Skip to content
OpenAdvisories

Archive

23 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /23 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.1
    CVE-2024-53961 EPSS 14%

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to acc…

    Adobe ColdFusion
  • High 7.8
    CVE-2024-56363

    APTRS has SSTI vulnerability

    APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input…

    APTRS APTRS
  • High 7.1
    CVE-2024-56362

    Navidrome Stores JWT Secret in Plaintext in navidrome.db

    Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the dat…

    navidrome navidrome github.com/navidrome/navidrome Go
  • High 8.7
    CVE-2024-55947 Public exploit EPSS 78%

    Gogs has a Path Traversal in file update API

    Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2024-54148

    Gogs has a Path Traversal in file editing UI

    Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

    Gogs Gogs gogs.io/gogs Go
  • High 7.8
    CVE-2024-53256

    Rizin has a command injection via RzBinInfo bclass due legacy code

    Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due the usage of `rz_core_cmdf` to invoke the command `m` which was removed in v0.1.x. A malicious binar…

    rizinorg rizin
  • High 7.8
    CVE-2024-12903

    Incorrect default permissions in Biamp Evoko Home

    Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It…

    Biamp Evoko Home Service
  • High 8.4
    CVE-2024-12902

    Global Wisdom Software ANCHOR - Undocumented Privileged Account

    ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to th…

    Global Wisdom Software ANCHOR
  • High 7.3
    CVE-2024-12899

    1000 Projects Attendance Tracking Management System course_action.php sql injection

    A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/course_action.php. The manipulation of the argument course_code leads to sql inj…

    1000 Projects Attendance Tracking Management System
  • High 7.2
    CVE-2024-54082

    home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore functi…

    Sharp home 5G HR02 Wi-Fi STATION SH-54C
  • High 7.2
    CVE-2024-45721

    home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST …

    Sharp home 5G HR02 Wi-Fi STATION SH-54C Wi-Fi STATION SH-52B