# CVEs published 2025-01-08

128 CVEs were published on January 8, 2025: 10 critical, 29 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-13195](https://cve.now/CVE-2024-13195.md): donglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgery (CVSS 5.3, donglight bookstore电商书城系统说明)
- [CVE-2024-13194](https://cve.now/CVE-2024-13194.md): Sucms admin\_members.php sql injection (CVSS 5.3, Sucms)
- [CVE-2024-13193](https://cve.now/CVE-2024-13193.md): SEMCMS Image Library Management Page SEMCMS\_Images.php sql injection (CVSS 5.3, SEMCMS)
- [CVE-2024-13192](https://cve.now/CVE-2024-13192.md): ZeroWdd myblog BlogController.java update cross site scripting (CVSS 5.3, ZeroWdd myblog)
- [CVE-2024-13191](https://cve.now/CVE-2024-13191.md): ZeroWdd myblog uploadController.java upload unrestricted upload (CVSS 5.3, ZeroWdd myblog)
- [CVE-2025-0283](https://cve.now/CVE-2025-0283.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu (CVSS 7.0, Ivanti Connect Secure · Ivanti Policy Secure +1)
- [CVE-2025-0282](https://cve.now/CVE-2025-0282.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu (CVSS 9.0, KEV, Ivanti Connect Secure · Ivanti Policy Secure +1)
- [CVE-2024-13190](https://cve.now/CVE-2024-13190.md): ZeroWdd myblog BlogMapper.xml xml injection (CVSS 5.3, ZeroWdd myblog)
- [CVE-2024-53995](https://cve.now/CVE-2024-53995.md): GHSL-2024-288: SickChill open redirect in login (CVSS 1.9, sickchill)
- [CVE-2024-54010](https://cve.now/CVE-2024-54010.md): Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches (CVSS 3.4, Hewlett Packard Enterprise (HPE) AOS-CX)
- [CVE-2025-22145](https://cve.now/CVE-2025-22145.md): Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale (CVSS 6.3, CarbonPHP carbon · nesbot/carbon)
- [CVE-2024-12431](https://cve.now/CVE-2024-12431.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-0194](https://cve.now/CVE-2025-0194.md): Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-13189](https://cve.now/CVE-2024-13189.md): ZeroWdd myblog MyBlogMvcConfig.java permission (CVSS 6.9, ZeroWdd myblog)
- [CVE-2025-22143](https://cve.now/CVE-2025-22143.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'listar\_permissoes.php' parameter 'msg\_e' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2024-13188](https://cve.now/CVE-2024-13188.md): MicroWorld eScan Antivirus Installation var default permission (CVSS 4.8, MicroWorld eScan Antivirus)
- [CVE-2025-0291](https://cve.now/CVE-2025-0291.md): Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.3, Google Chrome)
- [CVE-2025-22141](https://cve.now/CVE-2025-22141.md): WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar\_recursos\_cargo.php' parameter 'cargo' (CVSS 9.4, nilsonLazarin WeGIA)
- [CVE-2025-22139](https://cve.now/CVE-2025-22139.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint \`configuracao\_geral.php\` parameter \`msg\` (CVSS 6.4, nilsonLazarin WeGIA)
- [CVE-2025-22140](https://cve.now/CVE-2025-22140.md): WeGIA SQL Injection (Blind Time-Based) endpoint 'dependente\_listar\_um.php' parameter 'id\_dependente' (CVSS 9.4, nilsonLazarin WeGIA)
- [CVE-2024-56787](https://cve.now/CVE-2024-56787.md): soc: imx8m: Probe the SoC driver as platform driver (CVSS 5.5, Linux)
- [CVE-2024-56785](https://cve.now/CVE-2024-56785.md): MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a (CVSS 5.5, Linux)
- [CVE-2024-56784](https://cve.now/CVE-2024-56784.md): drm/amd/display: Adding array index check to prevent memory corruption (CVSS 7.8, Linux)
- [CVE-2024-56783](https://cve.now/CVE-2024-56783.md): netfilter: nft\_socket: remove WARN\_ON\_ONCE on maximum cgroup level (CVSS 5.5, Linux)
- [CVE-2024-56782](https://cve.now/CVE-2024-56782.md): ACPI: x86: Add adev NULL check to acpi\_quirk\_skip\_serdev\_enumeration() (CVSS 5.5, Linux)
- [CVE-2024-56780](https://cve.now/CVE-2024-56780.md): quota: flush quota\_release\_work upon quota writeback (CVSS 5.5, Linux)
- [CVE-2024-56779](https://cve.now/CVE-2024-56779.md): nfsd: fix nfs4\_openowner leak when concurrent nfsd4\_open occur (CVSS 9.8, Linux)
- [CVE-2024-56778](https://cve.now/CVE-2024-56778.md): drm/sti: avoid potential dereference of error pointers in sti\_hqvdp\_atomic\_check (CVSS 5.5, Linux)
- [CVE-2024-56777](https://cve.now/CVE-2024-56777.md): drm/sti: avoid potential dereference of error pointers in sti\_gdp\_atomic\_check (CVSS 5.5, Linux)
- [CVE-2024-56776](https://cve.now/CVE-2024-56776.md): drm/sti: avoid potential dereference of error pointers (CVSS 5.5, Linux)
- [CVE-2024-56775](https://cve.now/CVE-2024-56775.md): drm/amd/display: Fix handling of plane refcount (CVSS 7.8, Linux)
- [CVE-2024-56774](https://cve.now/CVE-2024-56774.md): btrfs: add a sanity check for btrfs root in btrfs\_search\_slot() (CVSS 5.5, Linux)
- [CVE-2024-56773](https://cve.now/CVE-2024-56773.md): kunit: Fix potential null dereference in kunit\_device\_driver\_test() (CVSS 5.5, Linux)
- [CVE-2024-56772](https://cve.now/CVE-2024-56772.md): kunit: string-stream: Fix a UAF bug in kunit\_init\_suite() (CVSS 7.8, Linux)
- [CVE-2024-56771](https://cve.now/CVE-2024-56771.md): mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information (CVSS 5.5, Linux)
- [CVE-2025-21111](https://cve.now/CVE-2025-21111.md): Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability. (CVSS 7.5, Dell VxRail HCI)
- [CVE-2023-35685](https://cve.now/CVE-2023-35685.md): In DevmemIntMapPages of devicemem\_server.c, there is a possible physical page uaf due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-6350](https://cve.now/CVE-2024-6350.md): EmberZNet malformed MAC layer packet leads to denial of service (CVSS 6.5, silabs.com Simplicity SDK)
- [CVE-2024-56770](https://cve.now/CVE-2024-56770.md): net/sched: netem: account for backlog updates from child qdisc (CVSS 5.5, Linux)
- [CVE-2024-13187](https://cve.now/CVE-2024-13187.md): Kingsoft WPS Office TCC code injection (CVSS 4.8, Kingsoft WPS Office)
- [CVE-2025-20168](https://cve.now/CVE-2025-20168.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Common Services Platform Collector Software)
- [CVE-2025-20167](https://cve.now/CVE-2025-20167.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Common Services Platform Collector Software)
- [CVE-2025-20166](https://cve.now/CVE-2025-20166.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Common Services Platform Collector Software)
- [CVE-2025-20126](https://cve.now/CVE-2025-20126.md): Cisco ThousandEyes Endpoint Agent Certificate Validation Vulnerability (CVSS 4.8, Cisco ThousandEyes Endpoint Agent)
- [CVE-2025-20123](https://cve.now/CVE-2025-20123.md): Cisco Crosswork Network Controller Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Crosswork Network Change Automation)
- [CVE-2025-22137](https://cve.now/CVE-2025-22137.md): Arbitrary File Overwrite via HTTP POST in Pingvin Share (CVSS 9.8, stonith404 pingvin-share)
- [CVE-2025-22136](https://cve.now/CVE-2025-22136.md): Tabby has a TCC Bypass via Misconfigured Node Fuses (CVSS 8.6, Eugeny tabby)
- [CVE-2025-22130](https://cve.now/CVE-2025-22130.md): Soft Serve allows path traversal attacks (CVSS 5.3, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2024-55656](https://cve.now/CVE-2024-55656.md): RedisBloom Integer Overflow Remote Code Execution Vulnerability (CVSS 8.8, RedisBloom)
- [CVE-2024-51737](https://cve.now/CVE-2024-51737.md): RediSearch Integer Overflow with LIMIT or KNN arguments can lead to RCE (CVSS 7.0, RediSearch)
- [CVE-2024-51480](https://cve.now/CVE-2024-51480.md): RedisTimeSeries Integer Overflow Remote Code Execution Vulnerability (CVSS 7.0, RedisTimeSeries)
- [CVE-2025-21102](https://cve.now/CVE-2025-21102.md): Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. (CVSS 7.5, Dell VxRail HCI)
- [CVE-2024-12337](https://cve.now/CVE-2024-12337.md): Shipping via Planzer for WooCommerce \<= 1.0.25 - Reflected Cross-Site Scripting via processed-ids (CVSS 6.1, webwirkung Shipping via Planzer for WooCommerce)
- [CVE-2024-11830](https://cve.now/CVE-2024-11830.md): Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer \<= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dearhive Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF emb…)
- [CVE-2024-11423](https://cve.now/CVE-2024-11423.md): Ultimate Gift Cards for WooCommerce \<= 3.0.6 - Missing Authorization to Infinite Money Glitch (CVSS 7.5, WP Swings Gift Cards for WooCommerce Pro · wpswings Ultimat…)
- [CVE-2024-12853](https://cve.now/CVE-2024-12853.md): Modula Image Gallery \<= 2.11.10 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2024-12854](https://cve.now/CVE-2024-12854.md): Garden Gnome Package \<= 2.3.0 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, ggnomes Garden Gnome Package)
- [CVE-2024-12712](https://cve.now/CVE-2024-12712.md): Shopping Cart & eCommerce Store \<= 5.7.8 - Missing Authorization to Order Updates (CVSS 5.3, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2024-45033](https://cve.now/CVE-2024-45033.md): Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli (CVSS 8.1, Apache Software Foundation Apache Airflow Fab Provider · ap…)
- [CVE-2024-54676](https://cve.now/CVE-2024-54676.md): Apache OpenMeetings: Deserialisation of untrusted data in cluster mode (CVSS 9.8, Apache Software Foundation Apache OpenMeetings · org.apache…)
- [CVE-2024-13186](https://cve.now/CVE-2024-13186.md): MinigameCenter information leakage vulnerability (CVSS 6.3, vivo MinigameCenter)
- [CVE-2024-12855](https://cve.now/CVE-2024-12855.md): AdForest - Classified Ads WordPress Theme \<= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion (CVSS 4.3, scriptsbundle AdForest)
- [CVE-2024-11939](https://cve.now/CVE-2024-11939.md): Cost Calculator Builder PRO \<= 3.2.15 - Unauthenticated SQL Injection via data (CVSS 7.5, StylemixThemes Cost Calculator Builder PRO)
- [CVE-2024-9939](https://cve.now/CVE-2024-9939.md): WordPress File Upload \<= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu\_file\_downloader.php (CVSS 7.5, nickboss Iptanus File Upload)
- [CVE-2024-11350](https://cve.now/CVE-2024-11350.md): AdForest \<= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover (CVSS 9.8, scriptsbundle AdForest)
- [CVE-2024-12328](https://cve.now/CVE-2024-12328.md): MAS Elementor \<= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG (CVSS 6.4, madrasthemes MAS Elementor)
- [CVE-2024-13185](https://cve.now/CVE-2024-13185.md): MinigameCenter module information leakage vulnerability (CVSS 6.3, vivo MinigameCenter)
- [CVE-2024-13173](https://cve.now/CVE-2024-13173.md): Health information leakage vulnerability (CVSS 6.3, vivo Health)
- [CVE-2024-11635](https://cve.now/CVE-2024-11635.md): WordPress File Upload \<= 4.24.12 - Unuathenticated Remote Code Execution (CVSS 9.8, nickboss Iptanus File Upload)
- [CVE-2024-12045](https://cve.now/CVE-2024-12045.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2024-8002](https://cve.now/CVE-2024-8002.md): VIWIS LMS File Upload cross site scripting (CVSS 6.9, VIWIS LMS)
- [CVE-2025-22215](https://cve.now/CVE-2025-22215.md): VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215) (CVSS 4.3, VMware Aria Automation · VMware Cloud Foundation)
- [CVE-2024-12584](https://cve.now/CVE-2024-12584.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication (CVSS 4.3, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2024-12852](https://cve.now/CVE-2024-12852.md): Happy Addons for Elementor \<= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-12851](https://cve.now/CVE-2024-12851.md): Element Pack Lite - Addons for Elementor \<= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-11613](https://cve.now/CVE-2024-11613.md): WordPress File Upload \<= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion (CVSS 9.8, nickboss Iptanus File Upload)
- [CVE-2024-12585](https://cve.now/CVE-2024-12585.md): PropertyHive \< 2.1.1 - Reflected XSS (CVSS 6.1, Property Hive)
- [CVE-2024-10151](https://cve.now/CVE-2024-10151.md): Auto iFrame \< 2.0 - Contributor+ XSS via Shortcode (CVSS 5.4, Auto iFrame)
- [CVE-2024-10585](https://cve.now/CVE-2024-10585.md): InfiniteWP Client \<= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading (CVSS 5.3, revmakx InfiniteWP Client)
- [CVE-2024-11270](https://cve.now/CVE-2024-11270.md): WordPress Webinar Plugin – WebinarPress \<= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation (CVSS 8.8, wpwebinarsystem WebinarPress – Webinar System for WordPress)
- [CVE-2024-12030](https://cve.now/CVE-2024-12030.md): MDTF – Meta Data and Taxonomies Filter \<= 1.3.3.5 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, realmag777 MDTF – Meta Data and Taxonomies Filter)
- [CVE-2024-11271](https://cve.now/CVE-2024-11271.md): WordPress Webinar Plugin – WebinarPress \<= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates (CVSS 8.8, wpwebinarsystem WebinarPress – Webinar System for WordPress)
- [CVE-2024-12205](https://cve.now/CVE-2024-12205.md): Themesflat Addons For Elementor \<= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Themesflat Addons For Elementor)
- [CVE-2025-21603](https://cve.now/CVE-2025-21603.md): Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. (CVSS 4.8, PLANEX COMMUNICATIONS MZK-DP300N)
- [CVE-2024-54121](https://cve.now/CVE-2024-54121.md): Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abno (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-56456](https://cve.now/CVE-2024-56456.md): Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of th (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2024-56455](https://cve.now/CVE-2024-56455.md): Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of th (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-56454](https://cve.now/CVE-2024-56454.md): Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of th (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-56453](https://cve.now/CVE-2024-56453.md): Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of th (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2024-11816](https://cve.now/CVE-2024-11816.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution (CVSS 8.8, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-12112](https://cve.now/CVE-2024-12112.md): Easy Form Builder \<= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, hassantafreshi Easy Form Builder by WhiteStudio — Drag & Dr…)
- [CVE-2024-11916](https://cve.now/CVE-2024-11916.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 7.4, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-12713](https://cve.now/CVE-2024-12713.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure (CVSS 5.3, brainstormforce SureForms – Contact Form, Payment Form & Ot…)
- [CVE-2024-12521](https://cve.now/CVE-2024-12521.md): Slotti Ajanvaraus \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, teonos Slotti Ajanvaraus)
- [CVE-2024-56452](https://cve.now/CVE-2024-56452.md): Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of th (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-56451](https://cve.now/CVE-2024-56451.md): Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may a (CVSS 7.3, Huawei HarmonyOS)
- [CVE-2024-56450](https://cve.now/CVE-2024-56450.md): Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 6.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56449](https://cve.now/CVE-2024-56449.md): Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidenti (CVSS 6.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56448](https://cve.now/CVE-2024-56448.md): Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect a (CVSS 6.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56447](https://cve.now/CVE-2024-56447.md): Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affec (CVSS 7.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56446](https://cve.now/CVE-2024-56446.md): Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2024-56445](https://cve.now/CVE-2024-56445.md): Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause fe (CVSS 4.3, Huawei HarmonyOS)
- [CVE-2024-47934](https://cve.now/CVE-2024-47934.md): TXOne Networks Portable Inspector Management Program Improper Input Validation Vulnerability (CVSS 6.9, TXOne Networks Portable Inspector)
- [CVE-2024-56444](https://cve.now/CVE-2024-56444.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2024-56443](https://cve.now/CVE-2024-56443.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-54120](https://cve.now/CVE-2024-54120.md): Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause features (CVSS 4.1, Huawei HarmonyOS)
- [CVE-2024-56442](https://cve.now/CVE-2024-56442.md): Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause (CVSS 5.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56441](https://cve.now/CVE-2024-56441.md): Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality. (CVSS 4.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56440](https://cve.now/CVE-2024-56440.md): Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perf (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56439](https://cve.now/CVE-2024-56439.md): Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2024-56438](https://cve.now/CVE-2024-56438.md): Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect avai (CVSS 6.0, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56437](https://cve.now/CVE-2024-56437.md): Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability ma (CVSS 5.7, Huawei HarmonyOS)
- [CVE-2023-52955](https://cve.now/CVE-2023-52955.md): Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause fe (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-47239](https://cve.now/CVE-2024-47239.md): Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2023-52954](https://cve.now/CVE-2023-52954.md): Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availabi (CVSS 4.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-52953](https://cve.now/CVE-2023-52953.md): Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and conf (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-56436](https://cve.now/CVE-2024-56436.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-56435](https://cve.now/CVE-2024-56435.md): Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-56434](https://cve.now/CVE-2024-56434.md): UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the (CVSS 4.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-40679](https://cve.now/CVE-2024-40679.md): IBM Db2 information disclosure (CVSS 5.5, IBM Db2)
- [CVE-2024-50603](https://cve.now/CVE-2024-50603.md): An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. (CVSS 10.0, KEV, Aviatrix Controller)
- [CVE-2024-51442](https://cve.now/CVE-2024-51442.md): Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna (CVSS 8.8)
- [CVE-2024-52869](https://cve.now/CVE-2024-52869.md): Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. (CVSS 6.0)
- [CVE-2024-53526](https://cve.now/CVE-2024-53526.md): composio \>=0.5.40 is vulnerable to Command Execution in composio\_openai, composio\_claude, and composio\_julep via the handle\_tool\_calls funct (CVSS 6.4, composio-claude · composio-openai +1)
- [CVE-2024-54731](https://cve.now/CVE-2024-54731.md): cpdf through 2.8 allows stack consumption via a crafted PDF document. (CVSS 4.0, Coherent Graphics CPDF)
- [CVE-2024-54818](https://cve.now/CVE-2024-54818.md): SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. (CVSS 8.8)
- [CVE-2024-55459](https://cve.now/CVE-2024-55459.md): An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get\_f (CVSS 6.5, keras)
- [CVE-2024-55517](https://cve.now/CVE-2024-55517.md): An issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.