CVEs published January 6, 2025
106 CVEs were published on January 6, 2025: 10 critical, 40 high.
- Published
- 106
- Critical
- 10
- High
- 40
- Medium
- 46
- Low
- 4
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Qualcomm Snapdragon
- 19
- Linux
- 12
- OISF suricata
- 5
- FFmpeg
- 3
- Grocy project Grocy
- 3
- IBM Sterling B2B Integrator Standard Edition
- 2
- MediaTek MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, M…
- 2
- MediaTek MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT…
- 2
- MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- 2
- redis
- 2
Critical 10
- CVE-2025-21613go-git has an Argument Injection via the URL fieldgo-git · github.com/go-git/go-git/v4 +2
- CVE-2024-5594OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arOpenVPN
- CVE-2024-20148In wlan STA FW, there is a possible out of bounds write due to improper input validation.MediaTek MT3603, MT6835, MT6878, MT6886, MT6897, MT7902, MT…
- CVE-2024-46622An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8
- CVE-2024-53931The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no perm
- CVE-2024-53932The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enable
- CVE-2024-54879SeaCMS V13.1 is vulnerable to Incorrect Access Control.
- CVE-2024-54880SeaCMS V13.1 is vulnerable to Incorrect Access Control.
- CVE-2024-55529Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.
- CVE-2024-56828File Upload vulnerability in ChestnutCMS through 1.5.0.
High 40
- CVE-2025-21620Deno's authorization headers not dropped when redirecting cross-origindenoland deno · deno_fetch +1
- CVE-2024-46981Redis' Lua library commands may lead to remote code executionredis
- CVE-2024-55629Suricata generic detection bypass using TCP urgent supportOISF suricata
- CVE-2024-55628Suricata oversized resource names utilizing DNS name compression can lead to resource starvationOISF suricata
- CVE-2024-55605Suricata allows stack overflow in transformsOISF suricata
- CVE-2023-6605Ffmpeg: dash playlist ssrf vulnerability in ffmpegFFmpeg
- CVE-2025-21618NiceGUI On Air authentication issuezauberzeug nicegui · nicegui
- CVE-2024-56765powerpc/pseries/vas: Add close() callback in vas_vm_ops structLinux
- CVE-2024-56764ublk: detach gendisk from ublk device if add_disk() failsLinux
- CVE-2024-56759btrfs: fix use-after-free when COWing tree bock and tracing is enabledLinux
- CVE-2024-56757Bluetooth: btusb: mediatek: add intf release flow when usb disconnectLinux
- CVE-2025-21614go-git clients vulnerable to DoS via maliciously crafted Git server repliesgo-git · github.com/go-git/go-git/v4 +3
- CVE-2025-21612Cross-site Scripting in TabberTransclude in Extension:TabberNeueStarCitizenTools mediawiki-extensions-TabberNeue · starciti…
- CVE-2025-21611tgstation-server's role authorization incorrectly OR'd with user's enabled statustgstation-server
- CVE-2024-8474OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, OpenVPN Connect
- CVE-2024-45558Buffer Over-read in WLAN Host CmnQualcomm Snapdragon
- CVE-2024-45555Integer Overflow to Buffer Overflow in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-45553Use After Free in DSP ServicesQualcomm Snapdragon
- CVE-2024-45550Improper Validation of Array Index in DSP ServicesQualcomm Snapdragon
- CVE-2024-45548Buffer Over-read in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-45547Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-45546Buffer Over-read in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-45542Stack-based Buffer Overflow in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-45541Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-43064Permissions, Privileges, and Access Controls issue in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-21464Buffer Copy Without Checking Size of Input in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-20153In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID.MediaTek MT2737, MT6989, MT6991, MT7925, MT8365, MT8518S, M…
- CVE-2024-20150In Modem, there is a possible system crash due to a logic error.MediaTek MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, M…
- CVE-2024-20149In Modem, there is a possible system crash due to improper input validation.MediaTek MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, M…
- CVE-2024-20146In wlan STA driver, there is a possible out of bounds write due to improper input validation.MediaTek MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT…
- CVE-2024-20154In Modem, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2735, MT6767, MT6768, MT6769, MT6769K, MT6769S,…
- CVE-2021-27285An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands
- CVE-2024-48456An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
- CVE-2024-48457An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
- CVE-2024-53934The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables
- CVE-2024-54767An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information w
- CVE-2024-55074The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG filGrocy project Grocy
- CVE-2024-55076Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.Grocy project Grocy
- CVE-2024-55407An issue in the DeviceloControl function of ITE Tech.
- CVE-2024-55553In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the inte
Medium, low and unrated 56
- CVE-2025-21616Plane has a Cross-site scripting (XSS) via SVG image uploadmakeplane plane
- CVE-2024-51741Redis allows denial-of-service due to malformed ACL selectorsredis
- CVE-2025-21617Guzzle OAuth Subscriber has insufficient nonce entropyguzzle oauth-subscriber · guzzlehttp/oauth-subscriber
- CVE-2024-55627Suricata segfault on StreamingBufferSlideToOffsetWithRegionsOISF suricata
- CVE-2024-55626Suricata oversized bpf file can lead to buffer overflowOISF suricata
- CVE-2024-47475Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability.Dell PowerScale OneFS
- CVE-2023-6604Ffmpeg: hls xbin demuxer dos amplification in ffmpegFFmpeg
- CVE-2023-6601Ffmpeg: hls unsafe file extension bypass in ffmpegFFmpeg
- CVE-2024-51472IBM DevOps Deploy / IBM UrbanCode Deploy HTML injectionIBM DevOps Deploy · IBM UrbanCode Deploy
- CVE-2025-21615AAT allows data exfiltration by other apps installed on the same devicebailuk AAT
- CVE-2024-56769media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_regLinux
- CVE-2024-56768bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMPLinux
- CVE-2024-56767dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memsetLinux
- CVE-2024-56766mtd: rawnand: fix double free in atmel_pmecc_create_user()Linux
- CVE-2024-56763tracing: Prevent bad count for tracing_cpumask_writeLinux
- CVE-2024-56761x86/fred: Clear WFE in missing-ENDBRANCH #CPsLinux
- CVE-2024-56760PCI/MSI: Handle lack of irqdomain gracefullyLinux
- CVE-2024-56758btrfs: check folio mapping after unlock in relocate_one_folio()Linux
- CVE-2024-31914IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator Standard Edition
- CVE-2024-31913IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator Standard Edition
- CVE-2025-21604LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflictsmoyangzhan langchain4j-aideepin
- CVE-2024-12970OS Command Injection in TUBITAK BILGEM's Pardus OS My ComputerTUBITAK BILGEM Pardus OS My Computer
- CVE-2024-45559Buffer Over-read in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-43063Buffer Over-read in Automotive AutonomyQualcomm Snapdragon
- CVE-2024-33067Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2024-33061Buffer Over-read in DSP ServiceQualcomm Snapdragon
- CVE-2024-33059Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2024-33055Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2024-33041Use of Out-of-range Pointer Offset in Computer VisionQualcomm Snapdragon
- CVE-2024-23366Buffer Over-read in Automotive AutonomyQualcomm Snapdragon
- CVE-2024-12311Email Subscribers < 5.7.44 - Admin+ SQL InjectionEmail Subscribers by Icegram Express
- CVE-2024-12302Icegram Engage < 3.1.32 - Author+ Stored XSSIcegram Engage
- CVE-2024-11849Pods – Custom Content Types and Fields < 3.2.8.1 - Admin+ Stored XSSPods
- CVE-2024-11356Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Bookingtourmaster
- CVE-2024-20152In wlan STA driver, there is a possible reachable assertion due to improper exception handling.MediaTek MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT…
- CVE-2024-20151In Modem, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT2737, MT2739, MT6789, MT6813, MT6815, MT6835, MT…
- CVE-2024-20105In m4u, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-20145In V6 DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- CVE-2024-20144In V6 DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT…
- CVE-2024-20143In V6 DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- CVE-2024-20140In power, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6768, MT6781, MT6833, MT6853, MT…
- CVE-2024-13145zhenfeng13 My-Blog uploadController. java upload unrestricted uploadzhenfeng13 My-Blog
- CVE-2024-13144zhenfeng13 My-Blog BlogController.java uploadFileByEditomd unrestricted uploadzhenfeng13 My-Blog
- CVE-2024-35498A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.getgrav/grav
- CVE-2024-46073A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS.
- CVE-2024-46209A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrredaxo/source
- CVE-2024-48455An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
- CVE-2024-51111Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are execute
- CVE-2024-51112Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a c
- CVE-2024-53933The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any appl
- CVE-2024-53935The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (wit
- CVE-2024-53936The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissi
- CVE-2024-54763An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information witho
- CVE-2024-54764An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information with
- CVE-2024-55075Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such Grocy project Grocy
- CVE-2024-55408An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver whASUS ASCI