# CVEs published 2024-12-24

60 CVEs were published on December 24, 2024: 2 critical, 15 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-2483](https://cve.now/CVE-2019-2483.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 8.2, Oracle iStore)
- [CVE-2022-21505](https://cve.now/CVE-2022-21505.md): In the linux kernel, if IMA appraisal is used with the "ima\_appraise=log" boot param, lockdown can be defeated with kexec on any machine whe (CVSS 6.7, Oracle Linux)
- [CVE-2024-12746](https://cve.now/CVE-2024-12746.md): SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0 (CVSS 8.6, Amazon Redshift ODBC Driver)
- [CVE-2024-12745](https://cve.now/CVE-2024-12745.md): SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4 (CVSS 8.6, Amazon Redshift Python Connector · redshift-connector)
- [CVE-2024-12744](https://cve.now/CVE-2024-12744.md): SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31 (CVSS 8.6, Amazon Redshift JDBC Driver · com.amazon.redshift:redshift-…)
- [CVE-2024-43441](https://cve.now/CVE-2024-43441.md): Apache HugeGraph-Server: Fixed JWT Token(Secret) (CVSS 9.8, Apache Software Foundation Apache HugeGraph-Server · org.ap…)
- [CVE-2024-53163](https://cve.now/CVE-2024-53163.md): crypto: qat/qat\_420xx - fix off by one in uof\_get\_name() (CVSS 5.5, Linux)
- [CVE-2024-53162](https://cve.now/CVE-2024-53162.md): crypto: qat/qat\_4xxx - fix off by one in uof\_get\_name() (CVSS 7.1, Linux)
- [CVE-2024-53161](https://cve.now/CVE-2024-53161.md): EDAC/bluefield: Fix potential integer overflow (CVSS 5.5, Linux)
- [CVE-2024-53160](https://cve.now/CVE-2024-53160.md): rcu/kvfree: Fix data-race in \_\_mod\_timer / kvfree\_call\_rcu (CVSS 4.7, Linux)
- [CVE-2024-53158](https://cve.now/CVE-2024-53158.md): soc: qcom: geni-se: fix array underflow in geni\_se\_clk\_tbl\_get() (CVSS 5.5, Linux)
- [CVE-2024-53157](https://cve.now/CVE-2024-53157.md): firmware: arm\_scpi: Check the DVFS OPP count returned by the firmware (CVSS 5.5, Linux)
- [CVE-2024-53156](https://cve.now/CVE-2024-53156.md): wifi: ath9k: add range check for conn\_rsp\_epid in htc\_connect\_service() (CVSS 7.8, Linux)
- [CVE-2024-53155](https://cve.now/CVE-2024-53155.md): ocfs2: fix uninitialized value in ocfs2\_file\_read\_iter() (CVSS 7.1, Linux)
- [CVE-2024-53154](https://cve.now/CVE-2024-53154.md): clk: clk-apple-nco: Add NULL check in applnco\_probe (CVSS 5.5, Linux)
- [CVE-2024-53153](https://cve.now/CVE-2024-53153.md): PCI: qcom-ep: Move controller cleanups to qcom\_pcie\_perst\_deassert() (no CVSS, Linux)
- [CVE-2024-53152](https://cve.now/CVE-2024-53152.md): PCI: tegra194: Move controller cleanups to pex\_ep\_event\_pex\_rst\_deassert() (no CVSS, Linux)
- [CVE-2024-53151](https://cve.now/CVE-2024-53151.md): svcrdma: Address an integer overflow (CVSS 7.5, Linux)
- [CVE-2024-53150](https://cve.now/CVE-2024-53150.md): ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVSS 7.1, KEV, Linux)
- [CVE-2024-53149](https://cve.now/CVE-2024-53149.md): usb: typec: ucsi: glink: fix off-by-one in connector\_status (no CVSS, Linux)
- [CVE-2024-53148](https://cve.now/CVE-2024-53148.md): comedi: Flush partial mappings in error case (CVSS 7.8, Linux)
- [CVE-2024-53147](https://cve.now/CVE-2024-53147.md): exfat: fix out-of-bounds access of directory entries (CVSS 7.8, Linux)
- [CVE-2024-53146](https://cve.now/CVE-2024-53146.md): NFSD: Prevent a potential integer overflow (CVSS 9.1, Linux)
- [CVE-2024-53145](https://cve.now/CVE-2024-53145.md): um: Fix potential integer overflow during physmem setup (CVSS 5.5, Linux)
- [CVE-2024-10856](https://cve.now/CVE-2024-10856.md): Booking Calendar WpDevArt \<= 3.2.19 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, wpdevart Booking calendar, Appointment Booking System)
- [CVE-2024-11726](https://cve.now/CVE-2024-11726.md): Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress \<= 1.1.21 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, reputeinfosystems Appointment Booking Calendar Plugin and S…)
- [CVE-2024-10584](https://cve.now/CVE-2024-10584.md): DirectoryPress \<= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 5.4, designinvento DirectoryPress – Business Directory And Class…)
- [CVE-2024-12268](https://cve.now/CVE-2024-12268.md): Responsive Blocks – WordPress Gutenberg Blocks \<= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cyberchimps Responsive Blocks – Page Builder for Blocks & P…)
- [CVE-2024-53241](https://cve.now/CVE-2024-53241.md): x86/xen: don't do PV iret hypercall through hypercall page (no CVSS, Linux)
- [CVE-2024-53240](https://cve.now/CVE-2024-53240.md): xen/netfront: fix crash when removing device (no CVSS, Linux)
- [CVE-2024-12881](https://cve.now/CVE-2024-12881.md): PlugVersions – Easily rollback to previous versions of your plugins \<= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation (CVSS 8.8, giuse PlugVersions – Easily roll back to previous versions…)
- [CVE-2024-12850](https://cve.now/CVE-2024-12850.md): Database Backup and check Tables Automated With Scheduler 2024 \<= 2.32 - Authenticated (Admin+) Arbitrary File Read (CVSS 4.9, sminozzi Database Backup and Table Integrity Check with Aut…)
- [CVE-2024-12031](https://cve.now/CVE-2024-12031.md): Advanced Floating Content \<= 3.8.2 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, CodeTides Advanced Floating Content)
- [CVE-2024-12103](https://cve.now/CVE-2024-12103.md): Content No Cache: prevent specific content from being cached \<= 0.1.2 - Unauthenticated Private Content Disclosure (CVSS 5.3, giuse Content No Cache | Serve uncached partial content eve…)
- [CVE-2024-8721](https://cve.now/CVE-2024-8721.md): Tracking Code Manager \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, data443 Tracking Code Manager)
- [CVE-2024-12468](https://cve.now/CVE-2024-12468.md): WP Datepicker \<= 2.1.4 - Reflected Cross-Site Scripting (CVSS 6.1, fahadmahmood WP Datepicker)
- [CVE-2024-11896](https://cve.now/CVE-2024-11896.md): Text Prompter – Unlimited chatgpt text prompts for openai tasks \<= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, flippercode Text Prompter – Unlimited chatgpt text prompts…)
- [CVE-2024-12814](https://cve.now/CVE-2024-12814.md): Loan Comparison \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, aerin Loan Comparison)
- [CVE-2024-12096](https://cve.now/CVE-2024-12096.md): Exhibit to WP Gallery \<= 0.0.2 - Reflected XSS (CVSS 6.1, Exhibit to WP Gallery)
- [CVE-2024-41882](https://cve.now/CVE-2024-41882.md): Stack based buffer overflow (CVSS 6.9, Hanwha Vision Co. XRN-420S)
- [CVE-2024-41883](https://cve.now/CVE-2024-41883.md): Null Pointer Dereference (CVSS 6.9, Hanwha Vision Co. XRN-420S)
- [CVE-2024-41884](https://cve.now/CVE-2024-41884.md): Null Pointer Dereference (CVSS 6.9, Hanwha Vision Co. XRN-420S)
- [CVE-2024-41885](https://cve.now/CVE-2024-41885.md): Hardcoding sensitive information (CVSS 5.6, Hanwha Vision Co. XRN-420S)
- [CVE-2024-41886](https://cve.now/CVE-2024-41886.md): Improper Input Validation (CVSS 6.9, Hanwha Vision Co. XRN-420S)
- [CVE-2024-12405](https://cve.now/CVE-2024-12405.md): Export Customers Data \<= 1.2.3 - Reflected Cross-Site Scripting (CVSS 6.1, fahadmahmood Export Customers Data)
- [CVE-2024-12100](https://cve.now/CVE-2024-12100.md): Bitcoin Lightning Publisher for WordPress \<= 1.4.1 - Reflected Cross-Site Scripting (CVSS 6.1, getalby Bitcoin Lightning Publisher for WordPress)
- [CVE-2024-12622](https://cve.now/CVE-2024-12622.md): WordPress Simple Shopping Cart \<= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mra13 Simple Shopping Cart)
- [CVE-2024-12594](https://cve.now/CVE-2024-12594.md): ALL In One Custom Login Page \<= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation (CVSS 8.8, zia-imtiaz Login Page Styler – Custom WordPress Login Page…)
- [CVE-2024-12210](https://cve.now/CVE-2024-12210.md): Print Invoice & Delivery Notes for WooCommerce \<= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion (CVSS 4.3, tychesoftwares Print Invoice & Delivery Notes for WooCommer…)
- [CVE-2024-11885](https://cve.now/CVE-2024-11885.md): NinjaTeam Chat for Telegram \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ninjateam WP Telegram Chat Widget)
- [CVE-2024-12034](https://cve.now/CVE-2024-12034.md): Advanced Google reCAPTCHA \<= 1.25 - Brute Force Protection IP Unblock (CVSS 5.3, webfactory Advanced Google reCAPTCHA)
- [CVE-2024-41887](https://cve.now/CVE-2024-41887.md): Arbitrary File Overwrite (CVSS 5.1, Hanwha Vision Co. XRN-420S)
- [CVE-2024-12617](https://cve.now/CVE-2024-12617.md): WC Price History for Omnibus \<= 2.1.3 - Missing Authorization (CVSS 5.4, kkarpieszuk WC Price History)
- [CVE-2024-12507](https://cve.now/CVE-2024-12507.md): Optio Dentistry \<= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Optio Dentistry)
- [CVE-2024-12518](https://cve.now/CVE-2024-12518.md): shMapper by Teplitsa \<= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, denischerniatev ShMapper by Teplitsa)
- [CVE-2024-12710](https://cve.now/CVE-2024-12710.md): WP-Appbox \<= 4.5.3 - Reflected Cross-Site Scripting (CVSS 6.1, marcelismus WP-Appbox)
- [CVE-2024-12266](https://cve.now/CVE-2024-12266.md): ELEX WooCommerce Dynamic Pricing and Discounts \<= 2.1.7 - Missing Authorization (CVSS 6.5, elextensions ELEX WooCommerce Dynamic Pricing and Discounts)
- [CVE-2024-12582](https://cve.now/CVE-2024-12582.md): Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service (CVSS 7.1, skupper · Red Hat Service Interconnect 1 for RHEL +1)
- [CVE-2024-47515](https://cve.now/CVE-2024-47515.md): Pagure: generate\_archive() follows symbolic links in temporary clones (CVSS 8.1, pagure)
- [CVE-2024-9427](https://cve.now/CVE-2024-9427.md): Koji: escape html tag characters in the query string (CVSS 5.4, koji)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.