CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- huawei emui, harmonyos +1 moreVulnerability of improper authentication in the ANS system service module Impact: Successful...6.5 Medium
- dell powerscale onefsDell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource...6.5 Medium
- huawei emui, harmonyos +1 moreVulnerability of improper permission control in the Gallery module Impact: Successful...4.4 Medium
- huawei emui, harmonyos +1 morePath traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this...6.2 Medium
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...5.5 Medium
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...6.2 Medium
- huawei emui, harmonyos +1 moreUAF vulnerability in the device node access module Impact: Successful exploitation of this...4.4 Medium
- ibm db2IBM Db2 information disclosure5.5 Medium
opencvOSS-FuzzHeap-buffer-overflow in cv::PngDecoder::readHeaderNo scoreopencvOSS-FuzzUNKNOWN READ in png_free_dataNo score- No product listedAn issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5....8.8 High
- keraskeras Path Traversal vulnerability6.5 Medium
- oretnom23 computer laboratory management systemSourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access...8.8 High
- coherent graphics cpdfcpdf through 2.8 allows stack consumption via a crafted PDF document.4.0 Medium
- composioComposio Command Execution vulnerability6.4 Medium
- No product listedCertain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server...6.0 Medium
minidlnaDebianCommand Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary...8.8 High- aviatrix controller, controllers +1 moreAn issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to...10.0 Critical
- apple smart card servicesThis issue is fixed in SCSSU-201801. A potential stack based buffer overflow existed in...9.8 Critical
- labredescefetrj wegiaWeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)10.0 Critical
- labredescefetrj wegiaWeGIA has a Cross-Site Scripting (XSS) in File Upload Field8.3 High
- pgadmin pgagentpgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service5.5 Medium
- code-projects online book shopcode-projects Online Book Shop subcat.php cross site scripting5.3 Medium
- hewlett packard enterprise (hpe) hpe aruba networking 501 wireless client bridgeAuthenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge7.2 High
- hewlett packard enterprise (hpe) hpe aruba networking 501 wireless client bridgeAuthenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge7.2 High
netcarver/textilePackagistPHP-Textile has persistent XSS vulnerability in image link handling7.3 High- code-projects online book shopcode-projects Online Book Shop subcat.php sql injection5.3 Medium
- spencer haws link whisper freeWordPress Link Whisper Free plugin <= 0.7.7 - Sensitive Data Exposure vulnerability5.3 Medium
- hermann lahami allada t-shirt designer for woocommerceWordPress Allada T-shirt Designer for Woocommerce plugin <= 1.1 - Broken Access Control vulnerability5.3 Medium
- hashthemes hash elementsWordPress Hash Elements plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dearhive social media share buttons | mashshareWordPress MashShare plugin <= 4.0.47 - Broken Access Control vulnerability4.3 Medium
- filathemes education lmsWordPress Education LMS theme <= 0.0.7 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- abb ac500 v3An attacker who successfully exploited these vulnerabilities could grant read access to files. A...5.1 Medium
- code themes digi storeWordPress Digi Store theme <= 1.1.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- eric mcniece emc2 alert boxesWordPress EMC2 Alert Boxes Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ali ali alpha price table for elementorWordPress Alpha Price Table For Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- azzaroco ultimate learning proWordPress Indeed Ultimate Learning Pro plugin <= 3.9 - SQL Injection vulnerability7.6 High
- splunk app for soarPrivilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOAR6.4 Medium
- securesubmit wp securesubmitWordPress WP SecureSubmit plugin <= 1.5.20 - Sensitive Data Exposure vulnerability5.3 Medium
- themesupport hide category by user role for woocommerceWordPress Hide Category by User Role for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability4.3 Medium
- code-projects online book shopcode-projects Online Book Shop search_result.php sql injection5.3 Medium
- abb ac500 v3An attacker who successfully exploited these vulnerabilities could cause enable command execution...7.3 High
- joomla joomla\!, joomla! project cms +1 more[20250103] - Core - Read ACL violation in multiple core views7.5 High
- joomla joomla\!, joomla! project cms +1 more[20250101] - Core - XSS vectors in module chromes6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20250102] - Core - XSS vector in the id attribute of menu lists7.5 High
- silabs.com wiseconnect sdkDoS caused due to wrong hash length returned for SHA2/224 algorithm7.5 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134 and Thunderbird 1349.8 Critical
- mozilla firefoxAddress bar spoofing using an invalid protocol scheme on Firefox for Android6.5 Medium
- mozilla firefoxLock screen setting bypass in Firefox Focus for Android3.3 Low
- mozilla firefoxAddress bar spoofing using an invalid protocol scheme on Firefox for Android5.3 Medium
- Show moreLoading…