# CVEs published 2025-01-28

101 CVEs were published on January 28, 2025: 8 critical, 41 high. Days are UTC.

- [CVE-2025-0791](https://cve.now/CVE-2025-0791.md): ESAFENET CDG sdDoneDetail.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0790](https://cve.now/CVE-2025-0790.md): ESAFENET CDG doneDetail.jsp cross site scripting (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0789](https://cve.now/CVE-2025-0789.md): ESAFENET CDG doneDetail.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0788](https://cve.now/CVE-2025-0788.md): ESAFENET CDG content\_top.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0787](https://cve.now/CVE-2025-0787.md): ESAFENET CDG appDetail.jsp cross site scripting (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0786](https://cve.now/CVE-2025-0786.md): ESAFENET CDG appDetail.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-29869](https://cve.now/CVE-2024-29869.md): Apache Hive: Credentials file created with non restrictive permissions (CVSS 5.5, Apache Software Foundation Apache Hive · org.apache.hive:hi…)
- [CVE-2025-0785](https://cve.now/CVE-2025-0785.md): ESAFENET CDG SysConfig.jsp cross site scripting (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-24482](https://cve.now/CVE-2025-24482.md): FactoryTalk® View Site Edition - Local Code Injection (CVSS 7.0, Rockwell Automation FactoryTalk® View Site Edition)
- [CVE-2025-24481](https://cve.now/CVE-2025-24481.md): FactoryTalk® View Site Edition - Incorrect Permission Assignment (CVSS 7.0, Rockwell Automation FactoryTalk® View Site Edition)
- [CVE-2025-24826](https://cve.now/CVE-2025-24826.md): Local privilege escalation due to insecure folder permissions. (CVSS 6.7, Acronis Snap Deploy)
- [CVE-2025-0784](https://cve.now/CVE-2025-0784.md): Intelbras InControl Registered User usuario cleartext transmission (CVSS 6.3, Intelbras InControl)
- [CVE-2024-40677](https://cve.now/CVE-2024-40677.md): In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing pe (CVSS 8.4, Google Android)
- [CVE-2024-40676](https://cve.now/CVE-2024-40676.md): In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a (CVSS 7.7, Google Android)
- [CVE-2024-40675](https://cve.now/CVE-2024-40675.md): In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. (CVSS 7.5, Google Android)
- [CVE-2024-40674](https://cve.now/CVE-2024-40674.md): In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the c (CVSS 5.3, Google Android)
- [CVE-2024-40673](https://cve.now/CVE-2024-40673.md): In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to imp (CVSS 6.5, Google Android)
- [CVE-2024-40672](https://cve.now/CVE-2024-40672.md): In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. (CVSS 8.4, Google Android)
- [CVE-2024-40670](https://cve.now/CVE-2024-40670.md): In TBD of TBD, there is a possible use after free due to a race condition. (CVSS 8.4, Google Android)
- [CVE-2024-40669](https://cve.now/CVE-2024-40669.md): In TBD of TBD, there is a possible use after free due to a race condition. (CVSS 8.4, Google Android)
- [CVE-2024-40651](https://cve.now/CVE-2024-40651.md): In TBD of TBD, there is a possible use-after-free due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2024-40649](https://cve.now/CVE-2024-40649.md): In TBD of TBD, there is a possible use-after-free due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2024-34748](https://cve.now/CVE-2024-34748.md): In \_DevmemXReservationPageAddress of devicemem\_server.c, there is a possible use-after-free due to improper casting. (CVSS 8.4, Google Android)
- [CVE-2024-34733](https://cve.now/CVE-2024-34733.md): In DevmemXIntMapPages of devicemem\_server.c, there is a possible arbitrary code execution due to an integer overflow. (CVSS 8.4, Google Android)
- [CVE-2024-34732](https://cve.now/CVE-2024-34732.md): In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. (CVSS 8.4, Google Android)
- [CVE-2025-24480](https://cve.now/CVE-2025-24480.md): FactoryTalk® View Machine Editon - Remote Code Execution (CVSS 9.3, Rockwell Automation FactoryTalk® View Machine Edition)
- [CVE-2025-24479](https://cve.now/CVE-2025-24479.md): FactoryTalk® View Machine Edition - Local Code Injection (CVSS 8.6, Rockwell Automation FactoryTalk View Machine Edition)
- [CVE-2025-24478](https://cve.now/CVE-2025-24478.md): 5380/5580 Denial-of-Service Vulnerability (CVSS 7.1, Rockwell Automation GuardLogix 5580 SIL · Rockwell Automati…)
- [CVE-2025-22217](https://cve.now/CVE-2025-22217.md): Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. (CVSS 8.6, VMware AVI Load Balancer)
- [CVE-2025-0783](https://cve.now/CVE-2025-0783.md): pankajindevops scale API Endpoint access control (CVSS 5.3, pankajindevops scale)
- [CVE-2025-0631](https://cve.now/CVE-2025-0631.md): PowerFlex® 755 Credential Exposure Vulnerability (CVSS 8.7, Rockwell Automation PowerFlex)
- [CVE-2024-13484](https://cve.now/CVE-2024-13484.md): Openshift-gitops-operator-container: namespace isolation break (CVSS 8.2, gitops-operator · Red Hat OpenShift GitOps +1)
- [CVE-2025-23053](https://cve.now/CVE-2025-23053.md): Authenticated privilege escalation via broken access control (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…)
- [CVE-2025-23054](https://cve.now/CVE-2025-23054.md): Authenticated Response Manipulation allows Unauthorized Actions in Management Interface (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…)
- [CVE-2025-23057](https://cve.now/CVE-2025-23057.md): Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface (CVSS 5.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…)
- [CVE-2025-23056](https://cve.now/CVE-2025-23056.md): Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface (CVSS 5.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…)
- [CVE-2025-23055](https://cve.now/CVE-2025-23055.md): Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface (CVSS 5.5, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Fabri…)
- [CVE-2018-9378](https://cve.now/CVE-2018-9378.md): In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. (CVSS 6.2, Google Android)
- [CVE-2018-9373](https://cve.now/CVE-2018-9373.md): In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2017-13318](https://cve.now/CVE-2017-13318.md): In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. (CVSS 5.7, Google Android)
- [CVE-2017-13317](https://cve.now/CVE-2017-13317.md): In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input validation. (CVSS 5.7, Google Android)
- [CVE-2024-8401](https://cve.now/CVE-2024-8401.md): CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated atta (CVSS 5.4, Schneider Electric EcoStruxure Power Monitoring Expert (… +1)
- [CVE-2025-0781](https://cve.now/CVE-2025-0781.md): Incorrect Authorization in SimGear (CVSS 8.6, FlightGear SimGear)
- [CVE-2025-23385](https://cve.now/CVE-2025-23385.md): In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 202 (CVSS 7.8, JetBrains ReSharper · JetBrains Rider +2)
- [CVE-2025-0432](https://cve.now/CVE-2025-0432.md): HMS Networks Ewon Flexy 202 Cleartext Transmission of Sensitive Information (CVSS 6.9, HMS Networks Ewon Flexy)
- [CVE-2025-24800](https://cve.now/CVE-2025-24800.md): Critical vulnerability in \`ismp-grandpa\` \<v15.0.1 (CVSS 9.3, polytope-labs hyperbridge · ismp-grandpa +2)
- [CVE-2025-23213](https://cve.now/CVE-2025-23213.md): Tandoor Recipes - Stored XSS through Unrestricted File Upload (CVSS 8.7, TandoorRecipes recipes)
- [CVE-2025-23212](https://cve.now/CVE-2025-23212.md): Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server (CVSS 7.7, TandoorRecipes recipes)
- [CVE-2025-23211](https://cve.now/CVE-2025-23211.md): Tandoor Recipes - SSTI - Remote Code Execution (CVSS 10.0, TandoorRecipes recipes)
- [CVE-2025-23045](https://cve.now/CVE-2025-23045.md): CVAT allows remote code execution via tracker Nuclio functions (CVSS 8.7, cvat-ai cvat)
- [CVE-2025-0659](https://cve.now/CVE-2025-0659.md): Path Traversal and Rockwell Automation Third-party Vulnerability in DataMosaix™ Private Cloud (CVSS 7.0, Rockwell Automation DataEdgePlatform DataMosaix™ Private Cl…)
- [CVE-2024-7881](https://cve.now/CVE-2024-7881.md): An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those (CVSS 5.1, Arm Neoverse · Arm Cortex-X3 +5)
- [CVE-2024-6351](https://cve.now/CVE-2024-6351.md): Malformed packet leads to denial of service in NWK/APS layer (CVSS 4.3, silabs.com SiSDK)
- [CVE-2024-11956](https://cve.now/CVE-2024-11956.md): Pimcore customer-data-framework list sql injection (CVSS 5.1, Pimcore customer-data-framework · pimcore/customer-manageme…)
- [CVE-2024-11954](https://cve.now/CVE-2024-11954.md): Pimcore Search Document cross site scripting (CVSS 5.1, Pimcore · pimcore/pimcore)
- [CVE-2025-0065](https://cve.now/CVE-2025-0065.md): Improper Neutralization of Argument Delimiters in TeamViewer Clients (CVSS 7.8, TeamViewer Remote Full Client · TeamViewer Remote Host)
- [CVE-2025-0754](https://cve.now/CVE-2025-0754.md): Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing (CVSS 4.3, envoyproxy · Red Hat OpenShift Service Mesh)
- [CVE-2025-0752](https://cve.now/CVE-2025-0752.md): Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access (CVSS 7.1, envoyproxy · Red Hat OpenShift Service Mesh)
- [CVE-2025-0750](https://cve.now/CVE-2025-0750.md): Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting (CVSS 6.6, cri-o · Red Hat OpenShift Container Platform +1)
- [CVE-2025-0736](https://cve.now/CVE-2025-0736.md): Org.infinispan-infinispan-parent: exposure of sensitive information in application logs (CVSS 5.5, org.infinispan-infinispan-parent · Red Hat Data Grid +1)
- [CVE-2024-23953](https://cve.now/CVE-2024-23953.md): Apache Hive: Timing Attack Against Signature in LLAP util (CVSS 6.5, Apache Software Foundation Apache Hive · org.apache.hive:hi…)
- [CVE-2025-0290](https://cve.now/CVE-2025-0290.md): Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-13527](https://cve.now/CVE-2024-13527.md): Philantro – Donations and Donor Management \<= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode (CVSS 6.4, Philantro – Donations and Donor Management)
- [CVE-2024-13521](https://cve.now/CVE-2024-13521.md): MailUp Auto Subscription \<= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, ghera74 MailUp Auto Subscription)
- [CVE-2025-0321](https://cve.now/CVE-2025-0321.md): ElementsKit Pro \<= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter (CVSS 6.4, wpmet ElementsKit Pro)
- [CVE-2024-13509](https://cve.now/CVE-2024-13509.md): WS Form LITE and PRO \<= 1.10.13 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, westguard WS Form LITE – Drag & Drop Contact Form Builder ·…)
- [CVE-2024-13448](https://cve.now/CVE-2024-13448.md): ThemeREX Addons \<= 2.32.3 - Unauthenticated Arbitrary File Upload in trx\_addons\_uploads\_save\_data (CVSS 9.8, ThemeREX Addons)
- [CVE-2024-12807](https://cve.now/CVE-2024-12807.md): Social Share Buttons for WordPress \<= 2.7 - Admin+ Stored XSS (CVSS 4.8, Social Share Buttons for WordPress)
- [CVE-2024-12723](https://cve.now/CVE-2024-12723.md): Infility Global \<= 2.9.8 - Reflected XSS (CVSS 6.1, Infility Global)
- [CVE-2025-24810](https://cve.now/CVE-2025-24810.md): Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. (CVSS 4.8, Rahe Simple Image Sizes)
- [CVE-2025-23084](https://cve.now/CVE-2025-23084.md): A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. (CVSS 5.6, NodeJS Node)
- [CVE-2024-11135](https://cve.now/CVE-2024-11135.md): Eventer \<= 3.9.8 - Unauthenticated SQL Injection via eventer\_get\_attendees (CVSS 7.5, imithemes Eventer - WordPress Event & Booking Manager Plugin)
- [CVE-2024-53881](https://cve.now/CVE-2024-53881.md): NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which (CVSS 5.5, NVIDIA vGPU software)
- [CVE-2024-0146](https://cve.now/CVE-2024-0146.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. (CVSS 7.8, NVIDIA vGPU software)
- [CVE-2024-53869](https://cve.now/CVE-2024-53869.md): NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. (CVSS 5.5, NVIDIA GPU Display Driver, vGPU software)
- [CVE-2024-0149](https://cve.now/CVE-2024-0149.md): NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. (CVSS 3.3, NVIDIA GPU Display Driver, vGPU software)
- [CVE-2024-0147](https://cve.now/CVE-2024-0147.md): NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial (CVSS 5.5, NVIDIA GPU Display Driver, vGPU software)
- [CVE-2024-0150](https://cve.now/CVE-2024-0150.md): NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buf (CVSS 7.1, NVIDIA GPU Display Driver, vGPU software)
- [CVE-2024-0140](https://cve.now/CVE-2024-0140.md): NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. (CVSS 6.8, NVIDIA RAPIDS cuDF and cuML)
- [CVE-2024-0137](https://cve.now/CVE-2024-0137.md): NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code (CVSS 5.5, NVIDIA Container Toolkit · NVIDIA GPU Operator)
- [CVE-2024-0136](https://cve.now/CVE-2024-0136.md): NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code (CVSS 7.6, NVIDIA Container Toolkit · NVIDIA GPU Operator)
- [CVE-2024-0135](https://cve.now/CVE-2024-0135.md): NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification o (CVSS 7.6, NVIDIA Container Toolkit · NVIDIA GPU Operator)
- [CVE-2024-22315](https://cve.now/CVE-2024-22315.md): IBM Fusion improper communication restriction (CVSS 4.0, IBM Fusion)
- [CVE-2025-22865](https://cve.now/CVE-2025-22865.md): ParsePKCS1PrivateKey panic with partial keys in crypto/x509 (CVSS 7.5, Go standard library crypto/x509 · stdlib)
- [CVE-2024-45336](https://cve.now/CVE-2024-45336.md): Sensitive headers incorrectly sent after cross-domain redirect in net/http (CVSS 6.1, Go standard library net/http · stdlib)
- [CVE-2024-45340](https://cve.now/CVE-2024-45340.md): GOAUTH credential leak in cmd/go (CVSS 8.8, Go toolchain cmd/go · toolchain)
- [CVE-2024-45341](https://cve.now/CVE-2024-45341.md): Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 (CVSS 6.1, Go standard library crypto/x509 · stdlib)
- [CVE-2024-45339](https://cve.now/CVE-2024-45339.md): Vulnerability when creating log files in github.com/golang/glog (CVSS 7.1, github.com/golang/glog)
- [CVE-2024-12649](https://cve.now/CVE-2024-12649.md): Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(\*) which may allow an attacker on the (CVSS 9.8, Canon Satera MF656Cdw · Canon Satera MF654Cdw +11)
- [CVE-2024-12648](https://cve.now/CVE-2024-12648.md): Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(\*) which may allow an attacker on (CVSS 9.8, Canon Satera MF656Cdw · Canon Satera MF654Cdw +11)
- [CVE-2024-12647](https://cve.now/CVE-2024-12647.md): Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(\*) which may allow an attacker on (CVSS 9.8, Canon Satera MF656Cdw · Canon Satera MF654Cdw +11)
- [CVE-2023-50316](https://cve.now/CVE-2023-50316.md): IBM Sterling B2B Integrator information disclosure (CVSS 6.3, IBM Sterling B2B Integrator)
- [CVE-2022-3365](https://cve.now/CVE-2022-3365.md): Emote Interactive Remote Mouse Server command injection due to weak encoding (CVSS 9.8, Emote Interactive Remote Mouse Server)
- [CVE-2024-27263](https://cve.now/CVE-2024-27263.md): IBM Sterling B2B Integrator information disclosure (CVSS 5.3, IBM Sterling B2B Integrator)
- [CVE-2024-48310](https://cve.now/CVE-2024-48310.md): AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. (CVSS 7.5)
- [CVE-2024-55968](https://cve.now/CVE-2024-55968.md): An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. (CVSS 8.8)
- [CVE-2024-56529](https://cve.now/CVE-2024-56529.md): Mailcow through 2024-11b has a session fixation vulnerability in the web panel. (CVSS 7.1)
- [CVE-2024-57376](https://cve.now/CVE-2024-57376.md): Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthentica (CVSS 8.8)
- [CVE-2024-57514](https://cve.now/CVE-2024-57514.md): The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web (CVSS 4.8)
- [CVE-2024-57519](https://cve.now/CVE-2024-57519.md): An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs\_dbi\_auth\_info function in lib/dbi/subscription (CVSS 7.5)
- [CVE-2025-22917](https://cve.now/CVE-2025-22917.md): A reflected cross-site scripting (XSS) vulnerability in Audemium ERP \<=0.9.0 allows remote attackers to execute an arbitrary JavaScript payl (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.