CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- ivanti endpoint managerAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...7.5 High
- ivanti endpoint managerAn out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...7.8 High
- ivanti endpoint managerAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...7.5 High
- ivanti endpoint managerInsufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and...7.8 High
- ivanti endpoint managerImproper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and...7.8 High
- ivanti endpoint managerAn unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and...7.2 High
- ivanti endpoint manager, endpoint manager (epm) +1 moreAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- ivanti endpoint manager, endpoint manager (epm) +1 moreAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- ivanti endpoint manager, endpoint manager (epm) +1 moreAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- oretnom23 task reminder systemSourceCodester Task Reminder System Maintenance Section cross site scripting5.1 Medium
- 51mis lingdang crmShanghai Lingdang Information Technology Lingdang CRM index.php unrestricted upload5.3 Medium
- ivanti endpoint managerAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- wikimedia foundation mediawiki - datatransfer extensionVarious security vulnerabilities in Extension:DataTransfer6.1 Medium
- ivanti avalanchePath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker...7.3 High
- ivanti avalanchePath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker...7.5 High
- ivanti avalanchePath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker...7.3 High
- ibm mqIBM MQ information disclosure6.2 Medium
- ivanti application control engine, application control, security controls +2 moreA race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local...7.8 High
- wikimedia foundation mediawiki - openbadges extensionXSSes in Special:BadgeView5.3 Medium
- vyperlang vyperSuccess of Certain Precompile Calls not Checked in Vyper2.3 Low
- gradio-app gradioGradio Blocked Path ACL Bypass Vulnerability8.7 High
- swift project asn1CVE-2025-0343: Swift ASN.1 can crash when parsing maliciously formed BER/DER7.5 High
- 51mis lingdang crmShanghai Lingdang Information Technology Lingdang CRM index.php sql injection5.3 Medium
- apache linkis, apache software foundation linkis metadata query service jdbc +1 moreApache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability5.9 Medium
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR) through realtime WYSIWYG editing in XWiki9.1 Critical
- rasahq rasa-pro-security-advisoriesRemote Code Execution via Remote Model Loading in Rasa9.1 Critical
- 51mis lingdang crmShanghai Lingdang Information Technology Lingdang CRM index.php path traversal5.3 Medium
- No product listedBlog Botz for Journal Theme blog_add unrestricted upload6.9 Medium
- phoenix securecore™ for intel coffee lake, securecore™ for intel comet lake, securecore™ for intel ice lake +2 more +4 moreUnsafe Handling of IHV UEFI Variables4.6 Medium
- phoenix securecore™ for intel coffee lake, securecore™ for intel comet lake, securecore™ for intel ice lake +2 more +4 moreUnsafe Handling of Phoenix UEFI Variables4.6 Medium
- typo3Cross-Site Request Forgery in DB Check Module in TYPO34.3 Medium
- typo3Cross-Site Request Forgery in Scheduler Module in TYPO38.0 High
- typo3Cross-Site Request Forgery in Indexed Search Module in TYPO34.3 Medium
- typo3Cross-Site Request Forgery in Form Framework Module in TYPO35.4 Medium
- typo3Cross-Site Request Forgery in Extension Manager Module in TYPO37.5 High
- libretro retroarchlibretro RetroArch Startup profapi.dll untrusted search path4.8 Medium
- virtual computer vysual rh solutionVirtual Computer Vysual RH Solution Login Panel index.php cross site scripting6.9 Medium
- typo3Cross-Site Request Forgery in Dashboard Module in TYPO34.3 Medium
- typo3TYPO3 Cross-Site Request Forgery in Backend User Module4.3 Medium
- typo3TYPO3 Cross-Site Request Forgery in Log Module4.3 Medium
- typo3Potential Open Redirect via Parsing Differences in TYPO34.8 Medium
- typo3Information Disclosure via Exception Handling/Logger in TYPO33.1 Low
- ami aptiov, aptio v +1 moreTOCTOU Race Condition between DMA and SMM7.5 High
- wavlink ac3000, wl-wn533a8 firmware +1 moreA cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode()...9.6 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreAn os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync()...10.0 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality...10.0 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality...10.0 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality...10.0 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing()...9.1 Critical
- wavlink ac3000, wl-wn533a8 firmware +1 moreMultiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing()...9.1 Critical
- Show moreLoading…