CVEs published January 11, 2025
105 CVEs were published on January 11, 2025: 7 critical, 23 high.
- Published
- 105
- Critical
- 7
- High
- 23
- Medium
- 49
- Low
- 2
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Linux
- 67
- HCL Software DRYiCE MyXalytics
- 8
- Palo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3
- 5
- Guangzhou Huayi Intelligent Technology Jeewms
- 3
- Mozilla Firefox for iOS
- 2
- premio Coupon X – Discount Popups & Promo Codes Pop Ups for…
- 2
- alanperfectportal Perfect Portal Widgets
- 1
- bqworks Accordion Slider Lite
- 1
- bqworks Grid Accordion Lite
- 1
- ClickWhale – Link Manager, Link Shortener and Click Tracker…
- 1
Critical 7
- CVE-2024-57843virtio-net: fix overflow inside virtnet_rq_allocLinux
- CVE-2024-57793virt: tdx-guest: Just leak decrypted memory on unrecoverable errorsLinux
- CVE-2024-49571net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msgLinux
- CVE-2024-49568net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msgLinux
- CVE-2024-47408net/smc: check smcd_v2_ext_offset when receiving proposal msgLinux
- CVE-2024-12877GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injectionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2025-0103Expedition: SQL Injection VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3
High 23
- CVE-2024-57875block: RCU protect disk->conv_zones_bitmapLinux
- CVE-2024-57850jffs2: Prevent rtime decompress memory corruptionLinux
- CVE-2024-57849s390/cpum_sf: Handle CPU hotplug remove during samplingLinux
- CVE-2024-57804scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfsLinux
- CVE-2024-57798drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()Linux
- CVE-2024-57792power: supply: gpio-charger: Fix set charge current limitsLinux
- CVE-2024-57791net/smc: check return value of sock_recvmsg when draining clc dataLinux
- CVE-2024-56788net: ethernet: oa_tc6: fix tx skb race condition between reference pointersLinux
- CVE-2024-56368ring-buffer: Fix overflow in __rb_map_vmaLinux
- CVE-2024-52319mm: use aligned address in clear_gigantic_page()Linux
- CVE-2024-51729mm: use aligned address in copy_user_gigantic_page()Linux
- CVE-2024-49573sched/fair: Fix NEXT_BUDDYLinux
- CVE-2024-41149block: avoid to reuse `hctx` not removed from cpuhp callback listLinux
- CVE-2024-55639net: renesas: rswitch: avoid use-after-put for a device tree nodeLinux
- CVE-2024-50051spi: mpc52xx: Add cancel_work_sync before module removeLinux
- CVE-2024-49569nvme-rdma: unquiesce admin_q before destroy itLinux
- CVE-2024-47794bpf: Prevent tailcall infinite loop caused by freplaceLinux
- CVE-2025-0107Expedition: OS Command Injection VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3
- CVE-2025-0104Expedition: Cross-Site Scripting (XSS) VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3
- CVE-2024-42169HCL MyXalytics is affected by insecure direct object referencesHCL Software DRYiCE MyXalytics
- CVE-2024-42168HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerabilityHCL Software DRYiCE MyXalytics
- CVE-2024-12627Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injectionpremio Coupon X – Discount Popups & Promo Codes Pop Ups for…
- CVE-2024-12404CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injectioncrowdfavorite CF Internal Link Shortcode
Medium, low and unrated 75
- CVE-2024-57881mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()Linux
- CVE-2024-57880ASoC: Intel: sof_sdw: Add space for a terminator into DAIs arrayLinux
- CVE-2024-57879Bluetooth: iso: Always release hdev at the end of iso_listen_bisLinux
- CVE-2024-57878arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMRLinux
- CVE-2024-57877arm64: ptrace: fix partial SETREGSET for NT_ARM_POELinux
- CVE-2024-57876drm/dp_mst: Fix resetting msg rx state after topology removalLinux
- CVE-2024-57874arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRLLinux
- CVE-2024-57872scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()Linux
- CVE-2024-57839Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"Linux
- CVE-2024-57838s390/entry: Mark IRQ entries to fix stack depot warningsLinux
- CVE-2024-57809PCI: imx6: Fix suspend/resume support on i.MX6QDLLinux
- CVE-2024-57807scsi: megaraid_sas: Fix for a potential deadlockLinux
- CVE-2024-57806btrfs: fix transaction atomicity bug when enabling simple quotasLinux
- CVE-2024-57805ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOPLinux
- CVE-2024-57800ALSA: memalloc: prefer dma_mapping_error() over explicit address checkingLinux
- CVE-2024-57799phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PMLinux
- CVE-2024-56372net: tun: fix tun_napi_alloc_frags()Linux
- CVE-2024-56369drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()Linux
- CVE-2024-55916Drivers: hv: util: Avoid accessing a ringbuffer not initialized yetLinux
- CVE-2024-55881KVM: x86: Play nice with protected guests in complete_hypercall_exit()Linux
- CVE-2024-54455accel/ivpu: Fix general protection fault in ivpu_bo_list()Linux
- CVE-2024-54193accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()Linux
- CVE-2024-53690nilfs2: prevent use of deleted inodeLinux
- CVE-2024-53685ceph: give up on paths longer than PATH_MAXLinux
- CVE-2024-46896drm/amdgpu: don't access invalid schedLinux
- CVE-2024-55642block: Prevent potential deadlocks in zone write plug error recoveryLinux
- CVE-2024-55641xfs: unlock inodes when erroring out of xfs_trans_alloc_dirLinux
- CVE-2024-54683netfilter: IDLETIMER: Fix for possible ABBA deadlockLinux
- CVE-2024-54460Bluetooth: iso: Fix circular lock in iso_listen_bisLinux
- CVE-2024-54191Bluetooth: iso: Fix circular lock in iso_conn_big_syncLinux
- CVE-2024-53687riscv: Fix IPIs usage in kfence_protect_page()Linux
- CVE-2024-53682regulator: axp20x: AXP717: set ramp_delayLinux
- CVE-2024-53680ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()Linux
- CVE-2024-52332igb: Fix potential invalid memory access in igb_init_module()Linux
- CVE-2024-48881bcache: revert replacing IS_ERR_OR_NULL with IS_ERR againLinux
- CVE-2024-48876stackdepot: fix stack_depot_save_flags() in NMI contextLinux
- CVE-2024-48875btrfs: don't take dev_replace rwsem on task already holding itLinux
- CVE-2024-48873wifi: rtw89: check return value of ieee80211_probereq_get() for RNRLinux
- CVE-2024-47809dlm: fix possible lkb_resource null dereferenceLinux
- CVE-2024-47143dma-debug: fix a possible deadlock on radix_lockLinux
- CVE-2024-47141pinmux: Use sequential access to access desc->pinmux dataLinux
- CVE-2024-45828i3c: mipi-i3c-hci: Mask ring interrupts before ring stop requestLinux
- CVE-2024-43098i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlockLinux
- CVE-2024-41935f2fs: fix to shrink read extent node in batchesLinux
- CVE-2024-41932sched: fix warning in sched_setaffinityLinux
- CVE-2025-0392Guangzhou Huayi Intelligent Technology Jeewms graphReportController.do datagridGraph sql injectionGuangzhou Huayi Intelligent Technology Jeewms
- CVE-2025-0391Guangzhou Huayi Intelligent Technology Jeewms CgFormBuildController. java saveOrUpdate sql injectionGuangzhou Huayi Intelligent Technology Jeewms
- CVE-2025-0390Guangzhou Huayi Intelligent Technology Jeewms wmOmNoticeHController.do path traversalGuangzhou Huayi Intelligent Technology Jeewms
- CVE-2024-12407Push Notification for Post and BuddyPress <= 2.07 - Reflected Cross-Site Scriptingmurali-indiacitys Push Notification for Post and BuddyPress
- CVE-2024-11386GatorMail SmartForms <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingwow-analytics GatorMail SmartForms
- CVE-2024-12527Perfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingalanperfectportal Perfect Portal Widgets
- CVE-2024-11892Accordion Slider Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingbqworks Accordion Slider Lite
- CVE-2024-12412Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin <= 2.2.1 - Reflected Cross-Site Scriptingmagepeopleteam Booking and Rental Manager for Bike | Car |…
- CVE-2024-12520Dominion – Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingreader87 Dominion – Domain Checker for WPBakery
- CVE-2024-12116Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosurecodepopular Unlimited Theme Addon For Elementor
- CVE-2024-12519TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingtcoder TCBD Auto Refresher
- CVE-2024-11874Grid Accordion Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingbqworks Grid Accordion Lite
- CVE-2024-11915RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosurerrdevs RRAddons for Elementor
- CVE-2024-11758WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingmilmor WP SPID Italia
- CVE-2024-42175HCL MyXalytics is affected by a weak input validation vulnerabilityHCL Software DRYiCE MyXalytics
- CVE-2024-42174HCL MyXalytics is affected by username enumeration vulnerabilityHCL Software DRYiCE MyXalytics
- CVE-2024-42173HCL MyXalytics is affected by an improper password policy implementation vulnerabilityHCL Software DRYiCE MyXalytics
- CVE-2024-42172HCL MyXalytics is affected by broken authenticationHCL Software DRYiCE MyXalytics
- CVE-2024-42171HCL MyXalytics is affected by insufficient session expirationHCL Software DRYiCE MyXalytics
- CVE-2024-42170HCL MyXalytics is affected by a session fixation vulnerabilityHCL Software DRYiCE MyXalytics
- CVE-2024-12587Contact Form Master <= 1.0.7 - Reflected XSSContact Form Master
- CVE-2025-23109Address bar spoofing on iOS using long hostnamesMozilla Firefox for iOS
- CVE-2025-23108Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URIMozilla Firefox for iOS
- CVE-2024-12304Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Linkstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2025-0106Expedition: Wildcard Expansion VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3
- CVE-2025-0105Expedition: Arbitrary File Deletion VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3
- CVE-2024-12204Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorizationpremio Coupon X – Discount Popups & Promo Codes Pop Ups for…
- CVE-2024-11327ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Reflected Cross-Site ScriptingClickWhale – Link Manager, Link Shortener and Click Tracker…
- CVE-2024-12505Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingtinuzz Trackserver
- CVE-2024-12472Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosuremetaphorcreations Post Duplicator