CVEs published January 29, 2025
71 CVEs were published on January 29, 2025: 8 critical, 20 high.
- Published
- 71
- Critical
- 8
- High
- 20
- Medium
- 40
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- ESAFENET CDG
- 4
- IBM Aspera Faspex
- 4
- com.ruoyi:ruoyi
- 3
- needyamin Library Card System
- 3
- snowflakedb snowflake-connector-python · snowflake-connecto…
- 3
- ABB FLXEON
- 2
- IBM Security Verify Governance
- 2
- ISC BIND
- 2
- MicroWorld eScan Antivirus
- 2
- mySCADA myPRO Manager · mySCADA myPRO Runtime
- 2
Critical 8
- CVE-2025-21415Azure AI Face Service Elevation of Privilege VulnerabilityMicrosoft Azure AI Face Service
- CVE-2025-0851Path traversal issue in Deep Java LibraryAWS DeepJavaLibrary · ai.djl:api
- CVE-2025-20061mySCADA myPRO Manager OS Command InjectionmySCADA myPRO Manager · mySCADA myPRO Runtime
- CVE-2025-20014mySCADA myPRO Manager OS Command InjectionmySCADA myPRO Manager · mySCADA myPRO Runtime
- CVE-2025-0798MicroWorld eScan Antivirus Quarantine rtscanner os command injectionMicroWorld eScan Antivirus
- CVE-2024-54852When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injectio
- CVE-2024-57395Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrar
- CVE-2024-57665JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java.
High 20
- CVE-2025-21396Microsoft Account Elevation of Privilege VulnerabilityMicrosoft Account
- CVE-2024-12705DNS-over-HTTPS implementation suffers from multiple issues under heavy query loadISC BIND
- CVE-2024-11187Many records in the additional section cause CPU exhaustionISC BIND
- CVE-2025-24793Snowflake Connector for Python has an SQL Injection in write_pandassnowflakedb snowflake-connector-python · snowflake-connecto…
- CVE-2024-10001Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message HandlingGitHub Enterprise Server
- CVE-2024-48849Authentication and Authorization IssuesABB FLXEON
- CVE-2025-24789Snowflake JDBC allows an untrusted search path on Windowssnowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc
- CVE-2024-41140Improper AuthorizationManageEngine Applications Manager
- CVE-2025-0762Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2021-3978Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpkiCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2024-7695Out-of-bounds Write VulnerabilityMoxa PT-7728 Series · Moxa PT-7828 Series +49
- CVE-2024-13696Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameterwpdesk Flexible Wishlist for WooCommerce – Ecommerce Wishli…
- CVE-2024-12749Competition Form <= 2.0 - Reflected XSSCompetition Form
- CVE-2024-23733The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote
- CVE-2024-48761Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "er
- CVE-2024-54851Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.
- CVE-2024-57436RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring.com.ruoyi:ruoyi
- CVE-2024-57509Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code
- CVE-2024-57510Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code
- CVE-2025-24527An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17.Akamai Enterprise Application Access
Medium, low and unrated 43
- CVE-2025-0844needyamin Library Card System Registration Page signup.php cross site scriptingneedyamin Library Card System
- CVE-2025-0843needyamin Library Card System Admin Panel admindashboard.php sql injectionneedyamin Library Card System
- CVE-2025-0842needyamin Library Card System Login admin.php sql injectionneedyamin Library Card System
- CVE-2025-0841Aridius XYZ News loadMore deserializationAridius XYZ
- CVE-2025-24795The Snowflake Connector for Python uses insecure cache files permissionssnowflakedb snowflake-connector-python · snowflake-connecto…
- CVE-2025-24794The Snowflake Connector for Python uses insecure deserialization of the OCSP response cachesnowflakedb snowflake-connector-python · snowflake-connecto…
- CVE-2025-24788Snowflake Connector for .NET has weak temporary files permissionssnowflakedb snowflake-connector-net · Snowflake.Data
- CVE-2025-24884kube-audit-rest's example logging configuration could disclose secret values in the audit logRichardoC kube-audit-rest · github.com/RichardoC/kube-audit…
- CVE-2025-0840GNU Binutils objdump.c disassemble_bytes stack-based overflowGNU Binutils
- CVE-2024-48852Information disclosuresABB FLXEON
- CVE-2025-24790Snowflake JDBC uses insecure temporary credential cache file permissionssnowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc
- CVE-2025-24882regclient may ignore pinned manifest digestsregclient · github.com/regclient/regclient
- CVE-2025-24791snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissionssnowflakedb snowflake-connector-nodejs · snowflake-sdk
- CVE-2023-35907IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-37413IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-37398IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-37412IBM Aspera Faspex improper access controlIBM Aspera Faspex
- CVE-2025-24792Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Errorsnowflakedb pdo_snowflake
- CVE-2025-24374Twig fixes a security issue where escaping was missing when using null coalesce operator (??)twigphp Twig · twig/twig
- CVE-2024-54462Unsanitized Filenames in Flutter package image_picker_android Allow File OverwritesFlutter image_picker_android
- CVE-2024-54461Unsanitized Filenames in Flutter package file_selector_android Allow File OverwritesFlutter file_selector_android
- CVE-2025-0353Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsbadhonrocks Divi Torque Lite – Divi Theme, Divi Builder & E…
- CVE-2024-13561Target Video Easy Publish <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt Shortcodenebojsadabic Target Video Easy Publish
- CVE-2025-0617An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console.Trellix HX Console
- CVE-2025-0804ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingClickWhale – Link Manager, Link Shortener and Click Tracker…
- CVE-2025-0806code-projects Job Recruitment _call_job_search_ajax.php cross site scriptingcode-projects Job Recruitment
- CVE-2025-0803Codezips Gym Management System submit_plan_new.php sql injectionCodezips Gym Management System
- CVE-2025-0802SourceCodester Best Employee Management System Administrative Endpoint View_user.php access controlSourceCodester Best Employee Management System
- CVE-2025-23362The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data.Rodrigue EXIF Viewer Classic
- CVE-2025-0800SourceCodester Online Courseware Edit Teacher saveeditt.php cross site scriptingSourceCodester Online Courseware
- CVE-2023-33838IBM Security Verify Governance information disclosureIBM Security Verify Governance
- CVE-2025-0797MicroWorld eScan Antivirus Quarantine Microworld default permissionMicroWorld eScan Antivirus
- CVE-2025-0795ESAFENET CDG todolistjump.jsp cross site scriptingESAFENET CDG
- CVE-2025-0794ESAFENET CDG todoDetail.jsp cross site scriptingESAFENET CDG
- CVE-2025-0793ESAFENET CDG todoDetail.jsp sql injectionESAFENET CDG
- CVE-2025-0792ESAFENET CDG sdTodoDetail.jsp sql injectionESAFENET CDG
- CVE-2023-35017IBM Security Verify Governance informationIBM Security Verify Governance
- CVE-2024-51182HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the "erro" p
- CVE-2024-57437RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list.
- CVE-2024-57438Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.com.ruoyi:ruoyi
- CVE-2024-57439An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by dupliccom.ruoyi:ruoyi
- CVE-2024-57513A floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function in Bento4.
- CVE-2024-57965In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted saxios