CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- redaxo cms, redaxo +1 moreRedaxo CMS Structure Management Page index.php cross site scripting5.1 Medium
- avast antivirusREVE Antivirus reveinstall default permission8.5 High
- kurniaramadhan e-commerce-phpkurniaramadhan E-Commerce-PHP Create Product Page create_product.php cross site scripting5.1 Medium
- kurniaramadhan e-commerce-phpkurniaramadhan E-Commerce-PHP blog-details.php sql injection5.3 Medium
- kurniaramadhan e-commerce-phpkurniaramadhan E-Commerce-PHP cross-site request forgery6.9 Medium
- wander-chu springboot-blogwander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scripting5.1 Medium
- wander-chu springboot-blogwander-chu SpringBoot-Blog Admin Attachment AttachtController.java upload unrestricted upload5.1 Medium
- wander-chu springboot-blogwander-chu SpringBoot-Blog HTTP POST Request BaseInterceptor.java preHandle access control6.9 Medium
- langhsu mblog blog system, mtons mblog +1 morelanghsu Mblog Blog System Search Bar search cross site scripting5.3 Medium
- langhsu mblog blog system, mtons mblog +1 morelanghsu Mblog Blog System login observable response discrepancy6.3 Medium
- donglight bookstore, bookstore电商书城系统说明 +1 moredonglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scripting5.3 Medium
- donglight bookstore, bookstore电商书城系统说明 +1 moredonglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scripting5.3 Medium
- vanderbilt redcapA stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows...5.4 Medium
- vanderbilt redcapA stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6...5.4 Medium
- henkel canlineappCanlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor...6.5 Medium
- No product listedSmart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing...7.5 High
- No product listedA cross-site scripting (XSS) vulnerability in Opencode Mobile Collect Call v5.4.7 allows...6.1 Medium
- dani-garcia vaultwardenVaultwarden authenticated reflected cross-site scripting (XSS) vulnerability5.4 Medium
- dani-garcia vaultwardenVaultwarden vulnerable to user impersonation9.8 Critical
- dani-garcia vaultwardenVaultwarden HTML injection vulnerability9.6 Critical
- tp-link tl-wr940n firmwareTP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the...8.0 High
- ruoyiRuoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because...6.3 Medium
- bigantsoft bigant office messenger 5BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.6.3 Medium
- No product listedPHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file...9.8 Critical
- pb-cms project pb-cmsCross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to...8.8 High
- No product listedBuffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate...6.8 Medium
- No product listedInfoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client...9.1 Critical
- No product listedIn PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user...7.8 High
- nagios xiA cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute...5.4 Medium
- red hat discovery 1.14, enterprise linux 10, enterprise linux 6 +4 more +6 moreRsync: race condition in rsync handling symbolic links5.6 Medium
- samba rsync, almalinux, archlinux arch linux +24 more +26 moreRsync: --safe-links option bypass leads to path traversal6.5 Medium
- samba rsync, almalinux, archlinux arch linux +32 more +34 moreRsync: path traversal vulnerability in rsync6.5 Medium
- samba rsync, almalinux, archlinux arch linux +13 more +15 moreRsync: rsync server leaks arbitrary client files6.1 Medium
- samba rsync, almalinux, archlinux arch linux +44 more +46 moreRsync: info leak via uninitialized stack contents7.5 High
- samba rsync, almalinux, archlinux arch linux +11 more +13 moreRsync: heap buffer overflow in rsync due to improper checksum length handling9.8 Critical
- No product listedAn issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call...9.8 Critical
- donglight bookstore, bookstore电商书城系统说明 +1 moredonglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgery5.3 Medium
- sucms project sucmsSucms admin_members.php sql injection5.3 Medium
- sem-cms semcmsSEMCMS Image Library Management Page SEMCMS_Images.php sql injection5.3 Medium
- zerowdd myblogZeroWdd myblog BlogController.java update cross site scripting5.3 Medium
- zerowdd myblogZeroWdd myblog uploadController.java upload unrestricted upload5.3 Medium
- ivanti connect secure, neurons for zta gateways, policy secure +1 more +3 moreA stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy...7.0 High
- ivanti connect secure, neurons for zta gateways, policy secure +2 more +4 moreA stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy...9.0 Critical
- zerowdd myblogZeroWdd myblog BlogMapper.xml xml injection5.3 Medium
- sickchillGHSL-2024-288: SickChill open redirect in login1.9 Low
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreUnauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches3.4 Low
- carbonphp carbonCarbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale6.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabInsertion of Sensitive Information into Externally-Accessible File or Directory in GitLab6.5 Medium
- zerowdd myblogZeroWdd myblog MyBlogMvcConfig.java permission6.9 Medium
- Show moreLoading…