# CVEs published 2025-01-20 33 CVEs were published on January 20, 2025: 4 critical, 7 high. Days are UTC. - [CVE-2025-24014](https://cve.now/CVE-2025-24014.md): segmentation fault in win\_line() in Vim \< 9.1.1043 (CVSS 4.2, vim) - [CVE-2024-13454](https://cve.now/CVE-2024-13454.md): Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when (CVSS 5.3, OpenVPN Easy-RSA) - [CVE-2025-23214](https://cve.now/CVE-2025-23214.md): Cosmos userbase checking vulnerability (CVSS 6.9, azukaar Cosmos-Server) - [CVE-2024-22349](https://cve.now/CVE-2024-22349.md): IBM UrbanCode Velocity information disclosure (CVSS 4.0, IBM UrbanCode Velocity · IBM DevOps Velocity) - [CVE-2024-22347](https://cve.now/CVE-2024-22347.md): IBM UrbanCode Velocity information disclosure (CVSS 5.9, IBM UrbanCode Velocity · IBM DevOps Velocity) - [CVE-2024-22348](https://cve.now/CVE-2024-22348.md): IBM UrbanCode Velocity cross-origin resource sharing (CVSS 5.3, IBM UrbanCode Velocity · IBM DevOps Velocity) - [CVE-2025-23221](https://cve.now/CVE-2025-23221.md): Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism (CVSS 5.4, dahlia fedify · @fedify/fedify) - [CVE-2025-24013](https://cve.now/CVE-2025-24013.md): CodeIgniter validation of header name and value (CVSS 5.3, CodeIgniter4 · codeigniter4/framework) - [CVE-2025-24010](https://cve.now/CVE-2025-24010.md): Vite allows any websites to send any requests to the development server and read the response (CVSS 6.5, vitejs vite · vite) - [CVE-2025-23220](https://cve.now/CVE-2025-23220.md): WeGIA has a SQL Injection endpoint 'adicionar\_raca.php' parameter 'raca' (CVSS 10.0, LabRedesCefetRJ WeGIA) - [CVE-2025-23219](https://cve.now/CVE-2025-23219.md): WeGIA has a SQL Injection endpoint 'adicionar\_cor.php' parameter 'cor' (CVSS 10.0, LabRedesCefetRJ WeGIA) - [CVE-2025-23218](https://cve.now/CVE-2025-23218.md): WeGIA has a SQL Injection endpoint 'adicionar\_especie.php' parameter 'especie' (CVSS 10.0, LabRedesCefetRJ WeGIA) - [CVE-2025-23044](https://cve.now/CVE-2025-23044.md): Cross-Site Request Forgery (CSRF) allows creating admin account with POST request (CVSS 6.8, pwndoc) - [CVE-2025-22620](https://cve.now/CVE-2025-22620.md): gix-worktree-state nonexclusive checkout sets executable files world-writable (CVSS 5.0, GitoxideLabs gitoxide · gix-worktree-state) - [CVE-2025-22131](https://cve.now/CVE-2025-22131.md): Cross-Site Scripting (XSS) vulnerability in generateNavigation() function (CVSS 5.1, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1) - [CVE-2024-51738](https://cve.now/CVE-2024-51738.md): Sunshine improperly enforces pairing protocol request order (CVSS 7.7, LizardByte Sunshine) - [CVE-2024-45647](https://cve.now/CVE-2024-45647.md): IBM Security Verify Access unverified password change (CVSS 5.6, IBM Security Verify Access) - [CVE-2025-21655](https://cve.now/CVE-2025-21655.md): io\_uring/eventfd: ensure io\_eventfd\_signal() defers another RCU period (CVSS 7.8, Linux) - [CVE-2024-13176](https://cve.now/CVE-2024-13176.md): Timing side-channel in ECDSA signature computation (CVSS 4.1, OpenSSL) - [CVE-2025-0479](https://cve.now/CVE-2025-0479.md): Security Misconfiguration Vulnerability in CP Plus Router (CVSS 8.6, CP Plus CP-XR-DE21-S Router) - [CVE-2023-52923](https://cve.now/CVE-2023-52923.md): netfilter: nf\_tables: adapt set backend to use GC transaction API (CVSS 7.8, Linux) - [CVE-2025-0590](https://cve.now/CVE-2025-0590.md): Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk. (CVSS 7.5, TECNO com.transsion.carlcare) - [CVE-2025-0582](https://cve.now/CVE-2025-0582.md): itsourcecode Farm Management System add-pig.php unrestricted upload (CVSS 5.1, itsourcecode Farm Management System) - [CVE-2025-0581](https://cve.now/CVE-2025-0581.md): CampCodes School Management Software Chat History send cross site scripting (CVSS 5.3, CampCodes School Management Software) - [CVE-2025-0580](https://cve.now/CVE-2025-0580.md): Shiprocket Module REST API Module rest\_api authorization (CVSS 6.3, Shiprocket Module) - [CVE-2025-0579](https://cve.now/CVE-2025-0579.md): Shiprocket Module REST API Module restapi sql injection (CVSS 6.9, Shiprocket Module) - [CVE-2025-0586](https://cve.now/CVE-2025-0586.md): aEnrich Technology a+HRD - Insecure Deserialization (CVSS 7.2, aEnrich Technology a+HRD) - [CVE-2025-0585](https://cve.now/CVE-2025-0585.md): aEnrich Technology a+HRD - SQL Injection (CVSS 9.8, aEnrich Technology a+HRD) - [CVE-2025-0584](https://cve.now/CVE-2025-0584.md): aEnrich Technology a+HRD - Server-Side Request Forgery (SSRF) (CVSS 5.3, aEnrich Technology a+HRD) - [CVE-2024-13524](https://cve.now/CVE-2024-13524.md): obsproject OBS Studio untrusted search path (CVSS 2.0, obsproject OBS Studio) - [CVE-2025-0583](https://cve.now/CVE-2025-0583.md): aEnrich Technology a+HRD - Reflected Cross-site Scripting(XSS) (CVSS 6.1, aEnrich Technology a+HRD) - [CVE-2025-0578](https://cve.now/CVE-2025-0578.md): Facile Sistemas Cloud Apps Password Reset forgotpassword cross site scripting (CVSS 5.3, Facile Sistemas Cloud Apps) - [CVE-2025-24337](https://cve.now/CVE-2025-24337.md): WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini. (CVSS 8.4, Musing Studio WriteFreely · github.com/writefreely/writefre…) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-01-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.