Skip to content
OpenAdvisories

Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

297 results · Feed

  • High 8.9
    CVE-2024-11834

    Arbitrary File Write via PTRAC Import

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

    PlexTrac PlexTrac
  • High 8.9
    CVE-2024-11833

    Arbitrary Directory Write via Runbooks Artifact Upload

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

    PlexTrac PlexTrac
  • Medium 4.4
    CVE-2024-12581

    Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting

    The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. Th…

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • High 7.1
    CVE-2024-21543

    djoser Authentication Bypass

    Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventuall…

    djoser djoser djoser Debian Ubuntu PyPI
  • High 8.6
    CVE-2024-21544

    Browsershot Local File Inclusion

    Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, …

    spatie/browsershot Packagist
  • Medium 6.1
    CVE-2024-11809

    Primer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting

    The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'img_src' parameter in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible f…

    primersoftware Primer MyData for Woocommerce Web / CMS
  • Medium 5.3
    CVE-2024-12579

    Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service

    The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated …

    teckel Minify HTML Web / CMS
  • Medium 5.4
    CVE-2024-12574

    SVG Shortcode <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

    The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke…

    amrendesign SVG Shortcode Web / CMS
  • Medium 6.4
    CVE-2024-11767

    NewsmanApp <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attr…

    newsmanapp NewsmanApp Web / CMS
  • Low 3.7
    CVE-2024-12300

    AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload

    The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticate…

    webandprint AR for WordPress Web / CMS
  • Medium 6.5
    CVE-2019-25221

    Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection

    The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…

    nik00726 Responsive Filterable Portfolio Web / CMS
  • Medium 6.1
    CVE-2024-12572

    Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers t…

    stathisg Hello In All Languages Web / CMS
  • Critical 9.8
    CVE-2024-12603 Public exploit

    A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application passw…

    TECNO com.transsion.applock
  • High 7.8
    CVE-2024-12212

    Horner Automation Cscape Out-of-bounds Read

    The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading past the end of allocated data structures, resulting in execution of arbitrary code.

    Horner Automation Cscape
  • High 7.8
    CVE-2024-9508

    Horner Automation Cscape Out-of-bounds Read

    Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code.

    Horner Automation Cscape
  • Medium 5.3
    CVE-2024-55918

    An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between module…

    libgraphics-colornames-perl libgraphics-colornames-perl Debian Ubuntu
  • Critical 9.8
    CVE-2024-55956 Exploited · Ransomware Public exploit Scanner template EPSS 94%

    In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can imp…

    KEV Dec 17, 2024