- Published
- 28
- Critical
- 3
- High
- 10
- Medium
- 14
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- 1000 Projects Attendance Tracking Management System
- 2
- FoxCMS
- 2
- gogs · gogs.io/gogs
- 2
- pallets jinja · jinja2
- 2
- Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +1
- 2
- Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +4
- 2
- xemle home-gallery
- 2
- Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- 1
- Adobe ColdFusion
- 1
- Apache Software Foundation Apache Hive · Apache Software… +3
- 1
Critical 3
- CVE-2024-45387Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsApache Software Foundation Apache Traffic Control · gith… +1
- CVE-2024-46873Multiple SHARP routers leave the hidden debug function enabled.Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +4
- CVE-2024-40896In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if clibxml2
High 10
- CVE-2024-53961ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2024-56363APTRS has SSTI vulnerabilityAPTRS
- CVE-2024-56362Navidrome Stores JWT Secret in Plaintext in navidrome.dbnavidrome · github.com/navidrome/navidrome
- CVE-2024-55947Gogs has a Path Traversal in file update APIgogs · gogs.io/gogs
- CVE-2024-54148Gogs has a Path Traversal in file editing UIgogs · gogs.io/gogs
- CVE-2024-53256Rizin has a command injection via RzBinInfo bclass due legacy coderizinorg rizin
- CVE-2024-12903Incorrect default permissions in Biamp Evoko HomeBiamp Evoko Home Service
- CVE-2024-12902Global Wisdom Software ANCHOR - Undocumented Privileged AccountGlobal Wisdom Software ANCHOR
- CVE-2024-54082home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function.Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-54C
- CVE-2024-45721home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration scSharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +1
Medium, low and unrated 15
- CVE-2018-25106webuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injectionwebuidesigning NebulaX Theme
- CVE-2024-53276GHSL-2024-092: Open CORS policy in home-galleryxemle home-gallery
- CVE-2024-53275GHSL-2024-091: DNS rebinding attack in home-galleryxemle home-gallery
- CVE-2024-56364Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLExshuchkin simplexlsx · shuchkin/simplexlsx
- CVE-2024-56326Jinja has a sandbox breakout through indirect reference to format methodpallets jinja · jinja2
- CVE-2024-56201Jinja has a sandbox breakout through malicious filenamespallets jinja · jinja2
- CVE-2024-23945Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification failsApache Software Foundation Apache Hive · Apache Software… +3
- CVE-2024-55539Weak algorithm used to sign RPM package.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2024-11230Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widgetbrainstormforce Ultimate Addons for Elementor
- CVE-2024-12901FoxCMS API Endpoint Site.php improper authorizationFoxCMS
- CVE-2024-12900FoxCMS Configuration File installdb.php code injectionFoxCMS
- CVE-2024-128991000 Projects Attendance Tracking Management System course_action.php sql injection1000 Projects Attendance Tracking Management System
- CVE-2024-52321Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function.Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +4
- CVE-2024-47864home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function.Sharp home 5G HR02 · Sharp Wi-Fi STATION SH-52B +1
- CVE-2024-128981000 Projects Attendance Tracking Management System faculty_action.php sql injection1000 Projects Attendance Tracking Management System