CVEs published January 3, 2025
53 CVEs were published on January 3, 2025: 6 critical, 20 high.
- Published
- 53
- Critical
- 6
- High
- 20
- Medium
- 24
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Google Android
- 12
- code-projects Point of Sales and Inventory Management System
- 7
- PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- 7
- gocd
- 4
- IBM i
- 2
- IBM Jazz Foundation
- 2
- karmada-io karmada · github.com/karmada-io/karmada
- 2
- basecamp trix · trix
- 1
- code-projects Online Shop
- 1
- hcabrera WP Popular Posts
- 1
Critical 6
- CVE-2024-56320GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated usergocd
- CVE-2024-9140Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140.Moxa EDR-8010 Series · Moxa EDR-G9004 Series +5
- CVE-2024-53842In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-55078An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbi
- CVE-2024-55507An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component.
- CVE-2025-22275iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by readiniTerm2
High 20
- CVE-2024-11733WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Executionhcabrera WP Popular Posts
- CVE-2024-13129Roxy-WI roxy.py action_service os command injectionRoxy-WI
- CVE-2024-56409PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php filePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-56366PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php filePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-56365PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader classPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2025-21609SiYuan has an arbitrary file deletion vulnerabilitysiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2024-56513Karmada PULL Mode Cluster Privilege Escalationkarmada-io karmada · github.com/karmada-io/karmada
- CVE-2024-56408PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` filePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-9138Privilege Escalation in Cellular Router, Secure Router, and Network Security AppliancesMoxa EDR-810 Series · Moxa EDR-8010 Series +8
- CVE-2024-53841In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy.Google Android
- CVE-2024-53840there is a possible biometric bypass due to an unusual root cause.Google Android
- CVE-2024-53838In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds write due to an incorrect bounds cGoogle Android
- CVE-2024-53837In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2024-53835there is a possible biometric bypass due to an unusual root cause.Google Android
- CVE-2024-53834In sms_DisplayHexDumpOfPrivacyBuffer of sms_Utilities.c, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2024-53833In prepare_response_locked of lwis_transaction.c, there is a possible out of bounds write due to improper input validation.Google Android
- CVE-2024-47032In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2024-11624there is a possible to add apps to bypass VPN due to Undeclared Permission .Google Android
- CVE-2024-35365FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stre
- CVE-2024-48814SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the f
Medium, low and unrated 27
- CVE-2025-0199code-projects Point of Sales and Inventory Management System minus_cart.php sql injectioncode-projects Point of Sales and Inventory Management System
- CVE-2024-55897IBM PowerHA SystemMirror for i information disclosureIBM i
- CVE-2024-55896IBM PowerHA SystemMirror for i clickjackingIBM i
- CVE-2024-12237Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgerynik00726 Photo Gallery Slideshow & Masonry Tiled Gallery
- CVE-2025-0198code-projects Point of Sales and Inventory Management System search_result.php sql injectioncode-projects Point of Sales and Inventory Management System
- CVE-2024-56332Next.js Vulnerable to Denial of Service (DoS) with Server Actionsvercel next.js · next
- CVE-2025-0197code-projects Point of Sales and Inventory Management System search.php sql injectioncode-projects Point of Sales and Inventory Management System
- CVE-2025-0196code-projects Point of Sales and Inventory Management System plist.php sql injectioncode-projects Point of Sales and Inventory Management System
- CVE-2025-0195code-projects Point of Sales and Inventory Management System del_product.php sql injectioncode-projects Point of Sales and Inventory Management System
- CVE-2024-56412PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special charactersPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-56411PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page headerPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-56410PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom propertiesPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2025-21610Trix allows Cross-site Scripting via `javascript:` url in a linkbasecamp trix · trix
- CVE-2024-56514Karmada Tar Slips in CRDs archive extractionkarmada-io karmada · github.com/karmada-io/karmada
- CVE-2024-56324GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group adminsgocd
- CVE-2024-56322GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionalitygocd
- CVE-2024-56321GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host accessgocd
- CVE-2024-41780IBM Jazz Foundation information disclosureIBM Jazz Foundation
- CVE-2024-5591IBM Jazz Foundation information disclosureIBM Jazz Foundation
- CVE-2024-12132WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Referencewpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-53839In GetCellInfoList() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-53836In wbrc_bt_dev_write of wb_regon_coordinator.c, there is a possible out of bounds write due to a buffer overflow.Google Android
- CVE-2025-0176code-projects Point of Sales and Inventory Management System add_cart.php sql injectioncode-projects Point of Sales and Inventory Management System
- CVE-2025-0175code-projects Online Shop view.php cross site scriptingcode-projects Online Shop
- CVE-2025-0174code-projects Point of Sales and Inventory Management System Parameter search_result2.php sql injectioncode-projects Point of Sales and Inventory Management System
- CVE-2024-36613FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a
- CVE-2025-22376In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand