Explore CVE records

UnscoredPublished 19 Dec 2024, 03:38 WIB

CVE-2024-45338

Non-linear parsing of case-insensitive content in golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated22 Feb 2025, 01:03 WIB

Official record

CritKEVPublished 19 Dec 2024, 03:37 WIB

CVE-2024-56145

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

MedKEVPublished 19 Dec 2024, 03:23 WIB

CVE-2024-12686

Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

Excerpt language: en.

CVSS6.6v3.1KEVListedEPSSPresentUpdated22 Oct 2025, 05:55 WIB

Official record

MedPublished 19 Dec 2024, 02:56 WIB

CVE-2024-51470

IBM MQ denial of service

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Dec 2024, 03:24 WIB

Official record

HighPublished 19 Dec 2024, 02:24 WIB

CVE-2024-49363

Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey

Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed denial-of-service via a maliciously…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated19 Dec 2024, 23:46 WIB

Official record

MedPublished 19 Dec 2024, 02:22 WIB

CVE-2024-52579

Server-Side Request Forgery vulnerability in various APIs in Misskey

Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with so…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated19 Dec 2024, 23:46 WIB

Official record

HighPublished 19 Dec 2024, 02:21 WIB

CVE-2024-52590

Missing validation allows spoofed profiles in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to impersonate existing users…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 23:59 WIB

Official record

HighPublished 19 Dec 2024, 02:20 WIB

CVE-2024-12741

Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that DAQExpress is an EOL pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated06 Mar 2025, 23:18 WIB

Official record

HighPublished 19 Dec 2024, 02:20 WIB

CVE-2024-52591

Missing validation allows spoofed profiles and notes in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated20 Dec 2024, 00:08 WIB

Official record

MedPublished 19 Dec 2024, 02:19 WIB

CVE-2024-52592

Missing validation allows spoofed poll updates in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instance. Vulnerable Misskey…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 04:30 WIB

Official record

MedPublished 19 Dec 2024, 02:17 WIB

CVE-2024-52593

Missing validation allows spoofed "origin" links in Misskey

Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker to control the target of any "origin" links (such as the "view on remote instance" banner). Any HTTP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 04:31 WIB

Official record

HighPublished 19 Dec 2024, 02:12 WIB

CVE-2024-53271

HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to upgrade. There are no know…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated19 Dec 2024, 04:34 WIB

Official record

HighPublished 19 Dec 2024, 02:12 WIB

CVE-2024-53270

HTTP/1: sending overload crashes when the request is reset beforehand in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, only onMessageBeginImpl() is called. However, the `onMessageB…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated19 Dec 2024, 04:35 WIB

Official record

MedPublished 19 Dec 2024, 02:12 WIB

CVE-2024-53269

Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to upgrade may disable Ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.5v3.1KEVNot listedEPSSPresentUpdated19 Dec 2024, 04:36 WIB

Official record

CritPublished 19 Dec 2024, 02:08 WIB

CVE-2024-47040

Use After Free in the android.hardware.radio.sap.ISap/slot2 service

There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

CVSS10v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 02:16 WIB

Official record

CritPublished 19 Dec 2024, 02:04 WIB

CVE-2024-47039

OOB Read in the android.hardware.boot.IBootControl/default service

In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

CVSS10v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 02:16 WIB

Official record

CritPublished 19 Dec 2024, 02:01 WIB

CVE-2024-47038

In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation of privilege with no additional execution privileges needed. Usercinteraction is not needed for exploitation.

Excerpt language: en.

CVSS10v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 02:09 WIB

Official record

HighPublished 19 Dec 2024, 01:58 WIB

CVE-2024-56047

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 19 Dec 2024, 01:58 WIB

CVE-2024-56053

WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 19 Dec 2024, 01:57 WIB

CVE-2024-56048

WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage