CVEs published December 31, 2024
105 CVEs were published on December 31, 2024: 17 critical, 35 high.
- Published
- 105
- Critical
- 17
- High
- 35
- Medium
- 53
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- PHPGurukul Land Record System
- 12
- Trend Micro Apex One
- 7
- VibeThemes WPLMS
- 5
- azzaroco WP SuperBackup
- 4
- DeluxeThemes Userpro
- 4
- Progress Software WhatsUp Gold
- 3
- VibeThemes VibeBP
- 3
- WP Royal Royal Elementor Addons
- 3
- Changing Information Technology CGFIDO
- 2
- CodeAstro Online Food Ordering System
- 2
Critical 17
- CVE-2024-56198path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerabilitycabraviva path-sanitizer · path-sanitizer
- CVE-2024-56066WordPress Agency Toolkit plugin <= 1.0.23 - Privilege Escalation vulnerabilityinspry Agency Toolkit
- CVE-2024-56045WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerabilityVibeThemes WPLMS
- CVE-2024-56044WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerabilityVibeThemes WPLMS
- CVE-2024-56043WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerabilityVibeThemes WPLMS
- CVE-2024-56040WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerabilityVibeThemes VibeBP
- CVE-2024-56042WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerabilityVibeThemes WPLMS
- CVE-2024-56039WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerabilityVibeThemes VibeBP
- CVE-2024-56064WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerabilityazzaroco WP SuperBackup
- CVE-2024-56046WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerabilityVibeThemes WPLMS
- CVE-2024-56071WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerabilitymikeleembruggen Simple Dashboard
- CVE-2024-56205WordPress AI Magic – SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation vulnerabilitySunnyKai AI Magic
- CVE-2024-130612100 Technology Electronic Official Document Management System - Authentication Bypass2100 Technology Electronic Official Document Management Sys…
- CVE-2024-12106WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authenticationProgress Software WhatsUp Gold
- CVE-2024-12108WhatsUp Gold - Public API signing key rotation issueProgress Software WhatsUp Gold
- CVE-2024-56220WordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerabilitysslplugins SSL Wireless SMS Notification
- CVE-2024-11972Hunk Companion < 1.9.0 - Unauthenticated Plugin InstallationHunk Companion
High 35
- CVE-2024-55917An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatioTrend Micro Apex One
- CVE-2024-55632A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalTrend Micro Apex One
- CVE-2024-55631An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installationsTrend Micro Apex One
- CVE-2024-52050A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected inTrend Micro Apex One
- CVE-2024-52049A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatioTrend Micro Apex One
- CVE-2024-52048A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatioTrend Micro Apex One
- CVE-2024-52047A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected instTrend Micro Apex One
- CVE-2024-56802Tapir allows DeployKey exposurePacoVK tapir
- CVE-2024-25133Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalationopenshift-hive · github.com/openshift/hive
- CVE-2023-6603Ffmpeg: null pointer dereference in ffmpeg hls parsingFFmpeg
- CVE-2024-56070WordPress WP SuperBackup plugin <= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilitiesazzaroco WP SuperBackup
- CVE-2024-56207WordPress EditionGuard for WooCommerce – eBook Sales with DRM plugin <= 3.4.2 - CSRF to Privilege Escalation vulnerabilityEditionGuard for WooCommerce – eBook Sales with DRM
- CVE-2024-56206WordPress gap-hub-user-role. plugin <= 3.4.1 - CSRF to Broken Authentication vulnerabilitykrishankakkar gap-hub-user-role
- CVE-2024-56204WordPress Sinking Dropdowns plugin <= 1.25 - CSRF to Privilege Escalation vulnerabilityyonisink Sinking Dropdowns
- CVE-2024-56203WordPress Wayne Audio Player plugin <= 1.0 - CSRF to Privilege Escalation vulnerabilitygholme4 Wayne Audio Player
- CVE-2024-56061WordPress RepairBuddy plugin <= 3.8119 - Account Takeover vulnerabilityAteeq Rafeeq RepairBuddy
- CVE-2024-56041WordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerabilityVibeThemes VibeBP
- CVE-2024-56068WordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerabilityazzaroco WP SuperBackup
- CVE-2024-56067WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerabilityazzaroco WP SuperBackup
- CVE-2024-56209WordPress Kleo theme < 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilitySeventhQueen Kleo
- CVE-2024-56210WordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityDeluxeThemes Userpro
- CVE-2024-56223WordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerabilityFahad Mahmood Gulri Slider
- CVE-2024-56226WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Royal Royal Elementor Addons
- CVE-2024-56228WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityWPFactory Wishlist for WooCommerce
- CVE-2024-56233WordPress Kintpv Wooconnect plugin <= 8.129 - Cross Site Scripting (XSS) vulnerabilitykinhelios KinTPV WooConnect
- CVE-2024-56265WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerabilitywpweb WooCommerce PDF Vouchers
- CVE-2024-56232WordPress WP Nice Loader plugin <= 0.1.0.4 - CSRF to Stored XSS vulnerabilityAlex Volkov WP Nice Loader
- CVE-2024-56212WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerabilityDeluxeThemes Userpro
- CVE-2024-56211WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerabilityDeluxeThemes Userpro
- CVE-2024-56214WordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerabilityDeluxeThemes Userpro
- CVE-2024-56230WordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerabilityMaidul Dynamic Product Category Grid, Slider for WooCommerce
- CVE-2024-45497Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentialsopenshift · Red Hat OpenShift Container Platform +1
- CVE-2024-13040Quanta Computer QOCA aim - Authorization BypassQuanta Computer QOCA aim
- CVE-2024-12839Changing Information Technology CGFIDO - Authentication BypassChanging Information Technology CGFIDO
- CVE-2024-12838Changing Information Technology CGFIDO - Authentication BypassChanging Information Technology CGFIDO
Medium, low and unrated 53
- CVE-2024-56020WordPress SvegliaT Buttons Plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitysvegliadesign SvegliaT Buttons
- CVE-2024-56021WordPress Category Post Shortcode Plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityibnuyahya Category Post Shortcode
- CVE-2024-56062WordPress Royal Elementor Addons and Templates plugin <= 1.3.987 - Cross Site Scripting (XSS) vulnerabilityWP Royal Royal Elementor Addons
- CVE-2024-56063WordPress Essential Addons for Elementor plugin <= 6.0.7 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2024-56803Ghostty improperly handles window title sequences which can lead to arbitrary command executionghostty-org ghostty
- CVE-2024-13085PHPGurukul Land Record System login.php sql injectionPHPGurukul Land Record System
- CVE-2024-13084PHPGurukul Land Record System search-property.php sql injectionPHPGurukul Land Record System
- CVE-2024-13083PHPGurukul Land Record System admin-profile.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-13082PHPGurukul Land Record System search-property.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-13081PHPGurukul Land Record System contactus.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-13080PHPGurukul Land Record System aboutus.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-13079PHPGurukul Land Record System property-details.php sql injectionPHPGurukul Land Record System
- CVE-2024-13078PHPGurukul Land Record System index.php sql injectionPHPGurukul Land Record System
- CVE-2024-13077PHPGurukul Land Record System add-property.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-13076PHPGurukul Land Record System edit-propertytype.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-13075PHPGurukul Land Record System add-propertytype.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-13074PHPGurukul Land Record System index.php cross site scriptingPHPGurukul Land Record System
- CVE-2024-55955An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 couTrend Micro Deep Security
- CVE-2024-53647Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email veTrend Micro ID Security
- CVE-2024-130721000 Projects Beauty Parlour Management System Customer Detail add-customer-services.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-13070CodeAstro Online Food Ordering System Update User Page update_users.php sql injectionCodeAstro Online Food Ordering System
- CVE-2023-6602Ffmpeg: improper handling of input format in tty demuxer of ffmpegFFmpeg
- CVE-2024-49686WordPress Landing Page Cat plugin <= 1.7.4 - Broken Access Control vulnerabilityfatcatapps Landing Page Cat
- CVE-2024-49687WordPress Smart Manager plugin <= 8.45.0 - Broken Access Control vulnerabilitystoreapps Smart Manager
- CVE-2024-49694WordPress My Wp Brand – Hide menu & Hide Plugin plugin <= 1.1.2 - Broken Access Control vulnerabilityimw3 My Wp Brand
- CVE-2024-49698WordPress Great Restaurant Menu WP plugin <= 1.4.2 - Broken Access Control vulnerabilityBest Restaurant Menu by PriceListo
- CVE-2024-51667WordPress paytium plugin <= 4.4.10 - Broken Access Control vulnerabilitypaytiumsupport Paytium
- CVE-2024-55995WordPress Torod plugin <= 1.7 - Settings Change vulnerabilityTorod Company for Information Technology Torod
- CVE-2024-56002WordPress Contact Form, Survey & Form Builder – MightyForms plugin <= 1.3.9 - Broken Access Control vulnerabilityContact Form, Survey & Form Builder – MightyForms
- CVE-2024-55991WordPress CRM Plugin – WP-CRM System plugin <= 3.2.9.1 - Broken Access Control vulnerabilityMario Peshev WP-CRM System
- CVE-2024-56031WordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerabilityYulio Aleman Jimenez Smart Shopify Product
- CVE-2023-48775WordPress WP CleanFix plugin <= 5.6.2 - Broken Access Control vulnerabilityGfazioli WP Cleanfix
- CVE-2023-50850WordPress Woo Subscriptions plugin < 5.8.0 - Broken Access Control vulnerabilityWooCommerce Subscriptions
- CVE-2024-13069SourceCodester Multi Role Login System add-user.php cross site scriptingSourceCodester Multi Role Login System
- CVE-2024-12105WhatsUp Gold - SnmpExtendedActiveMonitor path traversalProgress Software WhatsUp Gold
- CVE-2024-56221WordPress WPMozo Addons Lite for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityElicus WPMozo Addons Lite for Elementor
- CVE-2024-56224WordPress Ledenbeheer plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityLedenbeheer
- CVE-2024-56231WordPress SaasPricing plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityDebuggers Studio SaasPricing
- CVE-2024-56234WordPress VW Automobile Lite theme <= 2.1 - Broken Access Control vulnerabilityvowelweb VW Automobile Lite
- CVE-2024-56227WordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerabilityWP Royal Royal Elementor Addons
- CVE-2024-56225WordPress Premium Addons for Elementor plugin <= 4.10.56 - Broken Access Control vulnerabilityLeap13 Premium Addons for Elementor
- CVE-2024-56219WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerabilityMarketing Fire Widget Options
- CVE-2024-56217WordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerabilityShahjada Download Manager
- CVE-2024-56215WordPress Member Directory and Contact Form plugin <= 1.7.0 - Broken Access Control vulnerabilityDBAR Productions Member Directory and Contact Form
- CVE-2024-56235WordPress Coupon plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityVicky Kumar Coupon
- CVE-2024-56256WordPress Embed PDF Viewer plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerabilityAndy Fragen Embed PDF Viewer
- CVE-2024-56218WordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerabilitysevenspark Contact Form 7 – Dynamic Text Extension
- CVE-2024-56222WordPress CodeBard Help Desk plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerabilityCodeBard Help Desk
- CVE-2024-56229WordPress SearchIQ plugin <= 4.6 - Cross-Site Requst Forgery (CSRF) vulnerabilitySearchIQ
- CVE-2024-56213WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerabilityArraytics Eventin
- CVE-2024-56216WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerabilitythemifyme Themify Builder
- CVE-2024-13067CodeAstro Online Food Ordering System All Users Page all_users.php access controlCodeAstro Online Food Ordering System
- CVE-2024-49422Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by haSamsung Mobile Devices