Security Vulnerabilities - CVEs Published In December 2024
The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score
7.2
EPSS Score
0.005
Published
2024-12-06
In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs.
CVSS Score
6.2
EPSS Score
0.001
Published
2024-12-06
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score
4.3
EPSS Score
0.011
Published
2024-12-06
Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.
CVSS Score
3.8
EPSS Score
0.002
Published
2024-12-06
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
CVSS Score
3.8
EPSS Score
0.002
Published
2024-12-06
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the error-thrown mechanism in nav2_bt_navigator.
CVSS Score
7.8
EPSS Score
0.003
Published
2024-12-05
Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the nav2_amcl process
CVSS Score
7.8
EPSS Score
0.003
Published
2024-12-05
In reboot_block_command of htc reboot_block driver, there is a possible
stack buffer overflow due to a missing bounds check. This could lead to
local escalation of privilege with System execution privileges needed. User
interaction is not needed for exploitation.
CVSS Score
6.7
EPSS Score
0.001
Published
2024-12-05
In store_upgrade and store_cmd of drivers/input/touchscreen/stm/ftm4_pdc.c, there are out of bound writes due to missing bounds checks or integer underflows. These could lead to escalation of privilege.
CVSS Score
9.8
EPSS Score
0.002
Published
2024-12-05
In procfile_write of gl_proc.c, there is a possible out of bounds read of a
function pointer due to an incorrect bounds check. This could lead to local
escalation of privilege with System execution privileges needed. User
interaction is not needed for exploitation.
CVSS Score
6.7
EPSS Score
0.001
Published
2024-12-05