CVEs published in January 2025
4,247 vulnerabilities, 364 critical, 17 exploited.
- No product listedAvi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was...8.6 High
- pankajindevops scalepankajindevops scale API Endpoint access control5.3 Medium
- rockwell automation powerflex 755PowerFlex® 755 Credential Exposure Vulnerability8.7 High
- red hat openshift gitops 1.14, openshift gitops 1.15, openshift gitops 1.16 +2 moreOpenshift-gitops-operator-container: namespace isolation break8.2 High
- arubanetworks fabric composer, hewlett packard enterprise (hpe) hpe aruba networking fabric composer (afc) +1 moreAuthenticated privilege escalation via broken access control6.5 Medium
- arubanetworks fabric composer, hewlett packard enterprise (hpe) hpe aruba networking fabric composer (afc) +1 moreAuthenticated Response Manipulation allows Unauthorized Actions in Management Interface6.5 Medium
- arubanetworks fabric composer, hewlett packard enterprise (hpe) hpe aruba networking fabric composer (afc) +1 moreAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface5.5 Medium
- arubanetworks fabric composer, hewlett packard enterprise (hpe) hpe aruba networking fabric composer (afc) +1 moreAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface5.5 Medium
- arubanetworks fabric composer, hewlett packard enterprise (hpe) hpe aruba networking fabric composer (afc) +1 moreAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface5.5 Medium
- google androidIn BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information...6.2 Medium
- google androidIn TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a...8.8 High
- google androidIn HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to...5.7 Medium
- google androidIn HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read...5.7 Medium
- schneider electric ecostruxure power monitoring expert (pme) 2020, ecostruxure power monitoring expert (pme) 2021, ecostruxure power operation (epo) 2021 +4 more +6 moreCWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)...5.4 Medium
- flightgear simgear, debian linux +1 moreIncorrect Authorization in SimGear8.6 High
- jetbrains dottrace, etw host service, resharper +1 more +3 moreIn JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8,...7.8 High
- hms networks ewon flexy 202HMS Networks Ewon Flexy 202 Cleartext Transmission of Sensitive Information6.9 Medium
- polytope-labs hyperbridgeCritical vulnerability in `ismp-grandpa` <v15.0.19.3 Critical
- tandoor recipesTandoor Recipes - Stored XSS through Unrestricted File Upload8.7 High
- tandoor recipesTandoor Recipes - Local file disclosure - Users can read the content of any file on the server7.7 High
- tandoor recipesTandoor Recipes - SSTI - Remote Code Execution10.0 Critical
- cvat computer vision annotation tool, cvat-ai cvat +1 moreCVAT allows remote code execution via tracker Nuclio functions8.7 High
- rockwell automation dataedgeplatform datamosaix™ private cloudPath Traversal and Rockwell Automation Third-party Vulnerability in DataMosaix™ Private Cloud7.0 High
- arm c1-premium, c1-premium firmware, c1-pro +15 more +17 moreAn unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents...5.1 Medium
- silabs.com sisdkMalformed packet leads to denial of service in NWK/APS layer4.3 Medium
- pimcore customer-data-framework, pimcore +1 morePimcore customer-data-framework list sql injection5.1 Medium
- pimcorePimcore Search Document cross site scripting5.1 Medium
rsyncUbuntursync vulnerabilitiesNo score- teamviewer remote full client, remote host +1 moreImproper Neutralization of Argument Delimiters in TeamViewer Clients7.8 High
- red hat openshift service mesh 2Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing4.3 Medium
- red hat openshift service mesh 2, redhat openshift service mesh +1 moreEnvoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access7.1 High
- red hat openshift container platform 4, openshift container platform 4.17, openshift container platform 4.18 +2 moreCri-o: cri-o path traversal in log handling functions allows arbitrary unmounting6.6 Medium
- red hat data gridOrg.infinispan-infinispan-parent: exposure of sensitive information in application logs5.5 Medium
- apache hiveApache Hive: Timing Attack Against Signature in LLAP util6.5 Medium
- gitlabLoop with Unreachable Exit Condition ('Infinite Loop') in GitLab4.3 Medium
- philantro, philantro – donations and donor management +1 morePhilantro – Donations and Donor Management <= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode6.4 Medium
- ghera74 mailup auto subscriptionMailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- wpmet elementskit, elementskit pro +1 moreElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter6.4 Medium
- westguardsolutions ws form, ws form pro, westguard ws form lite – drag & drop contact form builder +2 moreWS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting7.2 High
- themerex addonsThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data9.8 Critical
- artlosk social share buttons, unknown social share buttons for wordpress +1 moreSocial Share Buttons for WordPress <= 2.7 - Admin+ Stored XSS4.8 Medium
- infility global, unknown infility global +1 moreInfility Global <= 2.9.8 - Reflected XSS6.1 Medium
- rahe simple image sizesCross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this...4.8 Medium
- nodejs node, node.js +1 moreA vulnerability has been identified in Node.js, specifically affecting the handling of drive...5.6 Medium
- imithemes eventer, eventer - wordpress event & booking manager plugin +1 moreEventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees7.5 High
- nvidia vgpu softwareNVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to...5.5 Medium
- nvidia vgpu softwareNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest...7.8 High
- nvidia rapids cudf and cumlNVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a...6.8 Medium
- nvidia container toolkit, gpu operator +1 moreNVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted...5.5 Medium
- nvidia container toolkit, gpu operator +1 moreNVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted...7.6 High
- Show moreLoading…