# CVEs published 2025-01-19

63 CVEs were published on January 19, 2025: 2 critical, 24 high. Days are UTC.

- [CVE-2025-0576](https://cve.now/CVE-2025-0576.md): Mobotix M15 player cross site scripting (CVSS 6.9, Mobotix M15)
- [CVE-2025-0575](https://cve.now/CVE-2025-0575.md): Union Bank of India Vyom Rooting Detection protection mechanism (CVSS 1.8, Union Bank of India Vyom)
- [CVE-2024-41742](https://cve.now/CVE-2024-41742.md): IBM TXSeries for Multiplatforms denial of service (CVSS 7.5, IBM TXSeries for Multiplatforms)
- [CVE-2024-41743](https://cve.now/CVE-2024-41743.md): IBM TXSeries for Multiplatforms denial of service (CVSS 7.5, IBM TXSeries for Multiplatforms)
- [CVE-2024-41783](https://cve.now/CVE-2024-41783.md): IBM Sterling Secure Proxy improper input validation (CVSS 9.1, IBM Sterling Secure Proxy)
- [CVE-2024-38337](https://cve.now/CVE-2024-38337.md): IBM Sterling Secure Proxy improper input validation (CVSS 9.1, IBM Sterling Secure Proxy)
- [CVE-2024-57929](https://cve.now/CVE-2024-57929.md): dm array: fix releasing a faulty array block twice in dm\_array\_cursor\_end (CVSS 7.8, Linux)
- [CVE-2024-57928](https://cve.now/CVE-2024-57928.md): netfs: Fix enomem handling in buffered reads (no CVSS, Linux)
- [CVE-2024-57927](https://cve.now/CVE-2024-57927.md): nfs: Fix oops in nfs\_netfs\_init\_request() when copying to cache (CVSS 5.5, Linux)
- [CVE-2024-57926](https://cve.now/CVE-2024-57926.md): drm/mediatek: Set private-\>all\_drm\_private\[i\]-\>drm to NULL if mtk\_drm\_bind returns err (CVSS 7.8, Linux)
- [CVE-2024-57925](https://cve.now/CVE-2024-57925.md): ksmbd: fix a missing return value check bug (CVSS 7.1, Linux)
- [CVE-2024-57924](https://cve.now/CVE-2024-57924.md): fs: relax assertions on failure to encode file handles (no CVSS, Linux)
- [CVE-2024-57923](https://cve.now/CVE-2024-57923.md): btrfs: zlib: fix avail\_in bytes for s390 zlib HW compression path (no CVSS, Linux)
- [CVE-2024-57922](https://cve.now/CVE-2024-57922.md): drm/amd/display: Add check for granularity in dml ceil/floor helpers (CVSS 5.5, Linux)
- [CVE-2024-57921](https://cve.now/CVE-2024-57921.md): drm/amdgpu: Add a lock when accessing the buddy trim function (CVSS 7.8, Linux)
- [CVE-2024-57919](https://cve.now/CVE-2024-57919.md): drm/amd/display: fix divide error in DM plane scale calcs (CVSS 5.5, Linux)
- [CVE-2024-57918](https://cve.now/CVE-2024-57918.md): drm/amd/display: fix page fault due to max surface definition mismatch (CVSS 7.8, Linux)
- [CVE-2024-57917](https://cve.now/CVE-2024-57917.md): topology: Keep the cpumask unchanged when printing cpumap (no CVSS, Linux)
- [CVE-2024-57916](https://cve.now/CVE-2024-57916.md): misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling (CVSS 5.5, Linux)
- [CVE-2024-57914](https://cve.now/CVE-2024-57914.md): usb: typec: tcpci: fix NULL pointer issue on shared irq case (CVSS 5.5, Linux)
- [CVE-2024-57913](https://cve.now/CVE-2024-57913.md): usb: gadget: f\_fs: Remove WARN\_ON in functionfs\_bind (CVSS 4.7, Linux)
- [CVE-2024-57912](https://cve.now/CVE-2024-57912.md): iio: pressure: zpa2326: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57911](https://cve.now/CVE-2024-57911.md): iio: dummy: iio\_simply\_dummy\_buffer: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57910](https://cve.now/CVE-2024-57910.md): iio: light: vcnl4035: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57909](https://cve.now/CVE-2024-57909.md): iio: light: bh1745: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57908](https://cve.now/CVE-2024-57908.md): iio: imu: kmx61: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57907](https://cve.now/CVE-2024-57907.md): iio: adc: rockchip\_saradc: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57906](https://cve.now/CVE-2024-57906.md): iio: adc: ti-ads8688: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57905](https://cve.now/CVE-2024-57905.md): iio: adc: ti-ads1119: fix information leak in triggered buffer (CVSS 7.1, Linux)
- [CVE-2024-57904](https://cve.now/CVE-2024-57904.md): iio: adc: at91: call input\_free\_device() on allocated iio\_dev (no CVSS, Linux)
- [CVE-2025-21654](https://cve.now/CVE-2025-21654.md): ovl: support encoding fid from inode with no alias (no CVSS, Linux)
- [CVE-2025-21653](https://cve.now/CVE-2025-21653.md): net\_sched: cls\_flow: validate TCA\_FLOW\_RSHIFT attribute (no CVSS, Linux)
- [CVE-2025-21652](https://cve.now/CVE-2025-21652.md): ipvlan: Fix use-after-free in ipvlan\_get\_iflink(). (CVSS 7.8, Linux)
- [CVE-2025-21651](https://cve.now/CVE-2025-21651.md): net: hns3: don't auto enable misc vector (no CVSS, Linux)
- [CVE-2025-21650](https://cve.now/CVE-2025-21650.md): net: hns3: fixed hclge\_fetch\_pf\_reg accesses bar space out of bounds issue (CVSS 7.1, Linux)
- [CVE-2025-21649](https://cve.now/CVE-2025-21649.md): net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (CVSS 5.5, Linux)
- [CVE-2025-21648](https://cve.now/CVE-2025-21648.md): netfilter: conntrack: clamp maximum hashtable size to INT\_MAX (no CVSS, Linux)
- [CVE-2025-21647](https://cve.now/CVE-2025-21647.md): sched: sch\_cake: add bounds checks to host bulk flow fairness counts (CVSS 7.3, Linux)
- [CVE-2025-21646](https://cve.now/CVE-2025-21646.md): afs: Fix the maximum cell name length (CVSS 7.5, Linux)
- [CVE-2025-21645](https://cve.now/CVE-2025-21645.md): platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it (no CVSS, Linux)
- [CVE-2025-21644](https://cve.now/CVE-2025-21644.md): drm/xe: Fix tlb invalidation when wedging (CVSS 5.5, Linux)
- [CVE-2025-21643](https://cve.now/CVE-2025-21643.md): netfs: Fix kernel async DIO (no CVSS, Linux)
- [CVE-2025-21642](https://cve.now/CVE-2025-21642.md): mptcp: sysctl: sched: avoid using current-\>nsproxy (CVSS 5.5, Linux)
- [CVE-2025-21641](https://cve.now/CVE-2025-21641.md): mptcp: sysctl: blackhole timeout: avoid using current-\>nsproxy (CVSS 5.5, Linux)
- [CVE-2025-21640](https://cve.now/CVE-2025-21640.md): sctp: sysctl: cookie\_hmac\_alg: avoid using current-\>nsproxy (CVSS 7.1, Linux)
- [CVE-2025-21639](https://cve.now/CVE-2025-21639.md): sctp: sysctl: rto\_min/max: avoid using current-\>nsproxy (CVSS 5.5, Linux)
- [CVE-2025-21638](https://cve.now/CVE-2025-21638.md): sctp: sysctl: auth\_enable: avoid using current-\>nsproxy (CVSS 7.1, Linux)
- [CVE-2025-21637](https://cve.now/CVE-2025-21637.md): sctp: sysctl: udp\_port: avoid using current-\>nsproxy (CVSS 7.1, Linux)
- [CVE-2025-21636](https://cve.now/CVE-2025-21636.md): sctp: sysctl: plpmtud\_probe\_interval: avoid using current-\>nsproxy (CVSS 5.5, Linux)
- [CVE-2025-21635](https://cve.now/CVE-2025-21635.md): rds: sysctl: rds\_tcp\_{rcv,snd}buf: avoid using current-\>nsproxy (CVSS 5.5, Linux)
- [CVE-2025-21634](https://cve.now/CVE-2025-21634.md): cgroup/cpuset: remove kernfs active break (CVSS 5.5, Linux)
- [CVE-2025-21632](https://cve.now/CVE-2025-21632.md): x86/fpu: Ensure shadow stack is active before "getting" registers (no CVSS, Linux)
- [CVE-2025-21631](https://cve.now/CVE-2025-21631.md): block, bfq: fix waker\_bfqq UAF after bfq\_split\_bfqq() (CVSS 7.8, Linux)
- [CVE-2025-0567](https://cve.now/CVE-2025-0567.md): Epic Games Launcher Installer profapi.dll untrusted search path (CVSS 2.0, Epic Games Launcher)
- [CVE-2025-0566](https://cve.now/CVE-2025-0566.md): Tenda AC15 SetDevNetName formSetDevNetName stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-0565](https://cve.now/CVE-2025-0565.md): ZZCMS index.php sql injection (CVSS 6.9, ZZCMS)
- [CVE-2024-8722](https://cve.now/CVE-2024-8722.md): WP All Import Pro \<= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.5, Soflyy WP All Import Pro)
- [CVE-2025-0564](https://cve.now/CVE-2025-0564.md): code-projects Fantasy-Cricket authenticate.php sql injection (CVSS 6.9, code-projects Fantasy-Cricket)
- [CVE-2024-45652](https://cve.now/CVE-2024-45652.md): IBM Maximo Asset Management directory traversal (CVSS 6.5, IBM Maximo Asset Management)
- [CVE-2024-45653](https://cve.now/CVE-2024-45653.md): IBM Sterling Connect:Direct Web Services information disclosure (CVSS 4.3, IBM Sterling Connect:Direct Web Services)
- [CVE-2024-45654](https://cve.now/CVE-2024-45654.md): IBM Security ReaQta improper input validation (CVSS 4.3, IBM Security ReaQta)
- [CVE-2025-0563](https://cve.now/CVE-2025-0563.md): code-projects Fantasy-Cricket update.php sql injection (CVSS 5.3, code-projects Fantasy-Cricket)
- [CVE-2025-0562](https://cve.now/CVE-2025-0562.md): Codezips Gym Management System health\_status\_entry.php sql injection (CVSS 5.3, Codezips Gym Management System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.