CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- palo alto networks expedition, cloud ngfw, pan-os +2 more +4 moreExpedition: Cross-Site Scripting (XSS) Vulnerability7.0 High
- palo alto networks expedition, cloud ngfw, pan-os +2 more +4 moreExpedition: SQL Injection Vulnerability9.2 Critical
- hcl software dryice myxalyticsHCL MyXalytics is affected by insecure direct object references7.1 High
- hcl software dryice myxalyticsHCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability8.9 High
- premio coupon x – discount popups & promo codes pop ups for woocommerceCoupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization5.4 Medium
- premio coupon x – discount popups & promo codes pop ups for woocommerceCoupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection7.5 High
- tinuzz trackserverTrackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- clickwhale – link manager, link shortener and click tracker for affiliate links & link pages, flowdee clickwhale +1 moreClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Reflected Cross-Site Scripting6.1 Medium
- metaphor creations post duplicatorPost Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure4.3 Medium
- crowdfavorite cf internal link shortcodeCF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection7.5 High
- arista ng firewall, arista networks edge threat management +1 moreSpecially constructed queries cause cross platform scripting leaking administrator tokens8.8 High
- arista ng firewall, arista networks edge threat management +1 moreA user with advanced report application access rights can perform actions for which they are not authorized7.6 High
- arista ng firewall, arista networks edge threat management +1 moreBackup uploads to ETM subject to man-in-the-middle interception8.3 High
- arista ng firewall, arista networks edge threat management +1 moreSpecially constructed queries targeting ETM could discover active remote access sessions6.4 Medium
- arista ng firewall, arista networks edge threat management +1 moreExpired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access6.8 Medium
- arista ng firewall, arista networks edge threat management +1 moreMultiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on th…8.3 High
- arista ng firewall, arista networks edge threat management +1 moreA user with administrator privileges is able to retrieve authentication tokens6.6 Medium
- arista ng firewall, arista networks edge threat management +1 moreThe administrator is able to configure an insecure captive portal script8.1 High
- arista ng firewall, arista networks edge threat management +1 moreA user with administrator privileges can perform command injection7.2 High
- arista networks cloudvision applianceOn Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This re…4.6 Medium
- arista networks eosOn affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as rou…6.5 Medium
- arista networks eosOn affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak…4.3 Medium
- arista networks eos - bgp flowspec, eos - interface traffic policy, eos-policy based routing (pbr) +2 moreOn affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- ce…5.8 Medium
- netgear dgn1000, dgn1000 firmware +1 moreNETGEAR DGN setup.cgi OS Command Injection9.8 Critical
linux-realtimeUbuntulinux-realtime vulnerabilitiesNo score- wikimedia foundation mediawiki - articlefeedbackv5 extensionXSSes in Extension:ArticleFeedbackv56.1 Medium
- wikimedia foundation mediawiki - breadcrumbs2 extensionXSS in BreadCrumbs26.5 Medium
- jan syski megabipCSRF in MegaBIP6.9 Medium
- jan syski megabipCSRF in MegaBIP8.7 High
- labredescefetrj wegiaWeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `configuracao_doacao.php` parameter `avulso`6.4 Medium
- labredescefetrj wegiaWeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `home.php` parameter `msg_c`6.4 Medium
- labredescefetrj wegiaWeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'cadastrarSocio.php' parameter 'nome'8.3 High
- labredescefetrj wegiaWeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'CobrancaController.php' parameter 'local_recepcao'8.3 High
- labredescefetrj wegiaWeGIA has a Cross-Site Scripting (XSS) Reflected endpoint 'modulos_visiveis.php' parameter'msg_c'6.4 Medium
- atheosImproper Path Validation Enables Path Traversal in Multiple Components in Atheos9.4 Critical
- dataeaseDataEase has an unauthorized vulnerability9.3 Critical
- ibm doors next, engineering requirements management doors next +1 moreIBM Engineering Requirements Management DOORS Next code execution9.8 Critical
- notfound essential wp real estateEssential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion5.3 Medium
- themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 moreOrbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter6.4 Medium
- themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 moreOrbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget6.4 Medium
- opacewebdesign opace ai scribe: seo content creator & humaizer for openai & anthropicAI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection6.5 Medium
- opacewebdesign opace ai scribe: seo content creator & humaizer for openai & anthropicAI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Se…4.3 Medium
python-djangoDebianpython-django - security updateNo score- vanderbilt redcapAn issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the...3.4 Low
- vanderbilt redcapAn issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability...6.1 Medium
- vanderbilt redcapAn issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name,...4.7 Medium
- vanderbilt redcapAn issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in...6.1 Medium
- freetypeFreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.4.0 Medium
- fastcgi fcgiFastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based...9.3 Critical
- tenda ac9 firmwareTenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg,...9.8 Critical
- Show moreLoading…