CVEs published December 25, 2024
28 CVEs were published on December 25, 2024: 4 critical, 6 high.
- Published
- 28
- Critical
- 4
- High
- 6
- Medium
- 16
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Dell NativeEdge
- 3
- IBM Engineering Insights
- 2
- 1000 Projects Attendance Tracking Management System
- 1
- Apache Software Foundation Apache MINA · org.apache.mina:mi…
- 1
- Arne Informatics Piramit Automation
- 1
- bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- 1
- code-projects Simple Admin Panel
- 1
- Codezips Project Management System
- 1
- Dell ECS
- 1
- Dell SupportAssist for Home PCs · Dell SupportAssist for Bu…
- 1
Critical 4
- CVE-2024-8950SQLi in Arne Informatics' Piramit AutomationArne Informatics Piramit Automation
- CVE-2024-52046Apache MINA: MINA applications using unbounded deserialization may allow RCEApache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2024-11281WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email ChangeWebkul WooCommerce Point of Sale
- CVE-2024-56431oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.
High 6
- CVE-2024-53291Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability.Dell NativeEdge
- CVE-2024-47978Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Execution with Unnecessary Privileges vulnerability.Dell NativeEdge
- CVE-2024-52535Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symboliDell SupportAssist for Home PCs · Dell SupportAssist for Bu…
- CVE-2024-12428WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injectionpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2024-12272WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusionwptravelengine WP Travel Engine – Elementor Widgets | Creat…
- CVE-2024-1609OPPO Store APP has a WebView component privilege escalation vulnerability.OPPO OPPP Store
Medium, low and unrated 18
- CVE-2024-12928code-projects Simple Admin Panel sql injectioncode-projects Simple Admin Panel
- CVE-2024-129271000 Projects Attendance Tracking Management System check_faculty_login.php sql injection1000 Projects Attendance Tracking Management System
- CVE-2024-12926Codezips Project Management System advanced.php sql injectionCodezips Project Management System
- CVE-2024-52534Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability.Dell ECS
- CVE-2024-52543Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability.Dell NativeEdge
- CVE-2024-52906IBM AIX denial of serviceIBM AIX
- CVE-2024-47102IBM AIX denial of serviceIBM AIX · IBM VIOS
- CVE-2023-5117Exposure of Sensitive Information Due to Incompatible Policies in GitLabGitLab
- CVE-2024-39727IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbingIBM Engineering Insights
- CVE-2024-39725IBM Engineering Lifecycle Optimization - Engineering Insights information disclosureIBM Engineering Insights
- CVE-2024-10862NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injectionwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2024-12335Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosurethemefusion Avada (Fusion) Builder
- CVE-2024-10858Jetpack 13.0-14.0 - Unauthenticated DOM-XSSJetpack
- CVE-2024-12636Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.2.7 - Cross-Site Request Forgerywplegalpages Privacy Policy Generator – WPLP Legal Pages
- CVE-2024-12190Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosurebitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- CVE-2024-12413MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorizationwebwizardsdev MarketKing — Ultimate WooCommerce Multivendor…
- CVE-2024-12032Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injectionthemefic Tourfic – Travel Booking, Hotel Booking & Car Rent…
- CVE-2024-56430OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp.OpenFHE