CVEs published January 20, 2025
33 CVEs were published on January 20, 2025: 4 critical, 7 high.
- Published
- 33
- Critical
- 4
- High
- 7
- Medium
- 21
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- aEnrich Technology a+HRD
- 4
- IBM UrbanCode Velocity · IBM DevOps Velocity
- 3
- LabRedesCefetRJ WeGIA
- 3
- Linux
- 2
- Shiprocket Module
- 2
- azukaar Cosmos-Server
- 1
- CampCodes School Management Software
- 1
- CodeIgniter4 · codeigniter4/framework
- 1
- CP Plus CP-XR-DE21-S Router
- 1
- dahlia fedify · @fedify/fedify
- 1
Critical 4
- CVE-2025-23220WeGIA has a SQL Injection endpoint 'adicionar_raca.php' parameter 'raca'LabRedesCefetRJ WeGIA
- CVE-2025-23219WeGIA has a SQL Injection endpoint 'adicionar_cor.php' parameter 'cor'LabRedesCefetRJ WeGIA
- CVE-2025-23218WeGIA has a SQL Injection endpoint 'adicionar_especie.php' parameter 'especie'LabRedesCefetRJ WeGIA
- CVE-2025-0585aEnrich Technology a+HRD - SQL InjectionaEnrich Technology a+HRD
High 7
- CVE-2024-51738Sunshine improperly enforces pairing protocol request orderLizardByte Sunshine
- CVE-2025-21655io_uring/eventfd: ensure io_eventfd_signal() defers another RCU periodLinux
- CVE-2025-0479Security Misconfiguration Vulnerability in CP Plus RouterCP Plus CP-XR-DE21-S Router
- CVE-2023-52923netfilter: nf_tables: adapt set backend to use GC transaction APILinux
- CVE-2025-0590Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.TECNO com.transsion.carlcare
- CVE-2025-0586aEnrich Technology a+HRD - Insecure DeserializationaEnrich Technology a+HRD
- CVE-2025-24337WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.Musing Studio WriteFreely · github.com/writefreely/writefre…
Medium, low and unrated 22
- CVE-2025-24014segmentation fault in win_line() in Vim < 9.1.1043vim
- CVE-2024-13454Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when OpenVPN Easy-RSA
- CVE-2025-23214Cosmos userbase checking vulnerabilityazukaar Cosmos-Server
- CVE-2024-22349IBM UrbanCode Velocity information disclosureIBM UrbanCode Velocity · IBM DevOps Velocity
- CVE-2024-22347IBM UrbanCode Velocity information disclosureIBM UrbanCode Velocity · IBM DevOps Velocity
- CVE-2024-22348IBM UrbanCode Velocity cross-origin resource sharingIBM UrbanCode Velocity · IBM DevOps Velocity
- CVE-2025-23221Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanismdahlia fedify · @fedify/fedify
- CVE-2025-24013CodeIgniter validation of header name and valueCodeIgniter4 · codeigniter4/framework
- CVE-2025-24010Vite allows any websites to send any requests to the development server and read the responsevitejs vite · vite
- CVE-2025-23044Cross-Site Request Forgery (CSRF) allows creating admin account with POST requestpwndoc
- CVE-2025-22620gix-worktree-state nonexclusive checkout sets executable files world-writableGitoxideLabs gitoxide · gix-worktree-state
- CVE-2025-22131Cross-Site Scripting (XSS) vulnerability in generateNavigation() functionPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-45647IBM Security Verify Access unverified password changeIBM Security Verify Access
- CVE-2024-13176Timing side-channel in ECDSA signature computationOpenSSL
- CVE-2025-0582itsourcecode Farm Management System add-pig.php unrestricted uploaditsourcecode Farm Management System
- CVE-2025-0581CampCodes School Management Software Chat History send cross site scriptingCampCodes School Management Software
- CVE-2025-0580Shiprocket Module REST API Module rest_api authorizationShiprocket Module
- CVE-2025-0579Shiprocket Module REST API Module restapi sql injectionShiprocket Module
- CVE-2025-0584aEnrich Technology a+HRD - Server-Side Request Forgery (SSRF)aEnrich Technology a+HRD
- CVE-2024-13524obsproject OBS Studio untrusted search pathobsproject OBS Studio
- CVE-2025-0583aEnrich Technology a+HRD - Reflected Cross-site Scripting(XSS)aEnrich Technology a+HRD
- CVE-2025-0578Facile Sistemas Cloud Apps Password Reset forgotpassword cross site scriptingFacile Sistemas Cloud Apps