CVEs published January 23, 2025
111 CVEs were published on January 23, 2025: 11 critical, 47 high. 1 is now in CISA KEV.
- Published
- 111
- Critical
- 11
- High
- 47
- Medium
- 46
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 30
Most affected products
- HCL Software BigFix Patch Management Download Plug-ins
- 6
- lunasvg
- 6
- Xerox Workplace Suite
- 6
- ECOVACS Unspecified robots
- 5
- Elastic Kibana
- 4
- M-Files Server
- 3
- Fedora Repository
- 2
- IBM Sterling B2B Integrator Standard Edition
- 2
- Alessandro Benoit WpDevTool
- 1
- antonzaroutski AZ Content Finder
- 1
Critical 11
- CVE-2024-52329ECOVACS HOME mobile app plugins do not properly validate TLS certificatesECOVACS HOME
- CVE-2025-0637Inadequate access control in Beta10Beta10
- CVE-2024-57947netfilter: nf_set_pipapo: fix initial map fillLinux
- CVE-2025-23006Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) andSonicWall SMA1000
- CVE-2024-52975Fleet Server sensitive information exposure via logsElastic Fleet Server
- CVE-2024-53923An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24.
- CVE-2024-55192OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char cons
- CVE-2024-55194OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.
- CVE-2024-55573An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.
- CVE-2024-55971SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to ru
- CVE-2024-57328A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0.
High 47
- CVE-2025-23012Fedora Repository fedoraIntCallUser default credentialsFedora Repository
- CVE-2025-23011Fedora Repository archive extraction path traversalFedora Repository
- CVE-2025-24033@fastify/multipart vulnerable to unlimited consumption of resourcesfastify-multipart · @fastify/multipart
- CVE-2025-22153try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreterzopefoundation RestrictedPython · restrictedpython
- CVE-2024-55927Flawed token generation implementation & Hard-coded key implementationXerox Workplace Suite
- CVE-2024-55926Arbitrary file upload, deletion and read through header manipulationXerox Workplace Suite
- CVE-2024-55925API Security bypass through header manipulationXerox Workplace Suite
- CVE-2024-11147ECOVACS lawnmowers and vacuums deterministic root passwordECOVACS Unspecified robots
- CVE-2024-52331ECOVACS lawnmowers and vacuums deterministic firmware encryption keyECOVACS Unspecified robots
- CVE-2024-52330ECOVACS lawnmowers and vacuums do not properly validate TLS certificatesECOVACS DEEBOT X5 PRO PLUS · ECOVACS DEEBOT X5 PRO +13
- CVE-2025-0650Ovn: egress acls may be bypassed via specially crafted udp packetovn · Fast Datapath for Red Hat Enterprise Linux +1
- CVE-2025-23960WordPress Save & Import Image from URL Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerabilitybasteln3rk Save & Import Image from URL
- CVE-2025-23894WordPress wp-flickr-press Plugin <= 2.6.4 - Reflected Cross Site Scripting (XSS) vulnerabilitytatsuya wp-flickr-press
- CVE-2025-23836WordPress Custom Coming Soon Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilitySuryaBhan Custom Coming Soon
- CVE-2025-23835WordPress Legal + Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityjmraya Legal +
- CVE-2025-23834WordPress Links/Problem Reporter plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityRaminMT Links/Problem Reporter
- CVE-2025-23733WordPress SC Simple Zazzle plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilitysayoko SC Simple Zazzle
- CVE-2025-23730WordPress FLX Dashboard Groups plugin <= 0.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityflx0 FLX Dashboard Groups
- CVE-2025-23729WordPress XTRA Settings plugin <= 2.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityfures XTRA Settings
- CVE-2025-23727WordPress AZ Content Finder plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityantonzaroutski AZ Content Finder
- CVE-2025-23725WordPress Accessibility Task Manager plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilitypshikli Accessibility Task Manager
- CVE-2025-23724WordPress University Quizzes Online plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityoleksandr87 University Quizzes Online
- CVE-2025-23723WordPress Plestar Directory Listing plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityhdw player Plestar Directory Listing
- CVE-2025-23722WordPress Mind3doM RyeBread Widgets plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMind3doM RyeBread Widgets
- CVE-2025-23636WordPress My Favorite Car plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityDimitar A. My Favorite Car
- CVE-2025-23634WordPress Youtube Video Grid plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerabilitycodehandling Youtube Video Grid
- CVE-2025-23629WordPress Gallerio plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitySubhasis Laha Gallerio
- CVE-2025-23628WordPress GeoDigs plugin <= 3.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityNewMediaOne GeoDigs
- CVE-2025-23626WordPress Kumihimo plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityfukushima Kumihimo
- CVE-2025-23624WordPress WpDevTool plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityAlessandro Benoit WpDevTool
- CVE-2025-23545WordPress WP Social Broadcast plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityNavnish Bhardwaj WP Social Broadcast
- CVE-2025-23544WordPress StatPressCN plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityheart5 StatPressCN
- CVE-2025-23541WordPress Download, Downloads plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityedmon.parker Download, Downloads
- CVE-2025-22768WordPress Rocket Media Library Mime Type plugin <= 2.1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityJinHan Park Rocket Media Library Mime Type
- CVE-2025-22264WordPress WP Query Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityPatel WP Query Creator
- CVE-2025-23540WordPress WP Front-end login and register plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMohsin Khan WP Front-end login and register
- CVE-2024-13234Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injectionwoobewoo Product Table for WooCommerce by WBW
- CVE-2024-12957A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion.ASUS Armoury Crate
- CVE-2024-13593BMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusionotrok7 BMLT Meeting Map
- CVE-2024-43707Kibana exposure of sensitive information to an unauthorized actorElastic Kibana
- CVE-2025-24030Envoy Admin Interface Exposed through prometheus metrics endpointenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2023-46401KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.
- CVE-2024-50664gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box.
- CVE-2024-53379Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12
- CVE-2024-53588A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \Pro
- CVE-2024-55195An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the progra
- CVE-2024-57722lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.lunasvg
Medium, low and unrated 53
- CVE-2021-42718Sensitive data unnecessarily returned from authenticated APIReplicated Classic
- CVE-2025-0693Issue with AWS Sign-in IAM User Login Flow - Possible Username EnumerationAWS Sign-in IAM Login Flow
- CVE-2025-24353Directus privilege escalation vulnerability using Share featuredirectus · @directus/app
- CVE-2025-24034Himmelblau leaks credentials in the debug loghimmelblau-idm himmelblau
- CVE-2024-55930Weak default folder permissionsXerox Workplace Suite
- CVE-2024-45672IBM Security Verify Bridge data manipulationIBM Security Verify Bridge
- CVE-2024-55929Mail spoofingXerox Workplace Suite
- CVE-2024-55928Clear text secrets returned & Remote system secrets in clear textXerox Workplace Suite
- CVE-2025-23227IBM Tivoli Application Dependency Discovery Manager cross-site scriptingIBM Tivoli Application Dependency Discovery Manager
- CVE-2024-52327ECOVACS lawnmower and vacuum cloud service live video PIN bypassECOVACS HOME · ECOVACS cloud service
- CVE-2024-12079ECOVACS lawnmowers cleartext storage of anti-theft PINECOVACS Unspecified robots
- CVE-2024-12078ECOVACS lawnmowers and vacuums static BLE GATT encryption keyECOVACS Unspecified robots
- CVE-2024-52328ECOVACS lawnmowers and vacuums insecurely store audio warning filesECOVACS Unspecified robots
- CVE-2024-52325ECOVACS robot lawnmowers and vacuums command injectionECOVACS GOAT G1 · ECOVACS GOAT G1-800 +8
- CVE-2024-10846Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loopcompose-spec compose-go · github.com/compose-spec/compose-g…
- CVE-2024-10539Reflected XSS in Uyumsoft's ERPUyumsoft Informatin Systems Uyumsoft ERP
- CVE-2024-13340MDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingrealmag777 MDTF – Meta Data and Taxonomies Filter
- CVE-2024-12118The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingstellarwp The Events Calendar
- CVE-2024-13389Cliptakes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingCliptakes
- CVE-2024-13422SEO Blogger to WordPress Migration using 301 Redirection <= 0.4.8 - Reflected Cross-Site Scriptingsuhas93 SEO Blogger to WordPress Migration using 301 Redire…
- CVE-2024-13236Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL InjectionTainacan
- CVE-2024-12504Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingvideowhisper Broadcast Live Video – Live Streaming : WebRTC…
- CVE-2024-12043Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingbdthemes Prime Slider – Addons for Elementor
- CVE-2025-0635Denial of Service condition in M-Files ServerM-Files Server
- CVE-2025-0619Unsafe stored password recoveryM-Files Server
- CVE-2025-0648M-Files Server crash via EOT database driver configurationM-Files Server
- CVE-2024-43708An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of iElastic Kibana
- CVE-2024-13511Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Resetthemehunk Variation Swatches for WooCommerce
- CVE-2024-53299Apache Wicket: An attacker can intentionally trigger a memory leakApache Software Foundation Apache Wicket · org.apache.wicke…
- CVE-2024-52972Kibana allocation of resources without limits or throttling leads to crashElastic Kibana
- CVE-2024-43710Kibana server-side request forgeryElastic Kibana
- CVE-2024-42187HCL BigFix Patch Download Plug-ins are affected by path traversal vulnerabilityHCL Software BigFix Patch Management Download Plug-ins
- CVE-2024-42186HCL BigFix Patch Download Plug-ins are affected by an insecure protocol supportHCL Software BigFix Patch Management Download Plug-ins
- CVE-2023-50309IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator Standard Edition
- CVE-2023-32340IBM Sterling B2B Integrator cross-site scriptingIBM Sterling B2B Integrator Standard Edition
- CVE-2024-42185HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacksHCL Software BigFix Patch Management Download Plug-ins
- CVE-2024-42184HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI schemeHCL Software BigFix Patch Management Download Plug-ins
- CVE-2024-42183HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerabilityHCL Software BigFix Patch Management Download Plug-ins
- CVE-2024-42182HCL BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerabilityHCL Software BigFix Patch Management Download Plug-ins
- CVE-2023-46400KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.
- CVE-2024-50665gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box.
- CVE-2024-55193OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h.
- CVE-2024-57326A Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0.
- CVE-2024-57329HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function.
- CVE-2024-57386Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
- CVE-2024-57556Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deepstore2
- CVE-2024-57719lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.lunasvg
- CVE-2024-57720lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.lunasvg
- CVE-2024-57721lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.lunasvg
- CVE-2024-57723lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.lunasvg
- CVE-2024-57724lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.lunasvg
- CVE-2025-24529An issue was discovered in phpMyAdmin 5.x before 5.2.2.phpMyAdmin
- CVE-2025-24530An issue was discovered in phpMyAdmin 5.x before 5.2.2.phpMyAdmin · phpmyadmin/phpmyadmin