CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- fortinet fortisoarAn improper neutralization of input during web page generation vulnerability [CWE-79] in...6.4 Medium
- fortinet fortiosAn insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7...3.5 Low
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 morePhoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation8.8 High
- arm scp-firmware, scp firmware +1 moreSCP-Firmware Vulnerability7.5 High
- arm scp-firmware, scp firmware +1 moreSCP-Firmware Vulnerability5.3 Medium
- ces taiwan neoimpact, cs-grp neo impact, greenware greenguard +7 more +9 moreHowyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.8.2 High
libsecp256k1crates.iolibsecp256k1 is unmaintainedNo score- gpriday page builder by siteorigin, siteorigin page builder +1 morePage Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter6.4 Medium
- siemens mendix ldapA vulnerability has been identified in Mendix LDAP (All versions < V1.1.2). Affected versions of...9.1 Critical
- siemens siprotec 5 6md84 (cp300), siprotec 5 6md85 (cp300), siprotec 5 6md86 (cp300) +40 more +42 moreA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC...7.1 High
- siemens simatic s7-1200 cpu 1211c ac/dc/rly, simatic s7-1200 cpu 1211c dc/dc/dc, simatic s7-1200 cpu 1211c dc/dc/rly +31 more +33 moreA vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0),...7.2 High
- siemens industrial edge management os (iem-os), industrial edge management +1 moreA vulnerability has been identified in Industrial Edge Management OS (IEM-OS) (All versions)....2.1 Low
- y's corporation stealthone d220, stealthone d340 +1 moreSQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An...7.5 High
- y's corporation stealthone d220, stealthone d340 +1 moreOS command injection vulnerability exists in network storage servers STEALTHONE D220/D340...9.8 Critical
- y's corporation stealthone d220, stealthone d340, stealthone d440 +2 moreOS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440...7.2 High
- cozmoslabs paid membership subscriptions – effortless memberships, recurring payments & content restriction, membership \& content restriction - paid member subscriptions +1 morePaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id9.8 Critical
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function8.8 High
- bplugins html5 video player – embed and play videos in custom playerHTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter6.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- boldgrid w3 total cacheW3 Total Cache <= 2.8.1 Information Exposure via Log Files5.3 Medium
- boldgrid w3 total cacheW3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery8.5 High
- boldgrid w3 total cacheW3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation5.3 Medium
- wpbookingcalendar wp booking calendar, wpdevelop booking calendar +1 moreBooking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode6.4 Medium
- veeam backup, backup for microsoft azure +1 moreVeeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may...7.2 High
- zyxel wbe530 firmware, wbe660s firmware, nwa110ax firmware +20 more +22 moreAn improper privilege management vulnerability in the web management interface of the Zyxel...8.8 High
- omron corporation machine automation controller nj-series, machine automation controller nx-series +1 morePath Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers6.6 Medium
- omron corporation programable terminals nb-designerVulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer5.5 Medium
- sap se netweaver application server for abap and abap platformImproper Authentication in SAP NetWeaver ABAP Server and ABAP Platform9.9 Critical
- sap se sapsetupDLL Hijacking vulnerability in SAPSetup7.8 High
- sap se netweaver application server abapMissing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP4.3 Medium
- sap se netweaver application server javaMissing Authorization check in SAP NetWeaver Application Server Java6.3 Medium
- sap se netweaver as for abap and abap platform (internet communication framework), sap basis +1 moreInformation Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)9.9 Critical
- sap se netweaver as abap and abap platform, sap basis +1 moreSQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform8.8 High
- sap businessobjects business intelligence platformMultiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform8.7 High
- sap businessobjects business intelligence platformMultiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform6.5 Medium
- sap se netweaver application server abap (applications based on sap gui for html)Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)6.0 Medium
- sap se business workflow and sap flexible workflow, sap basis +1 moreInformation Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow6.5 Medium
- sap se netweaver as java (user admin application)Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application)4.8 Medium
- sap se gui for javaInformation Disclosure vulnerability in SAP GUI for Java6.0 Medium
- sap se gui for windowsInformation Disclosure vulnerability in SAP GUI for Windows6.0 Medium
- sap se netweaver application server for abap and abap platform, sap basis +1 moreInformation Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform5.3 Medium
- ietf ipv6IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed...5.4 Medium
- ietf ipv6IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification...5.4 Medium
- linksys e5600 firmwareA stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys...4.8 Medium
- linksys e5600 firmwareA stored cross-site scripting (XSS) vulnerability in the spf_table_content component of Linksys...4.8 Medium
- thecosy icecmsAn access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0...7.5 High
- thecosy icecmsAn access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows...7.5 High
- wangl1989 mysiteformeMSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the...8.6 High
- wangl1989 mysiteformeMSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the...9.1 Critical
- wangl1989 mysiteformeMSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name...7.5 High
- Show moreLoading…