CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- m-files serverUnsafe stored password recovery4.6 Medium
- m-files serverM-Files Server crash via EOT database driver configuration5.9 Medium
- elastic kibanaAn allocation of resources without limits or throttling in Kibana can lead to a crash caused by a...6.5 Medium
- asus armoury crateA file handling command vulnerability in certain versions of Armoury Crate may result in...8.4 High
- bmltenabled meeting map, otrok7 bmlt meeting map +1 moreBMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion7.5 High
- themehunk variation swatches for woocommerce, variation swatches for woocommerce swatches for woocommerce +1 moreVariation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset4.3 Medium
- apache wicketApache Wicket: An attacker can intentionally trigger a memory leak6.5 Medium
- elastic fleet serverFleet Server sensitive information exposure via logs9.0 Critical
- elastic kibanaKibana allocation of resources without limits or throttling leads to crash6.5 Medium
- elastic kibanaKibana exposure of sensitive information to an unauthorized actor7.7 High
- elastic kibanaKibana server-side request forgery4.3 Medium
- nodejs nodeA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY...5.3 Medium
- go standard library crypto/x509Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x5096.1 Medium
- envoyproxy gatewayEnvoy Admin Interface Exposed through prometheus metrics endpoint7.1 High
- hcl software bigfix patch management download plug-insHCL BigFix Patch Download Plug-ins are affected by path traversal vulnerability5.3 Medium
- hcl software bigfix patch management download plug-insHCL BigFix Patch Download Plug-ins are affected by an insecure protocol support2.8 Low
- ibm sterling b2b integrator, sterling b2b integrator standard edition +1 moreIBM Sterling B2B Integrator cross-site scripting6.4 Medium
- ibm sterling b2b integrator, sterling b2b integrator standard edition +1 moreIBM Sterling B2B Integrator cross-site scripting4.6 Medium
- hcl software bigfix patch management download plug-insHCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks2.5 Low
- hcl software bigfix patch management download plug-insHCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme2.5 Low
- hcl software bigfix patch management download plug-insHCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability2.5 Low
- hcl software bigfix patch management download plug-insHCL BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability2.5 Low
- phpmyadminphpMyAdmin XSS when checking tables6.4 Medium
- phpmyadminAn issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered...6.4 Medium
- qtQLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to...3.1 Low
- sammycage lunasvglunasvg v3.0.0 was discovered to contain a segmentation violation via the component...6.5 Medium
- sammycage lunasvglunasvg v3.0.0 was discovered to contain a segmentation violation via the component...6.5 Medium
- sammycage lunasvglunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component...7.5 High
- sammycage lunasvglunasvg v3.0.0 was discovered to contain a segmentation violation via the component...6.5 Medium
- sammycage lunasvglunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.6.5 Medium
- sammycage lunasvglunasvg v3.0.0 was discovered to contain a segmentation violation via the component...6.5 Medium
- nbubna storeCross Site Scripting vulnerability in store26.1 Medium
- wallosapp wallosCross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute...6.1 Medium
- hortusfoxHortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input...5.4 Medium
- projectworlds online food ordering systemA SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. The...9.8 Critical
- online pizza delivery system project pizza delivery systemA Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online...6.1 Medium
- No product listedSQL Injection vulnerability in the default configuration of the Logitime WebClock application <=...10.0 Critical
- centreon webAn issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9,...9.1 Critical
openimageioDebianAn allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may...7.5 High- openimageioOpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO...9.8 Critical
- openimageioOpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component ...9.8 Critical
- openimageioOpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component...9.8 Critical
- centreon webAn issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x...9.1 Critical
- No product listedA DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via...7.8 High
- No product listedHeap buffer overflow in the server site handshake implementation in Real Time Logic LLC's...7.5 High
- gpacgpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio...5.5 Medium
- gpacgpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in...7.8 High
- kwhotelKWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.9.8 Critical
- kwhotelKWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.9.8 Critical
- theme-fusion avada builder, themefusion avada (fusion) builder +1 moreAvada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets6.4 Medium
- Show moreLoading…