CVEs published December 30, 2024
57 CVEs were published on December 30, 2024: 5 critical, 25 high.
- Published
- 57
- Critical
- 5
- High
- 25
- Medium
- 26
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Ashlar-Vellum Cobalt
- 6
- code-projects Chat System
- 4
- Delta Electronics DRASimuCAD
- 3
- Foxit PDF Reader
- 3
- TeamPass · nilsteampassnet/teampass
- 3
- Tiki Wiki CMS
- 3
- Antabot White-Jotter
- 2
- Ashlar-Vellum Graphite
- 2
- iXsystems TrueNAS CORE
- 2
- Tecnick TCExam
- 2
Critical 5
- CVE-2024-56799Simofa Allows Unauthenticated Access to API RoutesTrueWinter simofa
- CVE-2024-12828Webmin CGI Command Injection Remote Code Execution VulnerabilityWebmin
- CVE-2024-10044SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchatlm-sys/fastchat
- CVE-2024-47926Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Tecnick TCExam
- CVE-2024-47919Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Tiki Wiki CMS
High 25
- CVE-2024-13051Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2024-13050Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2024-13049Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2024-13048Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2024-13047Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2024-13046Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2024-13045Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2024-13044Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2024-12752Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-12751Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-13043Panda Security Dome Link Following Local Privilege Escalation VulnerabilityPanda Security Dome
- CVE-2024-11944iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution VulnerabilityiXsystems TrueNAS CORE
- CVE-2024-56800Firecrawl has SSRF Vulnerability via malicious scrape targetmendableai firecrawl
- CVE-2024-12836Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution VulnerabilityDelta Electronics DRASimuCAD
- CVE-2024-12835Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityDelta Electronics DRASimuCAD
- CVE-2024-12834Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution VulnerabilityDelta Electronics DRASimuCAD
- CVE-2024-56734Better Auth has an Open Redirect Vulnerability in Verify Email Endpointbetter-auth
- CVE-2024-54181IBM WebSphere Automation command injectionIBM WebSphere Automation
- CVE-2024-47925Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Tecnick TCExam
- CVE-2024-47924Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Boa web
- CVE-2024-47922Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorPriority PRI WEB
- CVE-2024-47921Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic AlgorithmSmadar SPS
- CVE-2024-47920Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Tiki Wiki CMS
- CVE-2024-47917Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Mobotix CCTV FW
- CVE-2024-22063ZTE ZENIC ONE R58 product has a CSV injection vulnerabilityZTE ZENIC ONE R58
Medium, low and unrated 27
- CVE-2024-13058Authenticated, non-admin users can create storage pools via the sifi APISoftIron HyperCloud
- CVE-2024-13042Tsinghua Unigroup Electronic Archives Management System download.html download information disclosureTsinghua Unigroup Electronic Archives Management System
- CVE-2024-12753Foxit PDF Reader Link Following Local Privilege Escalation VulnerabilityFoxit PDF Reader
- CVE-2024-11946iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information VulnerabilityiXsystems TrueNAS CORE
- CVE-2024-56801Tasklists has Blind SQL Injection in /ajax/reorder.phpInfotelGLPI tasklists
- CVE-2024-12754AnyDesk Link Following Information Disclosure VulnerabilityAnyDesk
- CVE-2024-56733Password Pusher Allows Session Token Interception Leading to Potential Hijackingpglombardo PasswordPusher · pwpush
- CVE-2024-56517LGSL has a reflected XSS at /lgsl_files/lgsl_list.phptltneon lgsl · tltneon/lgsl
- CVE-2024-56516free-one-api uses md5 for password storageRockChinQ free-one-api
- CVE-2024-52294khoj has an IDOR in subscription management that allows unauthorized subscription modificationskhoj-ai khoj · khoj
- CVE-2024-12993Location information exposure in Infinix Weather appInfinix Mobile com.rlk.weathers
- CVE-2024-47923Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorMashov
- CVE-2024-47918Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)Tiki Wiki CMS
- CVE-2024-13039code-projects Simple Chat System add_user.php sql injectioncode-projects Simple Chat System
- CVE-2024-13038CodeAstro Simple Loan Management System Login index.php sql injectionCodeAstro Simple Loan Management System
- CVE-2024-130371000 Projects Attendance Tracking Management System report.php attendance_report sql injection1000 Projects Attendance Tracking Management System
- CVE-2024-13036code-projects Chat System update_room.php sql injectioncode-projects Chat System
- CVE-2024-13035code-projects Chat System update_user.php sql injectioncode-projects Chat System
- CVE-2024-13034code-projects Chat System update_user.php cross site scriptingcode-projects Chat System
- CVE-2024-13033code-projects Chat System chatroom.php cross site scriptingcode-projects Chat System
- CVE-2024-13032Antabot White-Jotter Article Editor editor server-side request forgeryAntabot White-Jotter
- CVE-2024-13031Antabot White-Jotter Article Content Editor editor cross site scriptingAntabot White-Jotter
- CVE-2024-13030D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access controlD-Link DIR-823G
- CVE-2024-46542Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks.Veritas Data Insight
- CVE-2024-50701TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a userTeamPass · nilsteampassnet/teampass
- CVE-2024-50702TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.TeamPass · nilsteampassnet/teampass
- CVE-2024-50703TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.TeamPass · nilsteampassnet/teampass