CVEs published January 28, 2025
101 CVEs were published on January 28, 2025: 8 critical, 41 high.
- Published
- 101
- Critical
- 8
- High
- 41
- Medium
- 51
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Google Android
- 17
- ESAFENET CDG
- 7
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- 5
- NVIDIA GPU Display Driver, vGPU software
- 4
- Canon Satera MF656Cdw · Canon Satera MF654Cdw +11
- 3
- NVIDIA Container Toolkit · NVIDIA GPU Operator
- 3
- TandoorRecipes recipes
- 3
- Apache Software Foundation Apache Hive · org.apache.hive:hi…
- 2
- envoyproxy · Red Hat OpenShift Service Mesh
- 2
- Go standard library crypto/x509 · stdlib
- 2
Critical 8
- CVE-2025-24480FactoryTalk® View Machine Editon - Remote Code ExecutionRockwell Automation FactoryTalk® View Machine Edition
- CVE-2025-24800Critical vulnerability in `ismp-grandpa` <v15.0.1polytope-labs hyperbridge · ismp-grandpa +2
- CVE-2025-23211Tandoor Recipes - SSTI - Remote Code ExecutionTandoorRecipes recipes
- CVE-2024-13448ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_dataThemeREX Addons
- CVE-2024-12649Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the Canon Satera MF656Cdw · Canon Satera MF654Cdw +11
- CVE-2024-12648Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker onCanon Satera MF656Cdw · Canon Satera MF654Cdw +11
- CVE-2024-12647Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker onCanon Satera MF656Cdw · Canon Satera MF654Cdw +11
- CVE-2022-3365Emote Interactive Remote Mouse Server command injection due to weak encodingEmote Interactive Remote Mouse Server
High 41
- CVE-2025-24482FactoryTalk® View Site Edition - Local Code InjectionRockwell Automation FactoryTalk® View Site Edition
- CVE-2025-24481FactoryTalk® View Site Edition - Incorrect Permission AssignmentRockwell Automation FactoryTalk® View Site Edition
- CVE-2024-40677In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing peGoogle Android
- CVE-2024-40676In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to aGoogle Android
- CVE-2024-40675In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation.Google Android
- CVE-2024-40672In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check.Google Android
- CVE-2024-40670In TBD of TBD, there is a possible use after free due to a race condition.Google Android
- CVE-2024-40669In TBD of TBD, there is a possible use after free due to a race condition.Google Android
- CVE-2024-40651In TBD of TBD, there is a possible use-after-free due to a logic error in the code.Google Android
- CVE-2024-40649In TBD of TBD, there is a possible use-after-free due to a logic error in the code.Google Android
- CVE-2024-34748In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting.Google Android
- CVE-2024-34733In DevmemXIntMapPages of devicemem_server.c, there is a possible arbitrary code execution due to an integer overflow.Google Android
- CVE-2024-34732In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition.Google Android
- CVE-2025-24479FactoryTalk® View Machine Edition - Local Code InjectionRockwell Automation FactoryTalk View Machine Edition
- CVE-2025-244785380/5580 Denial-of-Service VulnerabilityRockwell Automation GuardLogix 5580 SIL · Rockwell Automati…
- CVE-2025-22217Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware.VMware AVI Load Balancer
- CVE-2025-0631PowerFlex® 755 Credential Exposure VulnerabilityRockwell Automation PowerFlex
- CVE-2024-13484Openshift-gitops-operator-container: namespace isolation breakgitops-operator · Red Hat OpenShift GitOps +1
- CVE-2018-9373In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2025-0781Incorrect Authorization in SimGearFlightGear SimGear
- CVE-2025-23385In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 202JetBrains ReSharper · JetBrains Rider +2
- CVE-2025-23213Tandoor Recipes - Stored XSS through Unrestricted File UploadTandoorRecipes recipes
- CVE-2025-23212Tandoor Recipes - Local file disclosure - Users can read the content of any file on the serverTandoorRecipes recipes
- CVE-2025-23045CVAT allows remote code execution via tracker Nuclio functionscvat-ai cvat
- CVE-2025-0659Path Traversal and Rockwell Automation Third-party Vulnerability in DataMosaix™ Private CloudRockwell Automation DataEdgePlatform DataMosaix™ Private Cl…
- CVE-2025-0065Improper Neutralization of Argument Delimiters in TeamViewer ClientsTeamViewer Remote Full Client · TeamViewer Remote Host
- CVE-2025-0752Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized accessenvoyproxy · Red Hat OpenShift Service Mesh
- CVE-2024-13509WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scriptingwestguard WS Form LITE – Drag & Drop Contact Form Builder ·…
- CVE-2024-11135Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendeesimithemes Eventer - WordPress Event & Booking Manager Plugin
- CVE-2024-0146NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption.NVIDIA vGPU software
- CVE-2024-0150NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a bufNVIDIA GPU Display Driver, vGPU software
- CVE-2024-0136NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted codeNVIDIA Container Toolkit · NVIDIA GPU Operator
- CVE-2024-0135NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification oNVIDIA Container Toolkit · NVIDIA GPU Operator
- CVE-2025-22865ParsePKCS1PrivateKey panic with partial keys in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2024-45340GOAUTH credential leak in cmd/goGo toolchain cmd/go · toolchain
- CVE-2024-45339Vulnerability when creating log files in github.com/golang/gloggithub.com/golang/glog
- CVE-2024-48310AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code.
- CVE-2024-55968An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1.
- CVE-2024-56529Mailcow through 2024-11b has a session fixation vulnerability in the web panel.
- CVE-2024-57376Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthentica
- CVE-2024-57519An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription
Medium, low and unrated 52
- CVE-2025-0791ESAFENET CDG sdDoneDetail.jsp sql injectionESAFENET CDG
- CVE-2025-0790ESAFENET CDG doneDetail.jsp cross site scriptingESAFENET CDG
- CVE-2025-0789ESAFENET CDG doneDetail.jsp sql injectionESAFENET CDG
- CVE-2025-0788ESAFENET CDG content_top.jsp sql injectionESAFENET CDG
- CVE-2025-0787ESAFENET CDG appDetail.jsp cross site scriptingESAFENET CDG
- CVE-2025-0786ESAFENET CDG appDetail.jsp sql injectionESAFENET CDG
- CVE-2024-29869Apache Hive: Credentials file created with non restrictive permissionsApache Software Foundation Apache Hive · org.apache.hive:hi…
- CVE-2025-0785ESAFENET CDG SysConfig.jsp cross site scriptingESAFENET CDG
- CVE-2025-24826Local privilege escalation due to insecure folder permissions.Acronis Snap Deploy
- CVE-2025-0784Intelbras InControl Registered User usuario cleartext transmissionIntelbras InControl
- CVE-2024-40674In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the cGoogle Android
- CVE-2024-40673In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to impGoogle Android
- CVE-2025-0783pankajindevops scale API Endpoint access controlpankajindevops scale
- CVE-2025-23053Authenticated privilege escalation via broken access controlHewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- CVE-2025-23054Authenticated Response Manipulation allows Unauthorized Actions in Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- CVE-2025-23057Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- CVE-2025-23056Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- CVE-2025-23055Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…
- CVE-2018-9378In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data.Google Android
- CVE-2017-13318In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow.Google Android
- CVE-2017-13317In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input validation.Google Android
- CVE-2024-8401CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attaSchneider Electric EcoStruxure Power Monitoring Expert (… +1
- CVE-2025-0432HMS Networks Ewon Flexy 202 Cleartext Transmission of Sensitive InformationHMS Networks Ewon Flexy
- CVE-2024-7881An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume thoseArm Neoverse · Arm Cortex-X3 +5
- CVE-2024-6351Malformed packet leads to denial of service in NWK/APS layersilabs.com SiSDK
- CVE-2024-11956Pimcore customer-data-framework list sql injectionPimcore customer-data-framework · pimcore/customer-manageme…
- CVE-2024-11954Pimcore Search Document cross site scriptingPimcore · pimcore/pimcore
- CVE-2025-0754Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofingenvoyproxy · Red Hat OpenShift Service Mesh
- CVE-2025-0750Cri-o: cri-o path traversal in log handling functions allows arbitrary unmountingcri-o · Red Hat OpenShift Container Platform +1
- CVE-2025-0736Org.infinispan-infinispan-parent: exposure of sensitive information in application logsorg.infinispan-infinispan-parent · Red Hat Data Grid +1
- CVE-2024-23953Apache Hive: Timing Attack Against Signature in LLAP utilApache Software Foundation Apache Hive · org.apache.hive:hi…
- CVE-2025-0290Loop with Unreachable Exit Condition ('Infinite Loop') in GitLabGitLab
- CVE-2024-13527Philantro – Donations and Donor Management <= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate ShortcodePhilantro – Donations and Donor Management
- CVE-2024-13521MailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingghera74 MailUp Auto Subscription
- CVE-2025-0321ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameterwpmet ElementsKit Pro
- CVE-2024-12807Social Share Buttons for WordPress <= 2.7 - Admin+ Stored XSSSocial Share Buttons for WordPress
- CVE-2024-12723Infility Global <= 2.9.8 - Reflected XSSInfility Global
- CVE-2025-24810Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier.Rahe Simple Image Sizes
- CVE-2025-23084A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment.NodeJS Node
- CVE-2024-53881NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which NVIDIA vGPU software
- CVE-2024-53869NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory.NVIDIA GPU Display Driver, vGPU software
- CVE-2024-0149NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files.NVIDIA GPU Display Driver, vGPU software
- CVE-2024-0147NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denialNVIDIA GPU Display Driver, vGPU software
- CVE-2024-0140NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue.NVIDIA RAPIDS cuDF and cuML
- CVE-2024-0137NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted codeNVIDIA Container Toolkit · NVIDIA GPU Operator
- CVE-2024-22315IBM Fusion improper communication restrictionIBM Fusion
- CVE-2024-45336Sensitive headers incorrectly sent after cross-domain redirect in net/httpGo standard library net/http · stdlib
- CVE-2024-45341Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2023-50316IBM Sterling B2B Integrator information disclosureIBM Sterling B2B Integrator
- CVE-2024-27263IBM Sterling B2B Integrator information disclosureIBM Sterling B2B Integrator
- CVE-2024-57514The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web
- CVE-2025-22917A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payl