CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- ibm safer paymentsIBM Safer Payments denial of service7.5 High
- ibm jazz for service managementIBM Jazz for Service Management information disclosure5.3 Medium
- ibm voice gatewayIBM ICP - Voice Gateway XML injection8.1 High
- ibm concert, concert software +1 moreIBM Concert information disclosure5.3 Medium
- ibm robotic process automation, robotic process automation for cloud pak +1 moreIBM Robotic Process Automation security bypass6.5 Medium
- ibm robotic process automationIBM Robotic Process Automation privilege escalation6.7 Medium
- campcodes school management softwareCampCodes School Management Software Photo Gallery Page photo-gallery cross site scripting5.1 Medium
- ibm app connect enterpriseIBM App Connect Enterprise information disclosure4.4 Medium
- campcodes school management softwareCampcodes School Management Software Create Id Card Page create-id-card cross site scripting5.1 Medium
- tduckcloud tduck-platformTDuckCloud tduck-platform QueryProThemeRequest.java QueryProThemeRequest sql injection5.3 Medium
- gitoxidelabs gitoxidegix-worktree-state nonexclusive checkout sets executable files world-writable5.0 Medium
- hyland alfresco community edition, alfresco enterprise edition +1 moreHyland Alfresco Community Edition URL s cross site scripting6.9 Medium
- spoonthemes adifier systemAdifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset9.8 Critical
- wpextended the ultimate wordpress toolkit – wp extendedThe Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module7.5 High
- videowhisper rate star review vote – ajax reviews, votes, star ratingsRate Star Review Vote – AJAX Reviews, Votes, Star Ratings <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- yunra utilities for mtgUtilities for MTG <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- crocoblock jetengineJet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter6.4 Medium
- videowhisper video share vod – turnkey video site builder scriptVideo Share VOD – Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- videowhisper picture gallery – frontend image uploads, ajax photo listPicture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode6.4 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title4.4 Medium
- jsmoriss jsm screenshot machine shortcodeJSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webwizardsdev marketking — ultimate woocommerce multivendor marketplace solutionMarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting4.4 Medium
- kevon adonis wp abstractsWP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- cmsmasters buzz club – night club, dj and music festival event wordpress themeBuzz Club – Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update4.3 Medium
- advancedcreation shipworks connector for woocommerceShipWorks Connector for Woocommerce <= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update4.3 Medium
- sjhand webcamconsultWebcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- videowhisper micropayments – fans paysite: paid creator subscriptions, digital assets, walletMicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- fernandobriano list category postsList category posts < 0.90.3 - Author+ Stored XSS5.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.9.1 - Unauthenticated SQL Injection7.5 High
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting6.1 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure5.3 Medium
- webzunft image source control lite – show image credits and captionsImage Source Control Lite – Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scripting6.1 Medium
- eric teubert podlove podcast publisher, podlove podcast publisher +1 morePodlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name4.4 Medium
- evergreencontentposter evergreen content poster – auto post and schedule your best content to social media, evergreen content poster +1 moreEvergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion5.3 Medium
- craft cms cms, craftcms craft cms +1 morePotential RCE with a compromised security key in craft/cms8.1 High
rsyncDebianrsync - security updateNo score- lexmark printer firmwareA buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices.8.8 High
- fortra application hubSensitive Information Disclosure in Fortra Application Hub Prior to version 1.35.5 Medium
- google androidIn BnDmAgent::onTransact of dm_agent.cpp, there is a possible out of bounds write due to a...6.7 Medium
- google androidIn many locations, there is a possible way to access kernel memory in user space due to an...7.8 High
- google androidIn NlpService, there is a possible way to obtain location information due to a missing permission...5.5 Medium
- google androidIn ip6_append_data of ip6_output.c, there is a possible way to achieve code execution due to a...7.8 High
- google androidIn multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an...7.8 High
- google androidIn multiple locations, there is a possible way to read protected files due to a missing...7.8 High
- google androidIn onAttachFragment of ShareIntentActivity.java, there is a possible way for an app to read files...7.0 High
- google androidIn onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the...5.5 Medium
- google androidIn multiple functions of Parcel.cpp, there is a possible way to bypass address space layout...7.8 High
- google androidIn multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot...7.8 High
- google androidIn multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of...5.5 Medium
- google androidIn multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete...7.8 High
- Show moreLoading…