# CVEs published 2025-01-06

106 CVEs were published on January 6, 2025: 10 critical, 40 high. Days are UTC.

- [CVE-2025-21620](https://cve.now/CVE-2025-21620.md): Deno's authorization headers not dropped when redirecting cross-origin (CVSS 7.5, denoland deno · deno\_fetch +1)
- [CVE-2025-21616](https://cve.now/CVE-2025-21616.md): Plane has a Cross-site scripting (XSS) via SVG image upload (CVSS 5.4, makeplane plane)
- [CVE-2024-51741](https://cve.now/CVE-2024-51741.md): Redis allows denial-of-service due to malformed ACL selectors (CVSS 4.4, redis)
- [CVE-2024-46981](https://cve.now/CVE-2024-46981.md): Redis' Lua library commands may lead to remote code execution (CVSS 7.0, redis)
- [CVE-2025-21617](https://cve.now/CVE-2025-21617.md): Guzzle OAuth Subscriber has insufficient nonce entropy (CVSS 6.3, guzzle oauth-subscriber · guzzlehttp/oauth-subscriber)
- [CVE-2024-55629](https://cve.now/CVE-2024-55629.md): Suricata generic detection bypass using TCP urgent support (CVSS 7.5, OISF suricata)
- [CVE-2024-55628](https://cve.now/CVE-2024-55628.md): Suricata oversized resource names utilizing DNS name compression can lead to resource starvation (CVSS 7.5, OISF suricata)
- [CVE-2024-55627](https://cve.now/CVE-2024-55627.md): Suricata segfault on StreamingBufferSlideToOffsetWithRegions (CVSS 5.9, OISF suricata)
- [CVE-2024-55626](https://cve.now/CVE-2024-55626.md): Suricata oversized bpf file can lead to buffer overflow (CVSS 3.3, OISF suricata)
- [CVE-2024-47475](https://cve.now/CVE-2024-47475.md): Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. (CVSS 5.0, Dell PowerScale OneFS)
- [CVE-2024-55605](https://cve.now/CVE-2024-55605.md): Suricata allows stack overflow in transforms (CVSS 7.5, OISF suricata)
- [CVE-2023-6605](https://cve.now/CVE-2023-6605.md): Ffmpeg: dash playlist ssrf vulnerability in ffmpeg (CVSS 7.2, FFmpeg)
- [CVE-2023-6604](https://cve.now/CVE-2023-6604.md): Ffmpeg: hls xbin demuxer dos amplification in ffmpeg (CVSS 5.3, FFmpeg)
- [CVE-2023-6601](https://cve.now/CVE-2023-6601.md): Ffmpeg: hls unsafe file extension bypass in ffmpeg (CVSS 4.7, FFmpeg)
- [CVE-2024-51472](https://cve.now/CVE-2024-51472.md): IBM DevOps Deploy / IBM UrbanCode Deploy HTML injection (CVSS 3.1, IBM DevOps Deploy · IBM UrbanCode Deploy)
- [CVE-2025-21618](https://cve.now/CVE-2025-21618.md): NiceGUI On Air authentication issue (CVSS 7.5, zauberzeug nicegui · nicegui)
- [CVE-2025-21615](https://cve.now/CVE-2025-21615.md): AAT allows data exfiltration by other apps installed on the same device (CVSS 5.5, bailuk AAT)
- [CVE-2024-56769](https://cve.now/CVE-2024-56769.md): media: dvb-frontends: dib3000mb: fix uninit-value in dib3000\_write\_reg (no CVSS, Linux)
- [CVE-2024-56768](https://cve.now/CVE-2024-56768.md): bpf: Fix bpf\_get\_smp\_processor\_id() on !CONFIG\_SMP (CVSS 5.5, Linux)
- [CVE-2024-56767](https://cve.now/CVE-2024-56767.md): dmaengine: at\_xdmac: avoid null\_prt\_deref in at\_xdmac\_prep\_dma\_memset (no CVSS, Linux)
- [CVE-2024-56766](https://cve.now/CVE-2024-56766.md): mtd: rawnand: fix double free in atmel\_pmecc\_create\_user() (no CVSS, Linux)
- [CVE-2024-56765](https://cve.now/CVE-2024-56765.md): powerpc/pseries/vas: Add close() callback in vas\_vm\_ops struct (CVSS 7.8, Linux)
- [CVE-2024-56764](https://cve.now/CVE-2024-56764.md): ublk: detach gendisk from ublk device if add\_disk() fails (CVSS 7.8, Linux)
- [CVE-2024-56763](https://cve.now/CVE-2024-56763.md): tracing: Prevent bad count for tracing\_cpumask\_write (no CVSS, Linux)
- [CVE-2024-56761](https://cve.now/CVE-2024-56761.md): x86/fred: Clear WFE in missing-ENDBRANCH #CPs (no CVSS, Linux)
- [CVE-2024-56760](https://cve.now/CVE-2024-56760.md): PCI/MSI: Handle lack of irqdomain gracefully (CVSS 5.5, Linux)
- [CVE-2024-56759](https://cve.now/CVE-2024-56759.md): btrfs: fix use-after-free when COWing tree bock and tracing is enabled (CVSS 7.8, Linux)
- [CVE-2024-56758](https://cve.now/CVE-2024-56758.md): btrfs: check folio mapping after unlock in relocate\_one\_folio() (no CVSS, Linux)
- [CVE-2024-56757](https://cve.now/CVE-2024-56757.md): Bluetooth: btusb: mediatek: add intf release flow when usb disconnect (CVSS 7.8, Linux)
- [CVE-2025-21614](https://cve.now/CVE-2025-21614.md): go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVSS 7.5, go-git · github.com/go-git/go-git/v4 +3)
- [CVE-2025-21613](https://cve.now/CVE-2025-21613.md): go-git has an Argument Injection via the URL field (CVSS 9.2, go-git · github.com/go-git/go-git/v4 +2)
- [CVE-2024-31914](https://cve.now/CVE-2024-31914.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 6.4, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2024-31913](https://cve.now/CVE-2024-31913.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 5.5, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2025-21612](https://cve.now/CVE-2025-21612.md): Cross-site Scripting in TabberTransclude in Extension:TabberNeue (CVSS 8.6, StarCitizenTools mediawiki-extensions-TabberNeue · starciti…)
- [CVE-2025-21611](https://cve.now/CVE-2025-21611.md): tgstation-server's role authorization incorrectly OR'd with user's enabled status (CVSS 8.8, tgstation-server)
- [CVE-2025-21604](https://cve.now/CVE-2025-21604.md): LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts (CVSS 6.9, moyangzhan langchain4j-aideepin)
- [CVE-2024-8474](https://cve.now/CVE-2024-8474.md): OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, (CVSS 7.5, OpenVPN Connect)
- [CVE-2024-5594](https://cve.now/CVE-2024-5594.md): OpenVPN before 2.6.11 does not santize PUSH\_REPLY messages properly which an attacker controlling the server can use to inject unexpected ar (CVSS 9.1, OpenVPN)
- [CVE-2024-12970](https://cve.now/CVE-2024-12970.md): OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer (CVSS 3.9, TUBITAK BILGEM Pardus OS My Computer)
- [CVE-2024-45559](https://cve.now/CVE-2024-45559.md): Buffer Over-read in Automotive OS Platform (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2024-45558](https://cve.now/CVE-2024-45558.md): Buffer Over-read in WLAN Host Cmn (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-45555](https://cve.now/CVE-2024-45555.md): Integer Overflow to Buffer Overflow in Automotive OS Platform (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-45553](https://cve.now/CVE-2024-45553.md): Use After Free in DSP Services (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45550](https://cve.now/CVE-2024-45550.md): Improper Validation of Array Index in DSP Services (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45548](https://cve.now/CVE-2024-45548.md): Buffer Over-read in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45547](https://cve.now/CVE-2024-45547.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45546](https://cve.now/CVE-2024-45546.md): Buffer Over-read in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45542](https://cve.now/CVE-2024-45542.md): Stack-based Buffer Overflow in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-45541](https://cve.now/CVE-2024-45541.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43064](https://cve.now/CVE-2024-43064.md): Permissions, Privileges, and Access Controls issue in Automotive OS Platform (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-43063](https://cve.now/CVE-2024-43063.md): Buffer Over-read in Automotive Autonomy (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2024-33067](https://cve.now/CVE-2024-33067.md): Buffer Over-read in Audio (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2024-33061](https://cve.now/CVE-2024-33061.md): Buffer Over-read in DSP Service (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2024-33059](https://cve.now/CVE-2024-33059.md): Use After Free in Computer Vision (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33055](https://cve.now/CVE-2024-33055.md): Use After Free in Computer Vision (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33041](https://cve.now/CVE-2024-33041.md): Use of Out-of-range Pointer Offset in Computer Vision (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23366](https://cve.now/CVE-2024-23366.md): Buffer Over-read in Automotive Autonomy (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2024-21464](https://cve.now/CVE-2024-21464.md): Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-12311](https://cve.now/CVE-2024-12311.md): Email Subscribers \< 5.7.44 - Admin+ SQL Injection (CVSS 6.5, Email Subscribers by Icegram Express)
- [CVE-2024-12302](https://cve.now/CVE-2024-12302.md): Icegram Engage \< 3.1.32 - Author+ Stored XSS (CVSS 6.1, Icegram Engage)
- [CVE-2024-11849](https://cve.now/CVE-2024-11849.md): Pods – Custom Content Types and Fields \< 3.2.8.1 - Admin+ Stored XSS (CVSS 6.1, Pods)
- [CVE-2024-11356](https://cve.now/CVE-2024-11356.md): Tourmaster \< 5.3.4 - Unauthenticated Stored XSS via Room Booking (CVSS 6.1, tourmaster)
- [CVE-2024-20153](https://cve.now/CVE-2024-20153.md): In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. (CVSS 7.5, MediaTek MT2737, MT6989, MT6991, MT7925, MT8365, MT8518S, M…)
- [CVE-2024-20152](https://cve.now/CVE-2024-20152.md): In wlan STA driver, there is a possible reachable assertion due to improper exception handling. (CVSS 4.4, MediaTek MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT…)
- [CVE-2024-20151](https://cve.now/CVE-2024-20151.md): In Modem, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT2737, MT2739, MT6789, MT6813, MT6815, MT6835, MT…)
- [CVE-2024-20150](https://cve.now/CVE-2024-20150.md): In Modem, there is a possible system crash due to a logic error. (CVSS 7.5, MediaTek MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, M…)
- [CVE-2024-20149](https://cve.now/CVE-2024-20149.md): In Modem, there is a possible system crash due to improper input validation. (CVSS 7.5, MediaTek MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, M…)
- [CVE-2024-20105](https://cve.now/CVE-2024-20105.md): In m4u, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20148](https://cve.now/CVE-2024-20148.md): In wlan STA FW, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT3603, MT6835, MT6878, MT6886, MT6897, MT7902, MT…)
- [CVE-2024-20146](https://cve.now/CVE-2024-20146.md): In wlan STA driver, there is a possible out of bounds write due to improper input validation. (CVSS 8.1, MediaTek MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT…)
- [CVE-2024-20145](https://cve.now/CVE-2024-20145.md): In V6 DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…)
- [CVE-2024-20144](https://cve.now/CVE-2024-20144.md): In V6 DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT…)
- [CVE-2024-20143](https://cve.now/CVE-2024-20143.md): In V6 DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT…)
- [CVE-2024-20140](https://cve.now/CVE-2024-20140.md): In power, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6768, MT6781, MT6833, MT6853, MT…)
- [CVE-2024-20154](https://cve.now/CVE-2024-20154.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, MediaTek MT2735, MT6767, MT6768, MT6769, MT6769K, MT6769S,…)
- [CVE-2024-13145](https://cve.now/CVE-2024-13145.md): zhenfeng13 My-Blog uploadController. java upload unrestricted upload (CVSS 5.3, zhenfeng13 My-Blog)
- [CVE-2024-13144](https://cve.now/CVE-2024-13144.md): zhenfeng13 My-Blog BlogController.java uploadFileByEditomd unrestricted upload (CVSS 5.3, zhenfeng13 My-Blog)
- [CVE-2021-27285](https://cve.now/CVE-2021-27285.md): An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands (CVSS 8.4)
- [CVE-2024-35498](https://cve.now/CVE-2024-35498.md): A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. (CVSS 6.1, getgrav/grav)
- [CVE-2024-46073](https://cve.now/CVE-2024-46073.md): A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. (CVSS 6.1)
- [CVE-2024-46209](https://cve.now/CVE-2024-46209.md): A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitr (CVSS 5.4, redaxo/source)
- [CVE-2024-46622](https://cve.now/CVE-2024-46622.md): An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8 (CVSS 9.8)
- [CVE-2024-48455](https://cve.now/CVE-2024-48455.md): An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0 (CVSS 2.7)
- [CVE-2024-48456](https://cve.now/CVE-2024-48456.md): An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0 (CVSS 7.5)
- [CVE-2024-48457](https://cve.now/CVE-2024-48457.md): An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0 (CVSS 7.5)
- [CVE-2024-51111](https://cve.now/CVE-2024-51111.md): Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are execute (CVSS 4.1)
- [CVE-2024-51112](https://cve.now/CVE-2024-51112.md): Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a c (CVSS 6.1)
- [CVE-2024-53931](https://cve.now/CVE-2024-53931.md): The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no perm (CVSS 9.1)
- [CVE-2024-53932](https://cve.now/CVE-2024-53932.md): The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enable (CVSS 9.1)
- [CVE-2024-53933](https://cve.now/CVE-2024-53933.md): The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any appl (CVSS 6.3)
- [CVE-2024-53934](https://cve.now/CVE-2024-53934.md): The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables (CVSS 7.7)
- [CVE-2024-53935](https://cve.now/CVE-2024-53935.md): The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (wit (CVSS 6.5)
- [CVE-2024-53936](https://cve.now/CVE-2024-53936.md): The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissi (CVSS 6.3)
- [CVE-2024-54763](https://cve.now/CVE-2024-54763.md): An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information witho (CVSS 6.5)
- [CVE-2024-54764](https://cve.now/CVE-2024-54764.md): An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information with (CVSS 6.5)
- [CVE-2024-54767](https://cve.now/CVE-2024-54767.md): An access control issue in the component /juis\_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information w (CVSS 7.5)
- [CVE-2024-54879](https://cve.now/CVE-2024-54879.md): SeaCMS V13.1 is vulnerable to Incorrect Access Control. (CVSS 9.1)
- [CVE-2024-54880](https://cve.now/CVE-2024-54880.md): SeaCMS V13.1 is vulnerable to Incorrect Access Control. (CVSS 9.1)
- [CVE-2024-55074](https://cve.now/CVE-2024-55074.md): The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG fil (CVSS 8.8, Grocy project Grocy)
- [CVE-2024-55075](https://cve.now/CVE-2024-55075.md): Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such (CVSS 4.3, Grocy project Grocy)
- [CVE-2024-55076](https://cve.now/CVE-2024-55076.md): Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. (CVSS 8.1, Grocy project Grocy)
- [CVE-2024-55407](https://cve.now/CVE-2024-55407.md): An issue in the DeviceloControl function of ITE Tech. (CVSS 7.8)
- [CVE-2024-55408](https://cve.now/CVE-2024-55408.md): An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver wh (CVSS 5.1, ASUS ASCI)
- [CVE-2024-55529](https://cve.now/CVE-2024-55529.md): Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \\zb\_users\\theme\\shell\\template. (CVSS 9.8)
- [CVE-2024-55553](https://cve.now/CVE-2024-55553.md): In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the inte (CVSS 7.5)
- [CVE-2024-56828](https://cve.now/CVE-2024-56828.md): File Upload vulnerability in ChestnutCMS through 1.5.0. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.