Skip to content
OpenAdvisories

Archive

9 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /9 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

28 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-55638

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable whe…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2024-55637

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2024-55636

    Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2024-8259

    Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: throug…

    Eryaz Information Technologies NatraCar B2B Dealer Management Program
  • Critical 9.3
    CVE-2024-54215

    WordPress Revy plugin <= 1.18 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a through <= 1.18.

    roninwp Revy
  • Critical 10.0
    CVE-2024-53822

    WordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.

    Genetech Solutions Pie Register Premium
  • Critical 9.8
    CVE-2024-43222

    WordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerability

    Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3.

    SeventhQueen Sweet Date
  • Critical 9.8
    CVE-2023-32117 Public exploit Scanner template

    WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.

    SoftLab Integrate Google Drive
  • Critical 9.8
    CVE-2022-38947

    SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers…

  • Critical 9.8
    CVE-2022-38946

    Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to …

  • Critical 9.8
    CVE-2024-55564

    The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.

    libposix-2008-perl libposix-2008-perl Debian Ubuntu
  • Critical 9.1
    CVE-2024-53441

    Bit flip attack vulnerability in cookie-encrypter

    An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.

    cookie-encrypter npm
  • Critical 9.8
    CVE-2024-48956

    Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially craf…

  • Critical 9.8
    CVE-2024-46455

    unstructured XML External Entity (XXE)

    unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.

    unstructured github.com/Unstructured-IO/unstructured PyPI Go
  • Critical 9.1
    CVE-2024-40583

    Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.

  • Critical 9.8
    CVE-2024-54920

    A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which al…

  • Critical 9.8
    CVE-2024-54930

    Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php.

  • Critical 9.8
    CVE-2024-54925

    A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remo…

  • Critical 9.8
    CVE-2024-54921

    A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote at…

  • Critical 9.8
    CVE-2024-54934

    Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php.

  • Critical 9.8
    CVE-2024-54932

    Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php.

  • Critical 9.8
    CVE-2024-54923

    A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, whic…

  • Critical 9.8
    CVE-2024-54918

    Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.p…

  • Critical 9.8
    CVE-2024-54926

    A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allo…

  • Critical 9.8
    CVE-2024-54924

    A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remot…

  • Critical 9.8
    CVE-2024-54933

    Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php.

  • Critical 9.8
    CVE-2024-54922

    A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote a…

  • Critical 9.8
    CVE-2024-54931

    A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remot…