# CVEs published 2024-12-30

57 CVEs were published on December 30, 2024: 5 critical, 25 high. Days are UTC.

- [CVE-2024-13058](https://cve.now/CVE-2024-13058.md): Authenticated, non-admin users can create storage pools via the sifi API (CVSS 4.8, SoftIron HyperCloud)
- [CVE-2024-13042](https://cve.now/CVE-2024-13042.md): Tsinghua Unigroup Electronic Archives Management System download.html download information disclosure (CVSS 5.3, Tsinghua Unigroup Electronic Archives Management System)
- [CVE-2024-13051](https://cve.now/CVE-2024-13051.md): Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2024-13050](https://cve.now/CVE-2024-13050.md): Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2024-13049](https://cve.now/CVE-2024-13049.md): Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2024-13048](https://cve.now/CVE-2024-13048.md): Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2024-13047](https://cve.now/CVE-2024-13047.md): Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2024-13046](https://cve.now/CVE-2024-13046.md): Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2024-13045](https://cve.now/CVE-2024-13045.md): Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2024-13044](https://cve.now/CVE-2024-13044.md): Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2024-12753](https://cve.now/CVE-2024-12753.md): Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability (CVSS 6.7, Foxit PDF Reader)
- [CVE-2024-12752](https://cve.now/CVE-2024-12752.md): Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-12751](https://cve.now/CVE-2024-12751.md): Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-13043](https://cve.now/CVE-2024-13043.md): Panda Security Dome Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Panda Security Dome)
- [CVE-2024-11946](https://cve.now/CVE-2024-11946.md): iXsystems TrueNAS CORE fetch\_plugin\_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability (CVSS 3.1, iXsystems TrueNAS CORE)
- [CVE-2024-11944](https://cve.now/CVE-2024-11944.md): iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability (CVSS 7.5, iXsystems TrueNAS CORE)
- [CVE-2024-56800](https://cve.now/CVE-2024-56800.md): Firecrawl has SSRF Vulnerability via malicious scrape target (CVSS 7.4, mendableai firecrawl)
- [CVE-2024-56799](https://cve.now/CVE-2024-56799.md): Simofa Allows Unauthenticated Access to API Routes (CVSS 10.0, TrueWinter simofa)
- [CVE-2024-56801](https://cve.now/CVE-2024-56801.md): Tasklists has Blind SQL Injection in /ajax/reorder.php (CVSS 6.9, InfotelGLPI tasklists)
- [CVE-2024-12754](https://cve.now/CVE-2024-12754.md): AnyDesk Link Following Information Disclosure Vulnerability (CVSS 5.5, AnyDesk)
- [CVE-2024-12836](https://cve.now/CVE-2024-12836.md): Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics DRASimuCAD)
- [CVE-2024-12835](https://cve.now/CVE-2024-12835.md): Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics DRASimuCAD)
- [CVE-2024-12834](https://cve.now/CVE-2024-12834.md): Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Delta Electronics DRASimuCAD)
- [CVE-2024-56734](https://cve.now/CVE-2024-56734.md): Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint (CVSS 7.9, better-auth)
- [CVE-2024-12828](https://cve.now/CVE-2024-12828.md): Webmin CGI Command Injection Remote Code Execution Vulnerability (CVSS 9.9, Webmin)
- [CVE-2024-56733](https://cve.now/CVE-2024-56733.md): Password Pusher Allows Session Token Interception Leading to Potential Hijacking (CVSS 5.7, pglombardo PasswordPusher · pwpush)
- [CVE-2024-56517](https://cve.now/CVE-2024-56517.md): LGSL has a reflected XSS at /lgsl\_files/lgsl\_list.php (CVSS 5.3, tltneon lgsl · tltneon/lgsl)
- [CVE-2024-56516](https://cve.now/CVE-2024-56516.md): free-one-api uses md5 for password storage (CVSS 6.9, RockChinQ free-one-api)
- [CVE-2024-52294](https://cve.now/CVE-2024-52294.md): khoj has an IDOR in subscription management that allows unauthorized subscription modifications (CVSS 4.3, khoj-ai khoj · khoj)
- [CVE-2024-54181](https://cve.now/CVE-2024-54181.md): IBM WebSphere Automation command injection (CVSS 7.2, IBM WebSphere Automation)
- [CVE-2024-10044](https://cve.now/CVE-2024-10044.md): SSRF in POST /worker\_generate\_stream API endpoint in lm-sys/fastchat (CVSS 9.3, lm-sys/fastchat)
- [CVE-2024-12993](https://cve.now/CVE-2024-12993.md): Location information exposure in Infinix Weather app (CVSS 4.8, Infinix Mobile com.rlk.weathers)
- [CVE-2024-47926](https://cve.now/CVE-2024-47926.md): Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVSS 9.8, Tecnick TCExam)
- [CVE-2024-47925](https://cve.now/CVE-2024-47925.md): Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 7.5, Tecnick TCExam)
- [CVE-2024-47924](https://cve.now/CVE-2024-47924.md): Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 7.5, Boa web)
- [CVE-2024-47923](https://cve.now/CVE-2024-47923.md): Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, Mashov)
- [CVE-2024-47922](https://cve.now/CVE-2024-47922.md): Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, Priority PRI WEB)
- [CVE-2024-47921](https://cve.now/CVE-2024-47921.md): Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm (CVSS 8.4, Smadar SPS)
- [CVE-2024-47920](https://cve.now/CVE-2024-47920.md): Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 7.5, Tiki Wiki CMS)
- [CVE-2024-47919](https://cve.now/CVE-2024-47919.md): Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVSS 9.8, Tiki Wiki CMS)
- [CVE-2024-47918](https://cve.now/CVE-2024-47918.md): Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVSS 6.1, Tiki Wiki CMS)
- [CVE-2024-47917](https://cve.now/CVE-2024-47917.md): Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 7.5, Mobotix CCTV FW)
- [CVE-2024-22063](https://cve.now/CVE-2024-22063.md): ZTE ZENIC ONE R58 product has a CSV injection vulnerability (CVSS 7.6, ZTE ZENIC ONE R58)
- [CVE-2024-13039](https://cve.now/CVE-2024-13039.md): code-projects Simple Chat System add\_user.php sql injection (CVSS 5.3, code-projects Simple Chat System)
- [CVE-2024-13038](https://cve.now/CVE-2024-13038.md): CodeAstro Simple Loan Management System Login index.php sql injection (CVSS 6.9, CodeAstro Simple Loan Management System)
- [CVE-2024-13037](https://cve.now/CVE-2024-13037.md): 1000 Projects Attendance Tracking Management System report.php attendance\_report sql injection (CVSS 5.3, 1000 Projects Attendance Tracking Management System)
- [CVE-2024-13036](https://cve.now/CVE-2024-13036.md): code-projects Chat System update\_room.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2024-13035](https://cve.now/CVE-2024-13035.md): code-projects Chat System update\_user.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2024-13034](https://cve.now/CVE-2024-13034.md): code-projects Chat System update\_user.php cross site scripting (CVSS 5.3, code-projects Chat System)
- [CVE-2024-13033](https://cve.now/CVE-2024-13033.md): code-projects Chat System chatroom.php cross site scripting (CVSS 5.3, code-projects Chat System)
- [CVE-2024-13032](https://cve.now/CVE-2024-13032.md): Antabot White-Jotter Article Editor editor server-side request forgery (CVSS 5.1, Antabot White-Jotter)
- [CVE-2024-13031](https://cve.now/CVE-2024-13031.md): Antabot White-Jotter Article Content Editor editor cross site scripting (CVSS 5.1, Antabot White-Jotter)
- [CVE-2024-13030](https://cve.now/CVE-2024-13030.md): D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control (CVSS 6.9, D-Link DIR-823G)
- [CVE-2024-46542](https://cve.now/CVE-2024-46542.md): Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks. (CVSS 6.5, Veritas Data Insight)
- [CVE-2024-50701](https://cve.now/CVE-2024-50701.md): TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user (CVSS 4.3, TeamPass · nilsteampassnet/teampass)
- [CVE-2024-50702](https://cve.now/CVE-2024-50702.md): TeamPass before 3.1.3.1 does not properly check whether a mail\_me (aka action\_mail) operation is on behalf of an administrator or manager. (CVSS 5.4, TeamPass · nilsteampassnet/teampass)
- [CVE-2024-50703](https://cve.now/CVE-2024-50703.md): TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user\_id. (CVSS 5.4, TeamPass · nilsteampassnet/teampass)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.