CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- google androidIn endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access...10.0 Critical
- google androidIn multiple locations, there is a possible way to bypass KASLR due to an unusual root cause. This...4.4 Medium
- google androidIn asn1_ber_decoder of asn1_decoder.c, there is a possible out of bounds read due to a missing...4.4 Medium
- project-zot zotIdP group membership revocation ignored in zot7.3 High
- code-projects gym management systemCodezips Gym Management System edit_member.php sql injection5.3 Medium
- katex\htmlData does not validate attribute names in KaTeX6.3 Medium
- lexmark printer firmwareA firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.4.3 Medium
- angeljudesuarez tailoring management systemitsourcecode Tailoring Management System expadd.php sql injection5.3 Medium
- amazon aws cloud development kit, aws aws-cdk +1 moreIAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk1.8 Low
- code-projects tourism management systemcode-projects Tourism Management System manage-pages.php cross site scripting5.3 Medium
- devycreates bible-moduleImproper Input Validation in Bible Module for ROBLOX10.0 Critical
- caidoCross Site Scripting on URL decode Tooltip in Caido5.2 Medium
- exelban statsLocal Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in stats8.7 High
- roche diagnostics algorithm suiteInadequate Encryption Strength Vulnerability in Roche Algo Edge6.1 Medium
- code-projects car rental management system, fabian online car rental system +1 morecode-projects Car Rental Management System manage-pages.php cross site scripting5.1 Medium
- 1000 projects attendance tracking management system1000 Projects Attendance Tracking Management System edit_action.php sql injection5.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability6.5 Medium
- microsoft edge update, edge update setup +1 moreMicrosoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability7.4 High
- code-projects gym management systemCodezips Gym Management System edit_mem_submit.php sql injection5.3 Medium
- 1000 projects campaign management system platform for women1000 Projects Campaign Management System Platform for Women loginnew.php sql injection6.9 Medium
- 1000 projects campaign management system platform for women1000 Projects Campaign Management System Platform for Women sc_login.php sql injection6.9 Medium
- nedap librix ecoreaderNedap Librix Ecoreader Missing Authentication for Critical Function8.8 High
- belledonne communications linphone-desktopBelledonne Communications Linphone-Desktop NULL Pointer Dereference8.7 High
- code-projects gym management systemCodezips Gym Management System new_submit.php sql injection5.3 Medium
- ossur mobile logic applicationOssur Mobile Logic Application Use of Hard-coded Credentials2.0 Low
- ossur mobile logic applicationOssur Mobile Logic Application Command Injection2.0 Low
- ossur mobile logic applicationOssur Mobile Logic Application Exposure of Sensitive System Information to an Unauthorized Control Sphere5.6 Medium
- jupyter nbgrader`frame-ancestors: self` grants all users access to formgrader in nbgrader6.9 Medium
- etic telecom remote access server (ras), etictelecom remote access server firmware +1 moreETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery6.3 Medium
- etic telecom remote access server (ras), etictelecom remote access server firmware +1 moreETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information6.1 Medium
- etic telecom remote access server (ras), etictelecom remote access server firmware +1 moreETIC Telecom Remote Access Server (RAS) Cross-site Scripting4.8 Medium
- etic telecom remote access server (ras), etictelecom remote access server firmware +1 moreETIC Telecom Remote Access Server (RAS) Cross-site Scripting5.3 Medium
- etic telecom remote access server (ras), etictelecom remote access server firmware +1 moreETIC Telecom Remote Access Server (RAS) Cross-site Scripting4.8 Medium
- code-projects chat systemcode-projects Chat System leaveroom.php sql injection5.3 Medium
- anisha job recruitmentcode-projects Job Recruitment _feedback_system.php cross site scripting5.3 Medium
- code-projects train ticket reservation systemcode-projects Train Ticket Reservation System Login Form stack-based overflow4.8 Medium
- tenda ac10, ac18, ac8 +3 more +5 moreTenda AC8/AC10/AC18 HTTP Request telnet command injection8.6 High
- newtec/idirect ntc2218, ntc2250, ntc2299A command injection in the NTC2218, NTC2250, NTC2299 modems' web interfaces allows to exeucte arbitrary shell commands.9.3 Critical
- newtec/idirect ntc2218, ntc2250, ntc2299Stack-Based Buffer Overflow in Newtec's update signaling causes RCE9.5 Critical
- anisha admission management systemcode-projects Admission Management System signupconfirm.php sql injection6.9 Medium
- schneider electric powerlogic hdpm6000CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability...6.9 Medium
- schneider electric powerlogic hdpm6000CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow...8.7 High
- schneider electric remoteconnect and scadapack x70 utilitiesCWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of...8.5 High
- schneider electric bmxnoe0100, bmxnoe0110, bmxnor0200h +1 more +3 moreCWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that...8.8 High
- schneider electric web designer for bmenoc0311(c), web designer for bmenoc0321(c), web designer for bmxnoe0110(h) +1 more +3 moreCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...8.4 High
- schneider electric pro-face gp-pro ex, pro-face remote hmi +1 moreCWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel...6.1 Medium
- gravity forms formsGravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter5.4 Medium
- gravity forms formsGravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter7.2 High
- schneider electric bmenor2200h, evlink pro ac, modicon m580 cpu (part numbers bmep* and bmeh*, excluding m580 cpu safety) +1 more +3 moreCWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of...8.7 High
- schneider electric ecostruxure™ power build rapsodyCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability...4.6 Medium
- Show moreLoading…