CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- mattermost, mattermost mobile +1 moreMobile crash via object that can't be cast to String in Attachment Field6.5 Medium
- mattermost, mattermost server +1 moreWebapp crash via object that can't be cast to String in Attachment Field6.5 Medium
- No product listedTime-of-check time-of-use race condition in some Intel(R) Neural Compressor software before...2.1 Low
- mattermost, mattermost mobile +1 moreMobile crash via improper validation of proto style in attachments6.5 Medium
- librenmsReflected Cross-site Scripting on error alert in librenms5.4 Medium
- librenmsStored XSS-LibreNMS-Misc Section in librenms4.6 Medium
- librenmsStored XSS-LibreNMS-Ports in librenms4.6 Medium
- librenmsStored-XSS-LibreNMS-Display-Name in librenms4.6 Medium
- librenmsStored XSS-LibreNMS-Display Name 2 in librenms4.6 Medium
- ibm cics tx advanced, cics tx, cics tx standard +2 moreIBM CICS TX cross-site scripting7.2 High
rsyncUbuntursync regressionNo score- ffmpegUnchecked sscanf return value which leads to memory data leak4.8 Medium
libxml2Ubuntulibxml2 vulnerabilityNo scoreharfbuzzUbuntuharfbuzz vulnerabilityNo score- pmb services platform, sigb pmb +1 moreIncomplete Cleanup vulnerability in PMB platform6.5 Medium
- pmb services platform, sigb pmb +1 moreInformation exposure vulnerability in PMB platform7.5 High
- pmb services platform, sigb pmb +1 moreUnrestricted Upload of File with Dangerous Type vulnerability in PMB platform9.9 Critical
- wago 750-8100 (controller pfc100), 750-831 (controller bacnet/ip), 750-880 (controller eth) +1 more +3 moreWAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption7.5 High
- coder426 passwords managerPasswords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- coder426 passwords managerPasswords Manager <= 1.4.8 - Unauthenticated SQL Injection7.5 High
- mondula multi step formMulti Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload5.3 Medium
- nmedia admin and customer messages after order for woocommerce: orderconvoAdmin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting5.4 Medium
- coder426 passwords managerPasswords Manager <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key7.5 High
- fahadmahmood wp responsive tabsWP Responsive Tabs <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +1 more +3 moreA weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1,...6.7 Medium
- fortinet fortirecorder, fortivoice, fortiweb +2 moreA improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet...5.2 Medium
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +1 more +3 moreA incorrect privilege assignment in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.0...6.9 Medium
- octopus deploy kubernetes worker or kubernetes agentIn affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be...6.5 Medium
- wp event manager user profile avatar, wpeventmanager wp user profile avatar +1 moreWP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- gwendydd chamber dashboard business directoryChamber Dashboard Business Directory <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- stylemix motors – car dealership & classified listings plugin, stylemixthemes motors - car dealer\, classifieds \& listing +1 moreMotors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title5.4 Medium
- scriptsbundle dwt - directory & listing wordpress themeDWT - Directory & Listing WordPress Theme <= 3.3.3 - Reflected Cross-Site Scripting6.1 Medium
- netvision information airpassNetVision Information airPASS - OS Command Injection8.8 High
- netvision information airpassNetVision Information airPASS - Missing Authentication9.8 Critical
- netvision information airpassNetVision Information airPASS - SQL injection9.8 Critical
pcapplusplusOSS-FuzzUNKNOWN READ in pcpp::RawPacket::insertDataNo scorepocoOSS-FuzzUNKNOWN READ in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<chNo scorersyncDebianrsync - regression updateNo scoreucfDebianucf - security updateNo score- edimax re11s firmwareRE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the...9.8 Critical
- edimax re11s firmwareRE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the...9.8 Critical
- edimax re11s firmwareRE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform...9.8 Critical
- edimax re11s firmwareRE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the...9.8 Critical
- edimax re11s firmwareRE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName...9.8 Critical
- edimax re11s firmwareRE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter...9.8 Critical
- edimax re11s firmwareRE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the...9.8 Critical
- No product listedZenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via...4.9 Medium
- No product listedAn issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows...5.5 Medium
- jfinaloa project jfinaloaA cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA...4.6 Medium
- jfinaloa project jfinaloaJFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the...8.8 High
- Show moreLoading…