# CVEs published 2025-01-11

105 CVEs were published on January 11, 2025: 7 critical, 23 high. Days are UTC.

- [CVE-2024-57881](https://cve.now/CVE-2024-57881.md): mm/page\_alloc: don't call pfn\_to\_page() on possibly non-existent PFN in split\_large\_buddy() (CVSS 5.5, Linux)
- [CVE-2024-57880](https://cve.now/CVE-2024-57880.md): ASoC: Intel: sof\_sdw: Add space for a terminator into DAIs array (no CVSS, Linux)
- [CVE-2024-57879](https://cve.now/CVE-2024-57879.md): Bluetooth: iso: Always release hdev at the end of iso\_listen\_bis (no CVSS, Linux)
- [CVE-2024-57878](https://cve.now/CVE-2024-57878.md): arm64: ptrace: fix partial SETREGSET for NT\_ARM\_FPMR (CVSS 6.1, Linux)
- [CVE-2024-57877](https://cve.now/CVE-2024-57877.md): arm64: ptrace: fix partial SETREGSET for NT\_ARM\_POE (CVSS 6.1, Linux)
- [CVE-2024-57876](https://cve.now/CVE-2024-57876.md): drm/dp\_mst: Fix resetting msg rx state after topology removal (no CVSS, Linux)
- [CVE-2024-57875](https://cve.now/CVE-2024-57875.md): block: RCU protect disk-\>conv\_zones\_bitmap (CVSS 7.8, Linux)
- [CVE-2024-57874](https://cve.now/CVE-2024-57874.md): arm64: ptrace: fix partial SETREGSET for NT\_ARM\_TAGGED\_ADDR\_CTRL (CVSS 6.1, Linux)
- [CVE-2024-57872](https://cve.now/CVE-2024-57872.md): scsi: ufs: pltfrm: Dellocate HBA during ufshcd\_pltfrm\_remove() (CVSS 5.5, Linux)
- [CVE-2024-57850](https://cve.now/CVE-2024-57850.md): jffs2: Prevent rtime decompress memory corruption (CVSS 7.8, Linux)
- [CVE-2024-57849](https://cve.now/CVE-2024-57849.md): s390/cpum\_sf: Handle CPU hotplug remove during sampling (CVSS 7.8, Linux)
- [CVE-2024-57843](https://cve.now/CVE-2024-57843.md): virtio-net: fix overflow inside virtnet\_rq\_alloc (CVSS 9.8, Linux)
- [CVE-2024-57839](https://cve.now/CVE-2024-57839.md): Revert "readahead: properly shorten readahead when falling back to do\_page\_cache\_ra()" (no CVSS, Linux)
- [CVE-2024-57838](https://cve.now/CVE-2024-57838.md): s390/entry: Mark IRQ entries to fix stack depot warnings (no CVSS, Linux)
- [CVE-2024-57809](https://cve.now/CVE-2024-57809.md): PCI: imx6: Fix suspend/resume support on i.MX6QDL (no CVSS, Linux)
- [CVE-2024-57807](https://cve.now/CVE-2024-57807.md): scsi: megaraid\_sas: Fix for a potential deadlock (CVSS 5.5, Linux)
- [CVE-2024-57806](https://cve.now/CVE-2024-57806.md): btrfs: fix transaction atomicity bug when enabling simple quotas (no CVSS, Linux)
- [CVE-2024-57805](https://cve.now/CVE-2024-57805.md): ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP (no CVSS, Linux)
- [CVE-2024-57804](https://cve.now/CVE-2024-57804.md): scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (CVSS 7.3, Linux)
- [CVE-2024-57800](https://cve.now/CVE-2024-57800.md): ALSA: memalloc: prefer dma\_mapping\_error() over explicit address checking (no CVSS, Linux)
- [CVE-2024-57799](https://cve.now/CVE-2024-57799.md): phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM (CVSS 5.5, Linux)
- [CVE-2024-57798](https://cve.now/CVE-2024-57798.md): drm/dp\_mst: Ensure mst\_primary pointer is valid in drm\_dp\_mst\_handle\_up\_req() (CVSS 7.8, Linux)
- [CVE-2024-57793](https://cve.now/CVE-2024-57793.md): virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (CVSS 9.3, Linux)
- [CVE-2024-57792](https://cve.now/CVE-2024-57792.md): power: supply: gpio-charger: Fix set charge current limits (CVSS 7.3, Linux)
- [CVE-2024-57791](https://cve.now/CVE-2024-57791.md): net/smc: check return value of sock\_recvmsg when draining clc data (CVSS 7.5, Linux)
- [CVE-2024-56788](https://cve.now/CVE-2024-56788.md): net: ethernet: oa\_tc6: fix tx skb race condition between reference pointers (CVSS 7.5, Linux)
- [CVE-2024-56372](https://cve.now/CVE-2024-56372.md): net: tun: fix tun\_napi\_alloc\_frags() (no CVSS, Linux)
- [CVE-2024-56369](https://cve.now/CVE-2024-56369.md): drm/modes: Avoid divide by zero harder in drm\_mode\_vrefresh() (CVSS 5.5, Linux)
- [CVE-2024-56368](https://cve.now/CVE-2024-56368.md): ring-buffer: Fix overflow in \_\_rb\_map\_vma (CVSS 7.1, Linux)
- [CVE-2024-55916](https://cve.now/CVE-2024-55916.md): Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (CVSS 5.5, Linux)
- [CVE-2024-55881](https://cve.now/CVE-2024-55881.md): KVM: x86: Play nice with protected guests in complete\_hypercall\_exit() (no CVSS, Linux)
- [CVE-2024-54455](https://cve.now/CVE-2024-54455.md): accel/ivpu: Fix general protection fault in ivpu\_bo\_list() (no CVSS, Linux)
- [CVE-2024-54193](https://cve.now/CVE-2024-54193.md): accel/ivpu: Fix WARN in ivpu\_ipc\_send\_receive\_internal() (no CVSS, Linux)
- [CVE-2024-53690](https://cve.now/CVE-2024-53690.md): nilfs2: prevent use of deleted inode (no CVSS, Linux)
- [CVE-2024-53685](https://cve.now/CVE-2024-53685.md): ceph: give up on paths longer than PATH\_MAX (no CVSS, Linux)
- [CVE-2024-52319](https://cve.now/CVE-2024-52319.md): mm: use aligned address in clear\_gigantic\_page() (CVSS 7.8, Linux)
- [CVE-2024-51729](https://cve.now/CVE-2024-51729.md): mm: use aligned address in copy\_user\_gigantic\_page() (CVSS 7.8, Linux)
- [CVE-2024-49573](https://cve.now/CVE-2024-49573.md): sched/fair: Fix NEXT\_BUDDY (CVSS 7.0, Linux)
- [CVE-2024-49571](https://cve.now/CVE-2024-49571.md): net/smc: check iparea\_offset and ipv6\_prefixes\_cnt when receiving proposal msg (CVSS 9.1, Linux)
- [CVE-2024-49568](https://cve.now/CVE-2024-49568.md): net/smc: check v2\_ext\_offset/eid\_cnt/ism\_gid\_cnt when receiving proposal msg (CVSS 9.8, Linux)
- [CVE-2024-47408](https://cve.now/CVE-2024-47408.md): net/smc: check smcd\_v2\_ext\_offset when receiving proposal msg (CVSS 9.8, Linux)
- [CVE-2024-46896](https://cve.now/CVE-2024-46896.md): drm/amdgpu: don't access invalid sched (no CVSS, Linux)
- [CVE-2024-41149](https://cve.now/CVE-2024-41149.md): block: avoid to reuse \`hctx\` not removed from cpuhp callback list (CVSS 7.8, Linux)
- [CVE-2024-55642](https://cve.now/CVE-2024-55642.md): block: Prevent potential deadlocks in zone write plug error recovery (CVSS 5.5, Linux)
- [CVE-2024-55641](https://cve.now/CVE-2024-55641.md): xfs: unlock inodes when erroring out of xfs\_trans\_alloc\_dir (no CVSS, Linux)
- [CVE-2024-55639](https://cve.now/CVE-2024-55639.md): net: renesas: rswitch: avoid use-after-put for a device tree node (CVSS 8.4, Linux)
- [CVE-2024-54683](https://cve.now/CVE-2024-54683.md): netfilter: IDLETIMER: Fix for possible ABBA deadlock (CVSS 5.5, Linux)
- [CVE-2024-54460](https://cve.now/CVE-2024-54460.md): Bluetooth: iso: Fix circular lock in iso\_listen\_bis (CVSS 5.5, Linux)
- [CVE-2024-54191](https://cve.now/CVE-2024-54191.md): Bluetooth: iso: Fix circular lock in iso\_conn\_big\_sync (CVSS 5.5, Linux)
- [CVE-2024-53687](https://cve.now/CVE-2024-53687.md): riscv: Fix IPIs usage in kfence\_protect\_page() (no CVSS, Linux)
- [CVE-2024-53682](https://cve.now/CVE-2024-53682.md): regulator: axp20x: AXP717: set ramp\_delay (no CVSS, Linux)
- [CVE-2024-53680](https://cve.now/CVE-2024-53680.md): ipvs: fix UB due to uninitialized stack access in ip\_vs\_protocol\_init() (no CVSS, Linux)
- [CVE-2024-52332](https://cve.now/CVE-2024-52332.md): igb: Fix potential invalid memory access in igb\_init\_module() (no CVSS, Linux)
- [CVE-2024-50051](https://cve.now/CVE-2024-50051.md): spi: mpc52xx: Add cancel\_work\_sync before module remove (CVSS 7.8, Linux)
- [CVE-2024-49569](https://cve.now/CVE-2024-49569.md): nvme-rdma: unquiesce admin\_q before destroy it (CVSS 7.5, Linux)
- [CVE-2024-48881](https://cve.now/CVE-2024-48881.md): bcache: revert replacing IS\_ERR\_OR\_NULL with IS\_ERR again (CVSS 5.5, Linux)
- [CVE-2024-48876](https://cve.now/CVE-2024-48876.md): stackdepot: fix stack\_depot\_save\_flags() in NMI context (no CVSS, Linux)
- [CVE-2024-48875](https://cve.now/CVE-2024-48875.md): btrfs: don't take dev\_replace rwsem on task already holding it (CVSS 5.5, Linux)
- [CVE-2024-48873](https://cve.now/CVE-2024-48873.md): wifi: rtw89: check return value of ieee80211\_probereq\_get() for RNR (CVSS 5.5, Linux)
- [CVE-2024-47809](https://cve.now/CVE-2024-47809.md): dlm: fix possible lkb\_resource null dereference (CVSS 5.5, Linux)
- [CVE-2024-47794](https://cve.now/CVE-2024-47794.md): bpf: Prevent tailcall infinite loop caused by freplace (CVSS 7.8, Linux)
- [CVE-2024-47143](https://cve.now/CVE-2024-47143.md): dma-debug: fix a possible deadlock on radix\_lock (CVSS 5.5, Linux)
- [CVE-2024-47141](https://cve.now/CVE-2024-47141.md): pinmux: Use sequential access to access desc-\>pinmux data (CVSS 5.5, Linux)
- [CVE-2024-45828](https://cve.now/CVE-2024-45828.md): i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (CVSS 5.5, Linux)
- [CVE-2024-43098](https://cve.now/CVE-2024-43098.md): i3c: Use i3cdev-\>desc-\>info instead of calling i3c\_device\_get\_info() to avoid deadlock (CVSS 5.5, Linux)
- [CVE-2024-41935](https://cve.now/CVE-2024-41935.md): f2fs: fix to shrink read extent node in batches (no CVSS, Linux)
- [CVE-2024-41932](https://cve.now/CVE-2024-41932.md): sched: fix warning in sched\_setaffinity (no CVSS, Linux)
- [CVE-2025-0392](https://cve.now/CVE-2025-0392.md): Guangzhou Huayi Intelligent Technology Jeewms graphReportController.do datagridGraph sql injection (CVSS 5.3, Guangzhou Huayi Intelligent Technology Jeewms)
- [CVE-2025-0391](https://cve.now/CVE-2025-0391.md): Guangzhou Huayi Intelligent Technology Jeewms CgFormBuildController. java saveOrUpdate sql injection (CVSS 5.3, Guangzhou Huayi Intelligent Technology Jeewms)
- [CVE-2025-0390](https://cve.now/CVE-2025-0390.md): Guangzhou Huayi Intelligent Technology Jeewms wmOmNoticeHController.do path traversal (CVSS 6.9, Guangzhou Huayi Intelligent Technology Jeewms)
- [CVE-2024-12407](https://cve.now/CVE-2024-12407.md): Push Notification for Post and BuddyPress \<= 2.07 - Reflected Cross-Site Scripting (CVSS 6.1, murali-indiacitys Push Notification for Post and BuddyPress)
- [CVE-2024-11386](https://cve.now/CVE-2024-11386.md): GatorMail SmartForms \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wow-analytics GatorMail SmartForms)
- [CVE-2024-12527](https://cve.now/CVE-2024-12527.md): Perfect Portal Widgets \<= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, alanperfectportal Perfect Portal Widgets)
- [CVE-2024-11892](https://cve.now/CVE-2024-11892.md): Accordion Slider Lite \<= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bqworks Accordion Slider Lite)
- [CVE-2024-12877](https://cve.now/CVE-2024-12877.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.19.2 - Unauthenticated PHP Object Injection (CVSS 9.8, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-12412](https://cve.now/CVE-2024-12412.md): Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin \<= 2.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, magepeopleteam Booking and Rental Manager for Bike | Car |…)
- [CVE-2024-12520](https://cve.now/CVE-2024-12520.md): Dominion – Domain Checker for WPBakery \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, reader87 Dominion – Domain Checker for WPBakery)
- [CVE-2024-12116](https://cve.now/CVE-2024-12116.md): Unlimited Theme Addon For Elementor and WooCommerce \<= 1.2.2 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, codepopular Unlimited Theme Addon For Elementor)
- [CVE-2024-12519](https://cve.now/CVE-2024-12519.md): TCBD Auto Refresher \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tcoder TCBD Auto Refresher)
- [CVE-2024-11874](https://cve.now/CVE-2024-11874.md): Grid Accordion Lite \<= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bqworks Grid Accordion Lite)
- [CVE-2024-11915](https://cve.now/CVE-2024-11915.md): RRAddons for Elementor \<= 1.1.0 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, rrdevs RRAddons for Elementor)
- [CVE-2024-11758](https://cve.now/CVE-2024-11758.md): WP SPID Italia \<= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, milmor WP SPID Italia)
- [CVE-2024-42175](https://cve.now/CVE-2024-42175.md): HCL MyXalytics is affected by a weak input validation vulnerability (CVSS 2.6, HCL Software DRYiCE MyXalytics)
- [CVE-2024-42174](https://cve.now/CVE-2024-42174.md): HCL MyXalytics is affected by username enumeration vulnerability (CVSS 3.7, HCL Software DRYiCE MyXalytics)
- [CVE-2024-42173](https://cve.now/CVE-2024-42173.md): HCL MyXalytics is affected by an improper password policy implementation vulnerability (CVSS 4.8, HCL Software DRYiCE MyXalytics)
- [CVE-2024-42172](https://cve.now/CVE-2024-42172.md): HCL MyXalytics is affected by broken authentication (CVSS 5.3, HCL Software DRYiCE MyXalytics)
- [CVE-2024-42171](https://cve.now/CVE-2024-42171.md): HCL MyXalytics is affected by insufficient session expiration (CVSS 6.4, HCL Software DRYiCE MyXalytics)
- [CVE-2024-42170](https://cve.now/CVE-2024-42170.md): HCL MyXalytics is affected by a session fixation vulnerability (CVSS 6.8, HCL Software DRYiCE MyXalytics)
- [CVE-2024-12587](https://cve.now/CVE-2024-12587.md): Contact Form Master \<= 1.0.7 - Reflected XSS (CVSS 6.1, Contact Form Master)
- [CVE-2025-23109](https://cve.now/CVE-2025-23109.md): Address bar spoofing on iOS using long hostnames (CVSS 6.5, Mozilla Firefox for iOS)
- [CVE-2025-23108](https://cve.now/CVE-2025-23108.md): Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2024-12304](https://cve.now/CVE-2024-12304.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2025-0107](https://cve.now/CVE-2025-0107.md): Expedition: OS Command Injection Vulnerability (CVSS 7.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3)
- [CVE-2025-0106](https://cve.now/CVE-2025-0106.md): Expedition: Wildcard Expansion Vulnerability (CVSS 6.9, Palo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3)
- [CVE-2025-0105](https://cve.now/CVE-2025-0105.md): Expedition: Arbitrary File Deletion Vulnerability (CVSS 6.9, Palo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3)
- [CVE-2025-0104](https://cve.now/CVE-2025-0104.md): Expedition: Cross-Site Scripting (XSS) Vulnerability (CVSS 7.0, Palo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3)
- [CVE-2025-0103](https://cve.now/CVE-2025-0103.md): Expedition: SQL Injection Vulnerability (CVSS 9.2, Palo Alto Networks Cloud NGFW · Palo Alto Networks Exped… +3)
- [CVE-2024-42169](https://cve.now/CVE-2024-42169.md): HCL MyXalytics is affected by insecure direct object references (CVSS 7.1, HCL Software DRYiCE MyXalytics)
- [CVE-2024-42168](https://cve.now/CVE-2024-42168.md): HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability (CVSS 8.9, HCL Software DRYiCE MyXalytics)
- [CVE-2024-12204](https://cve.now/CVE-2024-12204.md): Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups \<= 1.3.5 - Missing Authorization (CVSS 5.4, premio Coupon X – Discount Popups & Promo Codes Pop Ups for…)
- [CVE-2024-11327](https://cve.now/CVE-2024-11327.md): ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages \<= 2.4.1 - Reflected Cross-Site Scripting (CVSS 6.1, ClickWhale – Link Manager, Link Shortener and Click Tracker…)
- [CVE-2024-12505](https://cve.now/CVE-2024-12505.md): Trackserver \<= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tinuzz Trackserver)
- [CVE-2024-12627](https://cve.now/CVE-2024-12627.md): Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups \<= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection (CVSS 7.5, premio Coupon X – Discount Popups & Promo Codes Pop Ups for…)
- [CVE-2024-12472](https://cve.now/CVE-2024-12472.md): Post Duplicator \<= 2.36 - Authenticated (Contributor+) Protected Post Disclosure (CVSS 4.3, metaphorcreations Post Duplicator)
- [CVE-2024-12404](https://cve.now/CVE-2024-12404.md): CF Internal Link Shortcode \<= 1.1.0 - Unauthenticated SQL Injection (CVSS 7.5, crowdfavorite CF Internal Link Shortcode)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.