CVEs published January 10, 2025
72 CVEs were published on January 10, 2025: 15 critical, 17 high.
- Published
- 72
- Critical
- 15
- High
- 17
- Medium
- 39
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Arista Networks Arista Edge Threat Management
- 9
- LabRedesCefetRJ WeGIA
- 5
- Vanderbilt REDCap
- 4
- microweber/microweber
- 3
- Arista Networks EOS
- 2
- Jan Syski MegaBIP
- 2
- librdf Raptor RDF Syntax Library
- 2
- opacewebdesign Opace AI Scribe: SEO Content Creator & Humai…
- 2
- themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- 2
- Arista Networks CloudVision Appliance
- 1
Critical 15
- CVE-2024-12847NETGEAR DGN setup.cgi OS Command InjectionNETGEAR DGN1000
- CVE-2025-22152Improper Path Validation Enables Path Traversal in Multiple Components in AtheosAtheos
- CVE-2024-56511DataEase has an unauthorized vulnerabilitydataease
- CVE-2024-41787IBM Engineering Requirements Management DOORS Next code executionIBM Engineering Requirements Management DOORS Next
- CVE-2024-29970Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals.
- CVE-2024-29971Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals.
- CVE-2024-57223Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode f
- CVE-2024-57224Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fu
- CVE-2024-57225Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
- CVE-2024-57686A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which allo
- CVE-2024-57687An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows re
- CVE-2024-57823In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalibrdf Raptor RDF Syntax Library
- CVE-2025-22946Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary
- CVE-2025-22949Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code exec
- CVE-2025-23016FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLeFastCGI fcgi
High 17
- CVE-2024-9188Specially constructed queries cause cross platform scripting leaking administrator tokensArista Networks Arista Edge Threat Management
- CVE-2024-47520A user with advanced report application access rights can perform actions for which they are not authorizedArista Networks Arista Edge Threat Management
- CVE-2024-47519Backup uploads to ETM subject to man-in-the-middle interceptionArista Networks Arista Edge Threat Management
- CVE-2024-9134Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.Arista Networks Arista Edge Threat Management
- CVE-2024-9132The administrator is able to configure an insecure captive portal scriptArista Networks Arista Edge Threat Management
- CVE-2024-9131A user with administrator privileges can perform command injectionArista Networks Arista Edge Threat Management
- CVE-2024-6662CSRF in MegaBIPJan Syski MegaBIP
- CVE-2025-22598WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'cadastrarSocio.php' parameter 'nome'LabRedesCefetRJ WeGIA
- CVE-2025-22597WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'CobrancaController.php' parameter 'local_recepcao'LabRedesCefetRJ WeGIA
- CVE-2024-25371Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW exceptio
- CVE-2024-46210An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploadin
- CVE-2024-54848Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a m
- CVE-2024-54996MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description paramet
- CVE-2024-57211TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_
- CVE-2024-57226Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
- CVE-2024-57227Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps fu
- CVE-2024-57228Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
Medium, low and unrated 40
- CVE-2024-47518Specially constructed queries targeting ETM could discover active remote access sessionsArista Networks Arista Edge Threat Management
- CVE-2024-47517Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM accessArista Networks Arista Edge Threat Management
- CVE-2024-9133A user with administrator privileges is able to retrieve authentication tokensArista Networks Arista Edge Threat Management
- CVE-2024-7142On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This results in the disks remaining unsecured and data on themArista Networks CloudVision Appliance
- CVE-2024-5872On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.Arista Networks EOS
- CVE-2024-7095On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being termArista Networks EOS
- CVE-2024-6437On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options maArista Networks EOS-Policy Based Routing · Arista Networ… +1
- CVE-2025-23079XSSes in Extension:ArticleFeedbackv5Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension
- CVE-2025-23078XSS in BreadCrumbs2Wikimedia Foundation Mediawiki - Breadcrumbs2 extension
- CVE-2024-6880CSRF in MegaBIPJan Syski MegaBIP
- CVE-2025-22600WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `configuracao_doacao.php` parameter `avulso`LabRedesCefetRJ WeGIA
- CVE-2025-22599WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `home.php` parameter `msg_c`LabRedesCefetRJ WeGIA
- CVE-2025-22596WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint 'modulos_visiveis.php' parameter'msg_c'LabRedesCefetRJ WeGIA
- CVE-2024-13318Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletionsmartdatasoft Essential WP Real Estate
- CVE-2024-13183Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameterthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2025-0311Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widgetthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2024-12473AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injectionopacewebdesign Opace AI Scribe: SEO Content Creator & Humai…
- CVE-2024-12606AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Settings Updateopacewebdesign Opace AI Scribe: SEO Content Creator & Humai…
- CVE-2024-33297Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal microweber/microweber
- CVE-2024-33298Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new bamicroweber/microweber
- CVE-2024-33299Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Namemicroweber/microweber
- CVE-2024-50807Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions.
- CVE-2024-54687Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity
- CVE-2024-54846An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-t
- CVE-2024-54847An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or ex
- CVE-2024-54849An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a
- CVE-2024-54910Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.
- CVE-2024-54994MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the
- CVE-2024-54997MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/
- CVE-2024-54998MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/de
- CVE-2024-57212TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reb
- CVE-2024-57213TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_
- CVE-2024-57214TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wif
- CVE-2024-57222Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps functi
- CVE-2024-57822In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor_ntlibrdf Raptor RDF Syntax Library
- CVE-2025-23022FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.FreeType
- CVE-2025-23110An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap
- CVE-2025-23111An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap
- CVE-2025-23112An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap
- CVE-2025-23113An issue was discovered in REDCap 14.9.6.Vanderbilt REDCap