# CVEs published 2025-01-29

71 CVEs were published on January 29, 2025: 8 critical, 20 high. Days are UTC.

- [CVE-2025-0844](https://cve.now/CVE-2025-0844.md): needyamin Library Card System Registration Page signup.php cross site scripting (CVSS 6.9, needyamin Library Card System)
- [CVE-2025-21396](https://cve.now/CVE-2025-21396.md): Microsoft Account Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Account)
- [CVE-2025-0843](https://cve.now/CVE-2025-0843.md): needyamin Library Card System Admin Panel admindashboard.php sql injection (CVSS 6.9, needyamin Library Card System)
- [CVE-2025-21415](https://cve.now/CVE-2025-21415.md): Azure AI Face Service Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure AI Face Service)
- [CVE-2024-12705](https://cve.now/CVE-2024-12705.md): DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (CVSS 7.5, ISC BIND)
- [CVE-2024-11187](https://cve.now/CVE-2024-11187.md): Many records in the additional section cause CPU exhaustion (CVSS 7.5, ISC BIND)
- [CVE-2025-0842](https://cve.now/CVE-2025-0842.md): needyamin Library Card System Login admin.php sql injection (CVSS 6.9, needyamin Library Card System)
- [CVE-2025-0851](https://cve.now/CVE-2025-0851.md): Path traversal issue in Deep Java Library (CVSS 9.3, AWS DeepJavaLibrary · ai.djl:api)
- [CVE-2025-0841](https://cve.now/CVE-2025-0841.md): Aridius XYZ News loadMore deserialization (CVSS 6.9, Aridius XYZ)
- [CVE-2025-24795](https://cve.now/CVE-2025-24795.md): The Snowflake Connector for Python uses insecure cache files permissions (CVSS 4.4, snowflakedb snowflake-connector-python · snowflake-connecto…)
- [CVE-2025-24794](https://cve.now/CVE-2025-24794.md): The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache (CVSS 6.7, snowflakedb snowflake-connector-python · snowflake-connecto…)
- [CVE-2025-24793](https://cve.now/CVE-2025-24793.md): Snowflake Connector for Python has an SQL Injection in write\_pandas (CVSS 7.0, snowflakedb snowflake-connector-python · snowflake-connecto…)
- [CVE-2025-24788](https://cve.now/CVE-2025-24788.md): Snowflake Connector for .NET has weak temporary files permissions (CVSS 5.0, snowflakedb snowflake-connector-net · Snowflake.Data)
- [CVE-2025-24884](https://cve.now/CVE-2025-24884.md): kube-audit-rest's example logging configuration could disclose secret values in the audit log (CVSS 5.1, RichardoC kube-audit-rest · github.com/RichardoC/kube-audit…)
- [CVE-2025-0840](https://cve.now/CVE-2025-0840.md): GNU Binutils objdump.c disassemble\_bytes stack-based overflow (CVSS 6.3, GNU Binutils)
- [CVE-2025-20061](https://cve.now/CVE-2025-20061.md): mySCADA myPRO Manager OS Command Injection (CVSS 9.3, mySCADA myPRO Manager · mySCADA myPRO Runtime)
- [CVE-2025-20014](https://cve.now/CVE-2025-20014.md): mySCADA myPRO Manager OS Command Injection (CVSS 9.3, mySCADA myPRO Manager · mySCADA myPRO Runtime)
- [CVE-2024-48852](https://cve.now/CVE-2024-48852.md): Information disclosures (CVSS 6.9, ABB FLXEON)
- [CVE-2024-10001](https://cve.now/CVE-2024-10001.md): Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling (CVSS 7.1, GitHub Enterprise Server)
- [CVE-2024-48849](https://cve.now/CVE-2024-48849.md): Authentication and Authorization Issues (CVSS 8.8, ABB FLXEON)
- [CVE-2025-24790](https://cve.now/CVE-2025-24790.md): Snowflake JDBC uses insecure temporary credential cache file permissions (CVSS 4.4, snowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc)
- [CVE-2025-24789](https://cve.now/CVE-2025-24789.md): Snowflake JDBC allows an untrusted search path on Windows (CVSS 7.8, snowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc)
- [CVE-2025-24882](https://cve.now/CVE-2025-24882.md): regclient may ignore pinned manifest digests (CVSS 5.2, regclient · github.com/regclient/regclient)
- [CVE-2025-24791](https://cve.now/CVE-2025-24791.md): snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions (CVSS 4.4, snowflakedb snowflake-connector-nodejs · snowflake-sdk)
- [CVE-2023-35907](https://cve.now/CVE-2023-35907.md): IBM Aspera Faspex information disclosure (CVSS 5.9, IBM Aspera Faspex)
- [CVE-2023-37413](https://cve.now/CVE-2023-37413.md): IBM Aspera Faspex information disclosure (CVSS 5.3, IBM Aspera Faspex)
- [CVE-2023-37398](https://cve.now/CVE-2023-37398.md): IBM Aspera Faspex information disclosure (CVSS 5.9, IBM Aspera Faspex)
- [CVE-2023-37412](https://cve.now/CVE-2023-37412.md): IBM Aspera Faspex improper access control (CVSS 4.4, IBM Aspera Faspex)
- [CVE-2025-24792](https://cve.now/CVE-2025-24792.md): Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error (CVSS 4.4, snowflakedb pdo\_snowflake)
- [CVE-2025-24374](https://cve.now/CVE-2025-24374.md): Twig fixes a security issue where escaping was missing when using null coalesce operator (??) (CVSS 4.3, twigphp Twig · twig/twig)
- [CVE-2024-54462](https://cve.now/CVE-2024-54462.md): Unsanitized Filenames in Flutter package image\_picker\_android Allow File Overwrites (CVSS 2.1, Flutter image\_picker\_android)
- [CVE-2024-54461](https://cve.now/CVE-2024-54461.md): Unsanitized Filenames in Flutter package file\_selector\_android Allow File Overwrites (CVSS 2.1, Flutter file\_selector\_android)
- [CVE-2024-41140](https://cve.now/CVE-2024-41140.md): Improper Authorization (CVSS 8.1, ManageEngine Applications Manager)
- [CVE-2025-0353](https://cve.now/CVE-2025-0353.md): Divi Torque Lite \<= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, badhonrocks Divi Torque Lite – Divi Theme, Divi Builder & E…)
- [CVE-2024-13561](https://cve.now/CVE-2024-13561.md): Target Video Easy Publish \<= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid\_override\_yt Shortcode (CVSS 6.4, nebojsadabic Target Video Easy Publish)
- [CVE-2025-0762](https://cve.now/CVE-2025-0762.md): Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2025-0617](https://cve.now/CVE-2025-0617.md): An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. (CVSS 5.9, Trellix HX Console)
- [CVE-2021-3978](https://cve.now/CVE-2021-3978.md): Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki (CVSS 7.5, Cloudflare octorpki · github.com/cloudflare/cfrpki)
- [CVE-2024-7695](https://cve.now/CVE-2024-7695.md): Out-of-bounds Write Vulnerability (CVSS 7.5, Moxa PT-7728 Series · Moxa PT-7828 Series +49)
- [CVE-2024-13696](https://cve.now/CVE-2024-13696.md): Flexible Wishlist for WooCommerce \<= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist\_name Parameter (CVSS 7.2, wpdesk Flexible Wishlist for WooCommerce – Ecommerce Wishli…)
- [CVE-2024-12749](https://cve.now/CVE-2024-12749.md): Competition Form \<= 2.0 - Reflected XSS (CVSS 7.1, Competition Form)
- [CVE-2025-0804](https://cve.now/CVE-2025-0804.md): ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages \<= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ClickWhale – Link Manager, Link Shortener and Click Tracker…)
- [CVE-2025-0806](https://cve.now/CVE-2025-0806.md): code-projects Job Recruitment \_call\_job\_search\_ajax.php cross site scripting (CVSS 6.9, code-projects Job Recruitment)
- [CVE-2025-0803](https://cve.now/CVE-2025-0803.md): Codezips Gym Management System submit\_plan\_new.php sql injection (CVSS 6.9, Codezips Gym Management System)
- [CVE-2025-0802](https://cve.now/CVE-2025-0802.md): SourceCodester Best Employee Management System Administrative Endpoint View\_user.php access control (CVSS 6.9, SourceCodester Best Employee Management System)
- [CVE-2025-23362](https://cve.now/CVE-2025-23362.md): The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. (CVSS 6.1, Rodrigue EXIF Viewer Classic)
- [CVE-2025-0800](https://cve.now/CVE-2025-0800.md): SourceCodester Online Courseware Edit Teacher saveeditt.php cross site scripting (CVSS 5.1, SourceCodester Online Courseware)
- [CVE-2025-0798](https://cve.now/CVE-2025-0798.md): MicroWorld eScan Antivirus Quarantine rtscanner os command injection (CVSS 9.2, MicroWorld eScan Antivirus)
- [CVE-2023-33838](https://cve.now/CVE-2023-33838.md): IBM Security Verify Governance information disclosure (CVSS 4.4, IBM Security Verify Governance)
- [CVE-2025-0797](https://cve.now/CVE-2025-0797.md): MicroWorld eScan Antivirus Quarantine Microworld default permission (CVSS 4.8, MicroWorld eScan Antivirus)
- [CVE-2025-0795](https://cve.now/CVE-2025-0795.md): ESAFENET CDG todolistjump.jsp cross site scripting (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0794](https://cve.now/CVE-2025-0794.md): ESAFENET CDG todoDetail.jsp cross site scripting (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0793](https://cve.now/CVE-2025-0793.md): ESAFENET CDG todoDetail.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-0792](https://cve.now/CVE-2025-0792.md): ESAFENET CDG sdTodoDetail.jsp sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2023-35017](https://cve.now/CVE-2023-35017.md): IBM Security Verify Governance information (CVSS 5.9, IBM Security Verify Governance)
- [CVE-2024-23733](https://cve.now/CVE-2024-23733.md): The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core\_Fix7 allows remote (CVSS 7.5)
- [CVE-2024-48761](https://cve.now/CVE-2024-48761.md): Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "er (CVSS 8.8)
- [CVE-2024-51182](https://cve.now/CVE-2024-51182.md): HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the "erro" p (CVSS 6.1)
- [CVE-2024-54851](https://cve.now/CVE-2024-54851.md): Teedy \<= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection. (CVSS 8.8)
- [CVE-2024-54852](https://cve.now/CVE-2024-54852.md): When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injectio (CVSS 9.8)
- [CVE-2024-57395](https://cve.now/CVE-2024-57395.md): Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrar (CVSS 9.8)
- [CVE-2024-57436](https://cve.now/CVE-2024-57436.md): RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. (CVSS 7.2, com.ruoyi:ruoyi)
- [CVE-2024-57437](https://cve.now/CVE-2024-57437.md): RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list. (CVSS 6.5)
- [CVE-2024-57438](https://cve.now/CVE-2024-57438.md): Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles. (CVSS 5.4, com.ruoyi:ruoyi)
- [CVE-2024-57439](https://cve.now/CVE-2024-57439.md): An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplic (CVSS 4.9, com.ruoyi:ruoyi)
- [CVE-2024-57509](https://cve.now/CVE-2024-57509.md): Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code (CVSS 7.8)
- [CVE-2024-57510](https://cve.now/CVE-2024-57510.md): Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code (CVSS 7.8)
- [CVE-2024-57513](https://cve.now/CVE-2024-57513.md): A floating-point exception (FPE) vulnerability exists in the AP4\_TfraAtom::AP4\_TfraAtom function in Bento4. (CVSS 6.5)
- [CVE-2024-57665](https://cve.now/CVE-2024-57665.md): JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. (CVSS 9.8)
- [CVE-2024-57965](https://cve.now/CVE-2024-57965.md): In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted s (CVSS 0.0, axios)
- [CVE-2025-24527](https://cve.now/CVE-2025-24527.md): An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. (CVSS 8.0, Akamai Enterprise Application Access)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.