CVEs published January 8, 2025
128 CVEs were published on January 8, 2025: 10 critical, 29 high. 2 are now in CISA KEV.
- Published
- 128
- Critical
- 10
- High
- 29
- Medium
- 87
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 27
Most affected products
- Huawei HarmonyOS
- 16
- Linux
- 16
- Huawei HarmonyOS · Huawei EMUI
- 12
- ZeroWdd myblog
- 4
- Cisco Common Services Platform Collector Software
- 3
- nickboss Iptanus File Upload
- 3
- nilsonLazarin WeGIA
- 3
- Dell VxRail HCI
- 2
- GitLab
- 2
- Ivanti Connect Secure · Ivanti Policy Secure +1
- 2
Critical 10
- CVE-2025-0282A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti NeuIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2025-22141WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'nilsonLazarin WeGIA
- CVE-2025-22140WeGIA SQL Injection (Blind Time-Based) endpoint 'dependente_listar_um.php' parameter 'id_dependente'nilsonLazarin WeGIA
- CVE-2024-56779nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occurLinux
- CVE-2025-22137Arbitrary File Overwrite via HTTP POST in Pingvin Sharestonith404 pingvin-share
- CVE-2024-54676Apache OpenMeetings: Deserialisation of untrusted data in cluster modeApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2024-11350AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeoverscriptsbundle AdForest
- CVE-2024-11635WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Executionnickboss Iptanus File Upload
- CVE-2024-11613WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletionnickboss Iptanus File Upload
- CVE-2024-50603An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996.Aviatrix Controller
High 29
- CVE-2025-0283A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti NeuIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2025-0291Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2024-56784drm/amd/display: Adding array index check to prevent memory corruptionLinux
- CVE-2024-56775drm/amd/display: Fix handling of plane refcountLinux
- CVE-2024-56772kunit: string-stream: Fix a UAF bug in kunit_init_suite()Linux
- CVE-2025-21111Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability.Dell VxRail HCI
- CVE-2023-35685In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code.Google Android
- CVE-2025-22136Tabby has a TCC Bypass via Misconfigured Node FusesEugeny tabby
- CVE-2024-55656RedisBloom Integer Overflow Remote Code Execution VulnerabilityRedisBloom
- CVE-2024-51737RediSearch Integer Overflow with LIMIT or KNN arguments can lead to RCERediSearch
- CVE-2024-51480RedisTimeSeries Integer Overflow Remote Code Execution VulnerabilityRedisTimeSeries
- CVE-2025-21102Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability.Dell VxRail HCI
- CVE-2024-11423Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money GlitchWP Swings Gift Cards for WooCommerce Pro · wpswings Ultimat…
- CVE-2024-12853Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Uploadwpchill Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2024-12854Garden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Uploadggnomes Garden Gnome Package
- CVE-2024-45033Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliApache Software Foundation Apache Airflow Fab Provider · ap…
- CVE-2024-11939Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via dataStylemixThemes Cost Calculator Builder PRO
- CVE-2024-9939WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.phpnickboss Iptanus File Upload
- CVE-2024-11270WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creationwpwebinarsystem WebinarPress – Webinar System for WordPress
- CVE-2024-11271WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updateswpwebinarsystem WebinarPress – Webinar System for WordPress
- CVE-2024-11816The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Executionwpextended The Ultimate WordPress Toolkit – WP Extended
- CVE-2024-11916The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingwpextended The Ultimate WordPress Toolkit – WP Extended
- CVE-2024-56451Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may aHuawei HarmonyOS
- CVE-2024-56447Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affecHuawei HarmonyOS · Huawei EMUI
- CVE-2024-56444Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-56439Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-51442Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna
- CVE-2024-54818SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control.
- CVE-2024-55517An issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5.
Medium, low and unrated 89
- CVE-2024-13195donglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgerydonglight bookstore电商书城系统说明
- CVE-2024-13194Sucms admin_members.php sql injectionSucms
- CVE-2024-13193SEMCMS Image Library Management Page SEMCMS_Images.php sql injectionSEMCMS
- CVE-2024-13192ZeroWdd myblog BlogController.java update cross site scriptingZeroWdd myblog
- CVE-2024-13191ZeroWdd myblog uploadController.java upload unrestricted uploadZeroWdd myblog
- CVE-2024-13190ZeroWdd myblog BlogMapper.xml xml injectionZeroWdd myblog
- CVE-2024-53995GHSL-2024-288: SickChill open redirect in loginsickchill
- CVE-2024-54010Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switchesHewlett Packard Enterprise (HPE) AOS-CX
- CVE-2025-22145Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocaleCarbonPHP carbon · nesbot/carbon
- CVE-2024-12431Missing Authorization in GitLabGitLab
- CVE-2025-0194Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLabGitLab
- CVE-2024-13189ZeroWdd myblog MyBlogMvcConfig.java permissionZeroWdd myblog
- CVE-2025-22143WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'listar_permissoes.php' parameter 'msg_e'LabRedesCefetRJ WeGIA
- CVE-2024-13188MicroWorld eScan Antivirus Installation var default permissionMicroWorld eScan Antivirus
- CVE-2025-22139WeGIA Cross-Site Scripting (XSS) Reflected endpoint `configuracao_geral.php` parameter `msg`nilsonLazarin WeGIA
- CVE-2024-56787soc: imx8m: Probe the SoC driver as platform driverLinux
- CVE-2024-56785MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7aLinux
- CVE-2024-56783netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup levelLinux
- CVE-2024-56782ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()Linux
- CVE-2024-56780quota: flush quota_release_work upon quota writebackLinux
- CVE-2024-56778drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_checkLinux
- CVE-2024-56777drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_checkLinux
- CVE-2024-56776drm/sti: avoid potential dereference of error pointersLinux
- CVE-2024-56774btrfs: add a sanity check for btrfs root in btrfs_search_slot()Linux
- CVE-2024-56773kunit: Fix potential null dereference in kunit_device_driver_test()Linux
- CVE-2024-56771mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC informationLinux
- CVE-2024-6350EmberZNet malformed MAC layer packet leads to denial of servicesilabs.com Simplicity SDK
- CVE-2024-56770net/sched: netem: account for backlog updates from child qdiscLinux
- CVE-2024-13187Kingsoft WPS Office TCC code injectionKingsoft WPS Office
- CVE-2025-20168Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilityCisco Common Services Platform Collector Software
- CVE-2025-20167Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilityCisco Common Services Platform Collector Software
- CVE-2025-20166Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilityCisco Common Services Platform Collector Software
- CVE-2025-20126Cisco ThousandEyes Endpoint Agent Certificate Validation VulnerabilityCisco ThousandEyes Endpoint Agent
- CVE-2025-20123Cisco Crosswork Network Controller Stored Cross-Site Scripting VulnerabilityCisco Crosswork Network Change Automation
- CVE-2025-22130Soft Serve allows path traversal attackscharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2024-12337Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-idswebwirkung Shipping via Planzer for WooCommerce
- CVE-2024-11830Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scriptingdearhive Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF emb…
- CVE-2024-12712Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updateslevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2024-13186MinigameCenter information leakage vulnerabilityvivo MinigameCenter
- CVE-2024-12855AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletionscriptsbundle AdForest
- CVE-2024-12328MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVGmadrasthemes MAS Elementor
- CVE-2024-13185MinigameCenter module information leakage vulnerabilityvivo MinigameCenter
- CVE-2024-13173Health information leakage vulnerabilityvivo Health
- CVE-2024-12045Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scriptingwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2024-8002VIWIS LMS File Upload cross site scriptingVIWIS LMS
- CVE-2025-22215VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)VMware Aria Automation · VMware Cloud Foundation
- CVE-2024-12584140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post DuplicationXpro Addons — 140+ Widgets for Elementor
- CVE-2024-12852Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingthehappymonster Happy Addons for Elementor
- CVE-2024-12851Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-12585PropertyHive < 2.1.1 - Reflected XSSProperty Hive
- CVE-2024-10151Auto iFrame < 2.0 - Contributor+ XSS via ShortcodeAuto iFrame
- CVE-2024-10585InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Readingrevmakx InfiniteWP Client
- CVE-2024-12030MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injectionrealmag777 MDTF – Meta Data and Taxonomies Filter
- CVE-2024-12205Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingThemesflat Addons For Elementor
- CVE-2025-21603Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier.PLANEX COMMUNICATIONS MZK-DP300N
- CVE-2024-54121Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnoHuawei HarmonyOS
- CVE-2024-56456Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of thHuawei HarmonyOS
- CVE-2024-56455Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of thHuawei HarmonyOS
- CVE-2024-56454Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of thHuawei HarmonyOS
- CVE-2024-56453Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of thHuawei HarmonyOS
- CVE-2024-12112Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptinghassantafreshi Easy Form Builder by WhiteStudio — Drag & Dr…
- CVE-2024-12713SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosurebrainstormforce SureForms – Contact Form, Payment Form & Ot…
- CVE-2024-12521Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingteonos Slotti Ajanvaraus
- CVE-2024-56452Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of thHuawei HarmonyOS
- CVE-2024-56450Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-56449Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiHuawei HarmonyOS · Huawei EMUI
- CVE-2024-56448Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect aHuawei HarmonyOS · Huawei EMUI
- CVE-2024-56446Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affectHuawei HarmonyOS
- CVE-2024-56445Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause feHuawei HarmonyOS
- CVE-2024-47934TXOne Networks Portable Inspector Management Program Improper Input Validation VulnerabilityTXOne Networks Portable Inspector
- CVE-2024-56443Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-54120Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause featuresHuawei HarmonyOS
- CVE-2024-56442Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may causeHuawei HarmonyOS · Huawei EMUI
- CVE-2024-56441Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-56440Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perfHuawei HarmonyOS · Huawei EMUI
- CVE-2024-56438Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect avaiHuawei HarmonyOS · Huawei EMUI
- CVE-2024-56437Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability maHuawei HarmonyOS
- CVE-2023-52955Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause feHuawei HarmonyOS · Huawei EMUI
- CVE-2024-47239Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability.Dell PowerScale OneFS
- CVE-2023-52954Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availabiHuawei HarmonyOS · Huawei EMUI
- CVE-2023-52953Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confHuawei HarmonyOS · Huawei EMUI
- CVE-2024-56436Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-56435Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-56434UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of theHuawei HarmonyOS · Huawei EMUI
- CVE-2024-40679IBM Db2 information disclosureIBM Db2
- CVE-2024-52869Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups.
- CVE-2024-53526composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls functcomposio-claude · composio-openai +1
- CVE-2024-54731cpdf through 2.8 allows stack consumption via a crafted PDF document.Coherent Graphics CPDF
- CVE-2024-55459An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_fkeras