Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2024

155 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2024-12356
    95Now

    Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)

    CriticalCVSS 9.8KEVWeaponizedEPSS 87%

    beyondtrust · privileged remote accessDec 17, 2024

  • CVE-2024-50379
    49Plan

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

    CriticalCVSS 9.8Proof of conceptEPSS 31%

    apache · tomcatDec 17, 2024

  • CVE-2024-12025
    31Monitor

    Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 2%

    robfelty · collapsing categoriesDec 18, 2024

  • CVE-2024-21546
    35Monitor

    Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimety

    HighCVSS 8.9Proof of conceptEPSS 1%

    Dec 18, 2024

  • CVE-2024-56058
    40Plan

    WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    denniskravetstns · vrpconnectorDec 18, 2024

  • CVE-2024-56059
    40Plan

    WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    farinspace · partnersDec 18, 2024

  • CVE-2023-34990
    46Plan

    A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized c

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    fortinet · fortiwlmDec 18, 2024

  • CVE-2024-54383
    39Monitor

    WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    wpwebelite · woocommerce pdf vouchersDec 18, 2024

  • CVE-2024-12686
    68This week

    Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)

    HighCVSS 7.2KEVWeaponizedEPSS 32%

    beyondtrust · privileged remote accessDec 18, 2024

  • CVE-2024-56145
    96Now

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    CriticalCVSS 9.3KEVWeaponizedEPSS 97%

    craftcms · craft cmsDec 18, 2024

  • CVE-2024-56115
    24Monitor

    A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    amiro · amiro.cmsDec 18, 2024

  • CVE-2024-56116
    35Monitor

    A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account.

    HighCVSS 8.8Proof of conceptEPSS 0%

    amiro · amiro.cmsDec 18, 2024

  • CVE-2024-11740
    30Monitor

    Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution

    HighCVSS 7.3Proof of conceptEPSS 1%

    w3eden · download managerDec 19, 2024

  • CVE-2024-11616
    22Monitor

    Double-fetch heap overflow

    MediumCVSS 5.6Proof of conceptEPSS 0%

    netskope inc. · endpoint dlpDec 19, 2024

  • CVE-2021-26102
    42Plan

    A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated

    CriticalCVSS 9.1Proof of conceptEPSS 19%

    fortinet · fortiwanDec 19, 2024

  • CVE-2024-38819
    47Plan

    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks

    HighCVSS 7.5Proof of conceptEPSS 56%

    Dec 19, 2024

  • CVE-2024-56159
    31Monitor

    Server source code is exposed to the public if sourcemaps are enabled

    HighCVSS 7.8Proof of conceptEPSS 1%

    astro · astroDec 19, 2024

  • CVE-2024-52794
    24Monitor

    Magnific lightbox susceptible to Cross-site Scripting in Discourse

    MediumCVSS 6.1Proof of conceptEPSS 0%

    discourse · discourseDec 19, 2024

  • CVE-2024-53991
    32Monitor

    Potential Backup file leaked via Nginx in Discourse

    MediumCVSS 5.9Proof of conceptEPSS 29%

    discourse · discourseDec 19, 2024

  • CVE-2024-12729
    35Monitor

    A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older tha

    HighCVSS 8.8No exploitEPSS 1%

    sophos · firewall firmwareDec 19, 2024

  • CVE-2024-56348
    17Monitor

    In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents

    MediumCVSS 4.3Proof of conceptEPSS 0%

    jetbrains · teamcityDec 20, 2024

  • CVE-2024-56331
    28Monitor

    Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor

    MediumCVSS 6.8Proof of conceptEPSS 1%

    louislam · uptime-kumaDec 20, 2024

  • CVE-2024-12558
    26Monitor

    WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_expo

    MediumCVSS 6.5Proof of conceptEPSS 1%

    puckrobin · wp base booking of appointments, services and eventsDec 21, 2024

  • CVE-2024-51463
    21Monitor

    IBM i server-side request forgery

    MediumCVSS 5.4Proof of conceptEPSS 0%

    ibm · iDec 21, 2024

  • CVE-2024-51464
    17Monitor

    IBM i authentication bypass

    MediumCVSS 4.3Proof of conceptEPSS 1%

    ibm · iDec 21, 2024

  • CVE-2024-45387
    55Plan

    Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

    HighCVSS 8.8No exploitEPSS 65%

    apache · traffic controlDec 23, 2024

  • CVE-2024-55947
    57Plan

    Gogs has a Path Traversal in file update API

    HighCVSS 8.7Proof of conceptEPSS 77%

    gogs · gogsDec 23, 2024

  • CVE-2024-53961
    36Monitor

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    HighCVSS 8.1No exploitEPSS 14%

    adobe · coldfusionDec 23, 2024

  • CVE-2024-12594
    35Monitor

    ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation

    HighCVSS 8.8Proof of conceptEPSS 0%

    zia-imtiaz · login page styler – custom wordpress login page customizer & securityDec 24, 2024

  • CVE-2024-43441
    61This week

    Apache HugeGraph-Server: Fixed JWT Token(Secret)

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    apache · hugegraphDec 24, 2024

  • CVE-2024-53150
    58Plan

    ALSA: usb-audio: Fix out of bounds reads when finding clock sources

    HighCVSS 7.1KEVWeaponizedEPSS 1%

    linux · linux kernelDec 24, 2024

  • CVE-2024-10858
    24Monitor

    Jetpack 13.0-14.0 - Unauthenticated DOM-XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    automattic · jetpackDec 25, 2024

  • CVE-2024-52046
    47Plan

    Apache MINA: MINA applications using unbounded deserialization may allow RCE

    CriticalCVSS 10.0No exploitEPSS 24%

    apache · minaDec 25, 2024

  • CVE-2024-56431
    40Plan

    oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    xiph · theoraDec 25, 2024

  • CVE-2024-56433
    14Monitor

    shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user

    LowCVSS 3.6Proof of conceptEPSS 0%

    shadow-maint · shadow-utilsDec 26, 2024

  • CVE-2024-12955
    27Monitor

    PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery

    MediumCVSS 6.9Proof of conceptEPSS 0%

    phpgurukul · blood bank \& donor management systemDec 26, 2024

  • CVE-2024-11605
    19Monitor

    WP Publications <= 1.2 - Admin+ Stored XSS

    MediumCVSS 4.8Proof of conceptEPSS 1%

    wp-publications project · wp-publicationsDec 27, 2024

  • CVE-2024-11921
    19Monitor

    Give < 3.19.0 - Reflected XSS

    MediumCVSS 4.8Proof of conceptEPSS 0%

    givewp · givewpDec 27, 2024

  • CVE-2024-3393
    73This week

    PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

    HighCVSS 8.7KEVWeaponizedEPSS 29%

    paloaltonetworks · pan-osDec 27, 2024

  • CVE-2024-53197
    62This week

    ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    linux · linux kernelDec 27, 2024

  • CVE-2024-12856
    53Plan

    Four-Faith Industrial Router adjust_sys_time OS Command Injection

    HighCVSS 7.2Proof of conceptEPSS 84%

    four-faith · f3x36 firmwareDec 27, 2024

  • CVE-2024-12986
    38Monitor

    DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection

    MediumCVSS 6.9Proof of conceptEPSS 35%

    draytek · vigor300b firmwareDec 27, 2024

  • CVE-2024-12987
    86Now

    DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection

    MediumCVSS 6.9KEVWeaponizedEPSS 98%

    draytek · vigor300b firmwareDec 27, 2024

  • CVE-2024-50944
    39Monitor

    Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Dec 27, 2024

  • CVE-2024-50945
    30Monitor

    An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submi

    HighCVSS 7.5Proof of conceptEPSS 0%

    Dec 27, 2024

  • CVE-2024-53476
    23Monitor

    A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory rest

    MediumCVSS 5.9Proof of conceptEPSS 0%

    Dec 27, 2024

  • CVE-2024-56512
    9Monitor

    Apache NiFi: Missing Complete Authorization for Parameter and Service References

    LowCVSS 2.1Proof of conceptEPSS 3%

    apache · nifiDec 28, 2024

  • CVE-2024-12828
    45Plan

    Webmin CGI Command Injection Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 33%

    webmin · webminDec 30, 2024

  • CVE-2024-56800
    29Monitor

    Firecrawl has SSRF Vulnerability via malicious scrape target

    HighCVSS 7.4Proof of conceptEPSS 0%

    mendableai · firecrawlDec 30, 2024

  • CVE-2024-56801
    27Monitor

    Tasklists has Blind SQL Injection in /ajax/reorder.php

    MediumCVSS 6.9Proof of conceptEPSS 0%

    infotel · tasklistsDec 30, 2024

  • CVE-2024-11972
    57Plan

    Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

    CriticalCVSS 9.8Proof of conceptEPSS 59%

    themehunk · hunk companionDec 31, 2024

  • CVE-2024-12105
    39Monitor

    WhatsUp Gold - SnmpExtendedActiveMonitor path traversal

    MediumCVSS 6.5No exploitEPSS 41%

    progress · whatsup goldDec 31, 2024

  • CVE-2024-56064
    50Plan

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 33%

    azzaroco · wp superbackupDec 31, 2024

  • CVE-2024-56067
    34Monitor

    WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 11%

    azzaroco · wp superbackupDec 31, 2024

  • CVE-2024-56071
    39Monitor

    WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    mikeleembruggen · simple dashboardDec 31, 2024