CVEs published December 24, 2024
60 CVEs were published on December 24, 2024: 2 critical, 15 high. 1 is now in CISA KEV.
- Published
- 60
- Critical
- 2
- High
- 15
- Medium
- 38
- Low
- 0
- Unrated
- 5
- Now in CISA KEV
- 1
- Fix available
- 9
Most affected products
- Linux
- 20
- Hanwha Vision Co. XRN-420S
- 6
- aerin Loan Comparison
- 1
- Amazon Redshift JDBC Driver · com.amazon.redshift:redshift-…
- 1
- Amazon Redshift ODBC Driver
- 1
- Amazon Redshift Python Connector · redshift-connector
- 1
- Apache Software Foundation Apache HugeGraph-Server · org.ap…
- 1
- CodeTides Advanced Floating Content
- 1
- cyberchimps Responsive Blocks – Page Builder for Blocks & P…
- 1
- data443 Tracking Code Manager
- 1
Critical 2
High 15
- CVE-2019-2483Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).Oracle iStore
- CVE-2024-12746SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0Amazon Redshift ODBC Driver
- CVE-2024-12745SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4Amazon Redshift Python Connector · redshift-connector
- CVE-2024-12744SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31Amazon Redshift JDBC Driver · com.amazon.redshift:redshift-…
- CVE-2024-53162crypto: qat/qat_4xxx - fix off by one in uof_get_name()Linux
- CVE-2024-53156wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()Linux
- CVE-2024-53155ocfs2: fix uninitialized value in ocfs2_file_read_iter()Linux
- CVE-2024-53151svcrdma: Address an integer overflowLinux
- CVE-2024-53150ALSA: usb-audio: Fix out of bounds reads when finding clock sourcesLinux
- CVE-2024-53148comedi: Flush partial mappings in error caseLinux
- CVE-2024-53147exfat: fix out-of-bounds access of directory entriesLinux
- CVE-2024-12881PlugVersions – Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creationgiuse PlugVersions – Easily roll back to previous versions…
- CVE-2024-12594ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalationzia-imtiaz Login Page Styler – Custom WordPress Login Page…
- CVE-2024-12582Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of serviceskupper · Red Hat Service Interconnect 1 for RHEL +1
- CVE-2024-47515Pagure: generate_archive() follows symbolic links in temporary clonespagure
Medium, low and unrated 43
- CVE-2022-21505In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine wheOracle Linux
- CVE-2024-53163crypto: qat/qat_420xx - fix off by one in uof_get_name()Linux
- CVE-2024-53161EDAC/bluefield: Fix potential integer overflowLinux
- CVE-2024-53160rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcuLinux
- CVE-2024-53158soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()Linux
- CVE-2024-53157firmware: arm_scpi: Check the DVFS OPP count returned by the firmwareLinux
- CVE-2024-53154clk: clk-apple-nco: Add NULL check in applnco_probeLinux
- CVE-2024-53153PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()Linux
- CVE-2024-53152PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()Linux
- CVE-2024-53149usb: typec: ucsi: glink: fix off-by-one in connector_statusLinux
- CVE-2024-53145um: Fix potential integer overflow during physmem setupLinux
- CVE-2024-10856Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injectionwpdevart Booking calendar, Appointment Booking System
- CVE-2024-11726Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injectionreputeinfosystems Appointment Booking Calendar Plugin and S…
- CVE-2024-10584DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scriptingdesigninvento DirectoryPress – Business Directory And Class…
- CVE-2024-12268Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingcyberchimps Responsive Blocks – Page Builder for Blocks & P…
- CVE-2024-53241x86/xen: don't do PV iret hypercall through hypercall pageLinux
- CVE-2024-53240xen/netfront: fix crash when removing deviceLinux
- CVE-2024-12850Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Readsminozzi Database Backup and Table Integrity Check with Aut…
- CVE-2024-12031Advanced Floating Content <= 3.8.2 - Authenticated (Subscriber+) SQL InjectionCodeTides Advanced Floating Content
- CVE-2024-12103Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosuregiuse Content No Cache | Serve uncached partial content eve…
- CVE-2024-8721Tracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingdata443 Tracking Code Manager
- CVE-2024-12468WP Datepicker <= 2.1.4 - Reflected Cross-Site Scriptingfahadmahmood WP Datepicker
- CVE-2024-11896Text Prompter – Unlimited chatgpt text prompts for openai tasks <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingflippercode Text Prompter – Unlimited chatgpt text prompts…
- CVE-2024-12814Loan Comparison <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingaerin Loan Comparison
- CVE-2024-12096Exhibit to WP Gallery <= 0.0.2 - Reflected XSSExhibit to WP Gallery
- CVE-2024-41882Stack based buffer overflowHanwha Vision Co. XRN-420S
- CVE-2024-41883Null Pointer DereferenceHanwha Vision Co. XRN-420S
- CVE-2024-41884Null Pointer DereferenceHanwha Vision Co. XRN-420S
- CVE-2024-41885Hardcoding sensitive informationHanwha Vision Co. XRN-420S
- CVE-2024-41886Improper Input ValidationHanwha Vision Co. XRN-420S
- CVE-2024-12405Export Customers Data <= 1.2.3 - Reflected Cross-Site Scriptingfahadmahmood Export Customers Data
- CVE-2024-12100Bitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scriptinggetalby Bitcoin Lightning Publisher for WordPress
- CVE-2024-12622WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingmra13 Simple Shopping Cart
- CVE-2024-12210Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletiontychesoftwares Print Invoice & Delivery Notes for WooCommer…
- CVE-2024-11885NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingninjateam WP Telegram Chat Widget
- CVE-2024-12034Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblockwebfactory Advanced Google reCAPTCHA
- CVE-2024-41887Arbitrary File OverwriteHanwha Vision Co. XRN-420S
- CVE-2024-12617WC Price History for Omnibus <= 2.1.3 - Missing Authorizationkkarpieszuk WC Price History
- CVE-2024-12507Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingOptio Dentistry
- CVE-2024-12518shMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scriptingdenischerniatev ShMapper by Teplitsa
- CVE-2024-12710WP-Appbox <= 4.5.3 - Reflected Cross-Site Scriptingmarcelismus WP-Appbox
- CVE-2024-12266ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorizationelextensions ELEX WooCommerce Dynamic Pricing and Discounts
- CVE-2024-9427Koji: escape html tag characters in the query stringkoji