Skip to content
OpenAdvisories

Archive

2 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /2 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.8
    CVE-2018-9430

    In prop2cfg of btif_storage.cc, there is a possible out of bounds write due to an incorrect bounds check. This could le…

    Google Android Android
  • Critical —
    GHSA-q849-wxrc-vqrp

    hull.js Code Injection Vulnerability

    Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of `new Function(...)` in the module that handles points format. Applications passing the 3rd parameter to the `hull` function without sanitising ma…

    hull.js npm
  • Critical 9.2
    CVE-2024-53990

    AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace e…

    AsyncHttpClient async-http-client thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Critical 10.0
    CVE-2024-10905

    IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability

    IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ applicat…

    SailPoint IdentityIQ
  • Critical 9.8
    CVE-2024-8785

    WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.

    Progress Software WhatsUp Gold
  • Critical 9.8
    CVE-2024-46909 EPSS 49%

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account.

    Progress Software WhatsUp Gold
  • Critical 10.0
    CVE-2024-52476

    WordPress Fediverse Embeds plugin <= 1.5.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Stefan Bohacek Fediverse Embeds fediverse-embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through <= 1.5.3.

    Stefan Bohacek Fediverse Embeds
  • Critical 9.8
    CVE-2024-53477

    JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.j…

  • Critical 9.1
    CVE-2024-53900 Public exploit Scanner template

    Mongoose search injection vulnerability

    Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.

    mongoose npm
  • Critical 9.8
    CVE-2024-52724

    ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php.

  • Critical 9.1
    CVE-2024-52732

    Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system be…