CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- icewarpIceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.6.1 Medium
- jatosJATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where...7.5 High
- No product listedI, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due...9.1 Critical
- No product listedBangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV...7.5 High
- No product listedAn authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3...8.8 High
- ipublishmedia adportalFile Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary...9.8 Critical
- ipublishmedia adportalCross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote...6.1 Medium
- ipublishmedia adportalServer-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to...9.8 Critical
- janobe vehicle management systemVehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable...7.2 High
- elspec-ltd g5dfr firmwareAn XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder...7.5 High
- elspec-ltd g5dfr firmwareAn issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML...7.5 High
- elspec-ltd g5dfr firmwareElspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 was discovered to contain a...7.5 High
- No product listedAn issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows...7.5 High
- No product listedMultiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in...5.4 Medium
- dronecode px4 drone autopilotStack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to...7.9 High
- No product listedAn XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and...9.1 Critical
- salesagility suitecrmAn issue was discovered in SuiteCRM 7.12.7. Authenticated users can recover an arbitrary field of...8.1 High
- salesagility suitecrmAn issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload...8.8 High
- No product listedAn issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading...9.8 Critical
- eyesofnetworkAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be...9.8 Critical
- denoland denoDeno's authorization headers not dropped when redirecting cross-origin7.5 High
- makeplane planePlane has a Cross-site scripting (XSS) via SVG image upload5.4 Medium
- redisRedis allows denial-of-service due to malformed ACL selectors4.4 Medium
- redis, debian linux +1 moreRedis' Lua library commands may lead to remote code execution7.0 High
- guzzle oauth-subscriberGuzzle OAuth Subscriber has insufficient nonce entropy6.3 Medium
- oisf suricataSuricata generic detection bypass using TCP urgent support7.5 High
- oisf suricataSuricata oversized resource names utilizing DNS name compression can lead to resource starvation7.5 High
- oisf suricataSuricata segfault on StreamingBufferSlideToOffsetWithRegions5.9 Medium
- oisf suricataSuricata oversized bpf file can lead to buffer overflow3.3 Low
- dell powerscale onefsDell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for...5.0 Medium
- oisf suricataSuricata allows stack overflow in transforms7.5 High
- ffmpegFfmpeg: dash playlist ssrf vulnerability in ffmpeg7.2 High
- ffmpegFfmpeg: hls xbin demuxer dos amplification in ffmpeg5.3 Medium
- ffmpegFfmpeg: hls unsafe file extension bypass in ffmpeg4.7 Medium
- hclsoftware devops deploy, ibm urbancode deploy +1 moreIBM DevOps Deploy / IBM UrbanCode Deploy HTML injection3.1 Low
- zauberzeug niceguiNiceGUI On Air authentication issue7.5 High
- bailuk aatAAT allows data exfiltration by other apps installed on the same device5.5 Medium
- linux, linux kernel +1 moremedia: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg5.5 Medium
- linux, linux kernel +1 morebpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP5.5 Medium
- linux, linux kernel +1 moredmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset5.5 Medium
- linux, linux kernel +1 moremtd: rawnand: fix double free in atmel_pmecc_create_user()7.8 High
- linux, linux kernel +1 morepowerpc/pseries/vas: Add close() callback in vas_vm_ops struct7.8 High
- linux, linux kernel +1 moreublk: detach gendisk from ublk device if add_disk() fails7.8 High
- linux, linux kernel +1 moretracing: Prevent bad count for tracing_cpumask_write5.5 Medium
- linux, linux kernel +1 morex86/fred: Clear WFE in missing-ENDBRANCH #CPs5.5 Medium
- linux, linux kernel +1 morePCI/MSI: Handle lack of irqdomain gracefully5.5 Medium
- linux, linux kernel +1 morebtrfs: fix use-after-free when COWing tree bock and tracing is enabled7.8 High
- linux, linux kernel +1 morebtrfs: check folio mapping after unlock in relocate_one_folio()5.5 Medium
- linux, linux kernel +1 moreBluetooth: btusb: mediatek: add intf release flow when usb disconnect7.8 High
- go-gitgo-git clients vulnerable to DoS via maliciously crafted Git server replies7.5 High
- Show moreLoading…