CVEs published January 10, 2025
72 CVEs were published on January 10, 2025: 15 critical, 17 high. Browse them by severity, product and exploitation status.
- Published
- 72
- Critical
- 15
- High
- 17
- Medium
- 39
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Arista Networks Arista Edge Threat Management
- 9
- LabRedesCefetRJ WeGIA
- 5
- Vanderbilt REDCap
- 4
- microweber/microweber
- 3
- Arista Networks EOS
- 2
- Jan Syski MegaBIP
- 2
- librdf Raptor RDF Syntax Library
- 2
- opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…
- 2
- themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- 2
- Arista Networks CloudVision Appliance
- 1
Critical 15
- CVE-2024-12847NETGEAR DGN setup.cgi OS Command InjectionNETGEAR DGN1000
- CVE-2025-22152Improper Path Validation Enables Path Traversal in Multiple Components in AtheosAtheos
- CVE-2024-56511DataEase has an unauthorized vulnerabilitydataease
- CVE-2024-41787IBM Engineering Requirements Management DOORS Next code executionIBM Engineering Requirements Management DOORS Next
- CVE-2024-29970Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals.
- CVE-2024-29971Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals.
- CVE-2024-57223Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode…
- CVE-2024-57224Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps…
- CVE-2024-57225Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
- CVE-2024-57686A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which…
- CVE-2024-57687An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows…
- CVE-2024-57823In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in…librdf Raptor RDF Syntax Library
- CVE-2025-22946Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote…
- CVE-2025-22949Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code…
- CVE-2025-23016FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or…FastCGI fcgi
High 17
- CVE-2024-9188Specially constructed queries cause cross platform scripting leaking administrator tokensArista Networks Arista Edge Threat Management
- CVE-2024-47520A user with advanced report application access rights can perform actions for which they are not authorizedArista Networks Arista Edge Threat Management
- CVE-2024-47519Backup uploads to ETM subject to man-in-the-middle interceptionArista Networks Arista Edge Threat Management
- CVE-2024-9134Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can…Arista Networks Arista Edge Threat Management
- CVE-2024-9132The administrator is able to configure an insecure captive portal scriptArista Networks Arista Edge Threat Management
- CVE-2024-9131A user with administrator privileges can perform command injectionArista Networks Arista Edge Threat Management
- CVE-2024-6662CSRF in MegaBIPJan Syski MegaBIP
- CVE-2025-22598WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'cadastrarSocio.php' parameter 'nome'LabRedesCefetRJ WeGIA
- CVE-2025-22597WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'CobrancaController.php' parameter 'local_recepcao'LabRedesCefetRJ WeGIA
- CVE-2024-25371Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW…
- CVE-2024-46210An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via…
- CVE-2024-54848Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a…
- CVE-2024-54996MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description…
- CVE-2024-57211TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the…
- CVE-2024-57226Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
- CVE-2024-57227Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps…
- CVE-2024-57228Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
Medium, low and unrated 40
- CVE-2024-47518Specially constructed queries targeting ETM could discover active remote access sessionsArista Networks Arista Edge Threat Management
- CVE-2024-47517Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM accessArista Networks Arista Edge Threat Management
- CVE-2024-9133A user with administrator privileges is able to retrieve authentication tokensArista Networks Arista Edge Threat Management
- CVE-2024-7142On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only)…Arista Networks CloudVision Appliance
- CVE-2024-5872On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause…Arista Networks EOS
- CVE-2024-7095On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances…Arista Networks EOS
- CVE-2024-6437On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based…Arista Networks EOS-Policy Based Routing · Arista Networ… +1
- CVE-2025-23079XSSes in Extension:ArticleFeedbackv5Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension
- CVE-2025-23078XSS in BreadCrumbs2Wikimedia Foundation Mediawiki - Breadcrumbs2 extension
- CVE-2024-6880CSRF in MegaBIPJan Syski MegaBIP
- CVE-2025-22600WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `configuracao_doacao.php` parameter `avulso`LabRedesCefetRJ WeGIA
- CVE-2025-22599WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `home.php` parameter `msg_c`LabRedesCefetRJ WeGIA
- CVE-2025-22596WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint 'modulos_visiveis.php' parameter'msg_c'LabRedesCefetRJ WeGIA
- CVE-2024-13318Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletionsmartdatasoft Essential WP Real Estate
- CVE-2024-13183Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameterthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2025-0311Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widgetthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2024-12473AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <=…opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…
- CVE-2024-12606AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <=…opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…
- CVE-2024-33297Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name…microweber/microweber
- CVE-2024-33298Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new…microweber/microweber
- CVE-2024-33299Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last…microweber/microweber
- CVE-2024-50807Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions.
- CVE-2024-54687Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in…
- CVE-2024-54846An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a…
- CVE-2024-54847An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or…
Show all 40 entriesShow fewer entries
- CVE-2024-54849An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute…
- CVE-2024-54910Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.
- CVE-2024-54994MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in…
- CVE-2024-54997MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at…
- CVE-2024-54998MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at…
- CVE-2024-57212TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the…
- CVE-2024-57213TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the…
- CVE-2024-57214TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the…
- CVE-2024-57222Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps…
- CVE-2024-57822In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in…librdf Raptor RDF Syntax Library
- CVE-2025-23022FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.FreeType
- CVE-2025-23110An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap
- CVE-2025-23111An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap
- CVE-2025-23112An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap
- CVE-2025-23113An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap