CVEs published January 17, 2025
95 CVEs were published on January 17, 2025: 8 critical, 26 high.
- Published
- 95
- Critical
- 8
- High
- 26
- Medium
- 59
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Google Android
- 15
- ETIC Telecom Remote Access Server
- 5
- Codezips Gym Management System
- 3
- Ossur Mobile Logic Application
- 3
- 1000 Projects Campaign Management System Platform for Women
- 2
- barteled Sandbox
- 2
- Gravity Forms
- 2
- Lexmark Printer Firmware
- 2
- Newtec/iDirect NTC2218, NTC2250, NTC2299
- 2
- Schneider Electric PowerLogic HDPM6000
- 2
Critical 8
- CVE-2017-13322In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services due to a logic error Google Android
- CVE-2025-23202Improper Input Validation in Bible Module for ROBLOXdevycreates Bible-Module
- CVE-2024-13502A command injection in the NTC2218, NTC2250, NTC2299 modems' web interfaces allows to exeucte arbitrary shell commands.Newtec/iDirect NTC2218, NTC2250, NTC2299
- CVE-2024-13503Stack-Based Buffer Overflow in Newtec's update signaling causes RCENewtec/iDirect NTC2218, NTC2250, NTC2299
- CVE-2024-57031WeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter.
- CVE-2024-57032WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php.
- CVE-2024-57034WeGIA < 3.2.0 is vulnerable to SQL Injection in query_geracao_auto.php via the query parameter.
- CVE-2024-57035WeGIA v3.2.0 is vulnerable to SQL Injection viathe nextPage parameter in /controle/control.php.
High 26
- CVE-2023-50739A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices.Lexmark Printer Firmware
- CVE-2018-9401In many locations, there is a possible way to access kernel memory in user space due to an incorrect bounds check.Google Android
- CVE-2018-9387In multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an integer overflow.Google Android
- CVE-2018-9464In multiple locations, there is a possible way to read protected files due to a missing permission check.Google Android
- CVE-2018-9461In onAttachFragment of ShareIntentActivity.java, there is a possible way for an app to read files in the messages app due to a race conditioGoogle Android
- CVE-2018-9434In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization.Google Android
- CVE-2018-9382In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing pGoogle Android
- CVE-2018-9375In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confusGoogle Android
- CVE-2025-23208IdP group membership revocation ignored in zotproject-zot zot · zotregistry.dev/zot
- CVE-2025-21606Local Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in statsexelban stats
- CVE-2025-21399Microsoft Edge (Chromium-based) Update Elevation of Privilege VulnerabilityMicrosoft Edge Update Setup
- CVE-2024-12757Nedap Librix Ecoreader Missing Authentication for Critical FunctionNedap Librix Ecoreader
- CVE-2025-0430Belledonne Communications Linphone-Desktop NULL Pointer DereferenceBelledonne Communications Linphone-Desktop
- CVE-2024-26153ETIC Telecom Remote Access Server (RAS) Cross-Site Request ForgeryETIC Telecom Remote Access Server
- CVE-2025-0528Tenda AC8/AC10/AC18 HTTP Request telnet command injectionTenda AC8 · Tenda AC10 +1
- CVE-2024-10497CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outsSchneider Electric PowerLogic HDPM6000
- CVE-2024-12703CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote cSchneider Electric RemoteConnect and SCADAPack x70 Utilities
- CVE-2024-12142CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restrictSchneider Electric Modicon M340 processors · Schneider E… +2
- CVE-2024-12476CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstaSchneider Electric Web Designer for BMXNOR0200H · Schnei… +2
- CVE-2024-13377GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameterGravity Forms
- CVE-2024-11425CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticatedSchneider Electric Modicon M580 CPU · Schneider Electric… +1
- CVE-2024-13333Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Uploadsaadiqbal Advanced File Manager — Ultimate WordPress File M…
- CVE-2025-21325Windows Secure Kernel Mode Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-34579Fuji Electric Alpha5 SMART Stack-Based Buffer OverflowFuji Electric Alpha5 SMART
- CVE-2024-52870Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality
- CVE-2024-57030Wegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.
Medium, low and unrated 61
- CVE-2024-11923Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3Fortra Application Hub
- CVE-2018-9405In BnDmAgent::onTransact of dm_agent.cpp, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9406In NlpService, there is a possible way to obtain location information due to a missing permission check.Google Android
- CVE-2018-9389In ip6_append_data of ip6_output.c, there is a possible way to achieve code execution due to a heap buffer overflow.Google Android
- CVE-2018-9447In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the emergency callback mode due to a missing null checGoogle Android
- CVE-2018-9379In multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a confused deputy.Google Android
- CVE-2018-9384In multiple locations, there is a possible way to bypass KASLR due to an unusual root cause.Google Android
- CVE-2018-9383In asn1_ber_decoder of asn1_decoder.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2025-0541Codezips Gym Management System edit_member.php sql injectionCodezips Gym Management System
- CVE-2025-23207\htmlData does not validate attribute names in KaTeXKaTeX
- CVE-2023-50738A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.Lexmark Printer Firmware
- CVE-2025-0540itsourcecode Tailoring Management System expadd.php sql injectionitsourcecode Tailoring Management System
- CVE-2025-23206IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdkaws-cdk · aws-cdk-lib
- CVE-2025-0538code-projects Tourism Management System manage-pages.php cross site scriptingcode-projects Tourism Management System
- CVE-2025-23205`frame-ancestors: self` grants all users access to formgrader in nbgraderjupyter nbgrader · nbgrader
- CVE-2025-23039Cross Site Scripting on URL decode Tooltip in Caidocaido
- CVE-2024-13026Inadequate Encryption Strength Vulnerability in Roche Algo EdgeRoche Diagnostics Algorithm Suite
- CVE-2025-0537code-projects Car Rental Management System manage-pages.php cross site scriptingcode-projects Car Rental Management System
- CVE-2025-05361000 Projects Attendance Tracking Management System edit_action.php sql injection1000 Projects Attendance Tracking Management System
- CVE-2025-21185Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2025-0535Codezips Gym Management System edit_mem_submit.php sql injectionCodezips Gym Management System
- CVE-2025-05341000 Projects Campaign Management System Platform for Women loginnew.php sql injection1000 Projects Campaign Management System Platform for Women
- CVE-2025-05331000 Projects Campaign Management System Platform for Women sc_login.php sql injection1000 Projects Campaign Management System Platform for Women
- CVE-2025-0532Codezips Gym Management System new_submit.php sql injectionCodezips Gym Management System
- CVE-2024-45832Ossur Mobile Logic Application Use of Hard-coded CredentialsOssur Mobile Logic Application
- CVE-2024-54681Ossur Mobile Logic Application Command InjectionOssur Mobile Logic Application
- CVE-2024-53683Ossur Mobile Logic Application Exposure of Sensitive System Information to an Unauthorized Control SphereOssur Mobile Logic Application
- CVE-2024-26155ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive InformationETIC Telecom Remote Access Server
- CVE-2024-26154ETIC Telecom Remote Access Server (RAS) Cross-site ScriptingETIC Telecom Remote Access Server
- CVE-2024-26157ETIC Telecom Remote Access Server (RAS) Cross-site ScriptingETIC Telecom Remote Access Server
- CVE-2024-26156ETIC Telecom Remote Access Server (RAS) Cross-site ScriptingETIC Telecom Remote Access Server
- CVE-2025-0531code-projects Chat System leaveroom.php sql injectioncode-projects Chat System
- CVE-2025-0530code-projects Job Recruitment _feedback_system.php cross site scriptingcode-projects Job Recruitment
- CVE-2025-0529code-projects Train Ticket Reservation System Login Form stack-based overflowcode-projects Train Ticket Reservation System
- CVE-2025-0527code-projects Admission Management System signupconfirm.php sql injectioncode-projects Admission Management System
- CVE-2024-10498CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attacSchneider Electric PowerLogic HDPM6000
- CVE-2024-12399CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partSchneider Electric Pro-face GP-Pro EX · Schneider Electric…
- CVE-2024-13378GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameterGravity Forms
- CVE-2024-11139CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to exSchneider Electric EcoStruxure™ Power Build Rapsody
- CVE-2024-12370WP Hotel Booking <= 2.1.5 - Missing Authorizationthimpress WP Hotel Booking
- CVE-2024-12203RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scriptingbrandondove RSS Icon Widget
- CVE-2024-12466Proofreading <= 1.2.1.1 - Reflected Cross-Site Scriptingscribit Proofreading
- CVE-2024-12598MyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via book Parameterzookatron MyBookProgress by Stormhill Media
- CVE-2024-12637Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposurekatsushi-kawamori Moving Users
- CVE-2024-13367Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Downloadbarteled Sandbox
- CVE-2024-13386quote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingtobig quote-posttype-plugin
- CVE-2024-13366Sandbox <= 0.4 - Reflected Cross-Site Scriptingbarteled Sandbox
- CVE-2024-12508Glofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingglofoxwebdev Glofox Shortcodes
- CVE-2024-10799Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Readimithemes Eventer - WordPress Event & Booking Manager Plugin
- CVE-2024-11146TrueFiling authorization bypass via user-controlled keysi3 Verticals TrueFiling
- CVE-2024-13398Checkout for PayPal <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scriptingnaa986 Checkout for PayPal
- CVE-2024-13434WP Inventory Manager <= 2.3.2 - Reflected Cross-Site Scriptingchuck1982 WP Inventory Manager
- CVE-2024-13401Payment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scriptingnaa986 Payment Button for PayPal
- CVE-2024-51462IBM QRadar WinCollect Agent data manipulationIBM QRadar WinCollect Agent
- CVE-2024-52363IBM InfoSphere Information Server directory traversalIBM InfoSphere Information Server
- CVE-2024-50967The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability.
- CVE-2024-57033WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php.
- CVE-2024-57252OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily.
- CVE-2024-57369Clickjacking vulnerability in typecho v1.2.1.
- CVE-2024-57370Cross Site Scripting vulnerability in sunnygkp10 Online Exam System master version allows a remote attacker to obtain sensitive information
- CVE-2024-57372Cross Site Scripting vulnerability in InformationPush master version allows a remote attacker to obtain sensitive information via the title,