CVEs published February 4, 2025
148 CVEs were published on February 4, 2025: 18 critical, 35 high. 2 are now in CISA KEV.
- Published
- 148
- Critical
- 18
- High
- 35
- Medium
- 90
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 22
Most affected products
- Samsung Mobile Devices
- 17
- Mozilla Firefox · Mozilla Thunderbird
- 11
- discourse
- 9
- IBM Security Verify Access Appliance · IBM Security Verify…
- 6
- Adobe Experience Manager
- 5
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- 4
- Apache Software Foundation Apache Cassandra · org.apache.ca…
- 3
- Google Chrome
- 3
- SMCI MBD-X12DPG-OA6
- 3
- yogeshojha rengine
- 3
Critical 18
- CVE-2025-24964Remote Code Execution when accessing a malicious website while Vitest API server is listeningvitest-dev vitest · vitest
- CVE-2025-0960AutomationDirect C-more EA9 HMI Classic Buffer OverflowAutomationDirect C-more EA9 HMI EA9-T6CL · AutomationDir… +8
- CVE-2025-24971OS Command Injection endpoint '/upload/init' parameter 'filename' (RCE) in DumpDropDumbWareio DumbDrop
- CVE-2025-0364BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCEBigAntSoft BigAnt Server
- CVE-2024-9644Four-Faith F3x36 bapply.cgi Auth BypassFour-Faith F3x36
- CVE-2024-9643Four-Faith F3x36 Hidden Debug CredentialsFour-Faith F3x36
- CVE-2025-24677WordPress Post/Page Copying Tool to Export and Import post/page for Cross site Migration Plugin <= 2.0.3 - Remote Code Execution (RCE) vulnerabilitywpspin Post/Page Copying Tool
- CVE-2025-22699WordPress Traveler Code plugin < 3.1.2 - Unauthenticated Arbitrary SQL Execution vulnerabilityshinetheme Traveler Code
- CVE-2025-1020Memory safety bugs fixed in Firefox 135 and Thunderbird 135Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1017Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1016Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-1012Use-after-free during concurrent delazificationMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1011A bug in WebAssembly code generation could result in a crashMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1010Use-after-free in Custom HighlightMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1009Use-after-free in XSLTMozilla Firefox · Mozilla Thunderbird
- CVE-2025-0890**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware versionZyxel VMG4325-B10A firmware
- CVE-2025-22204Extension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for Joomlaregularlabs.com Sourcerer for Joomla
- CVE-2024-48445An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters.
High 35
- CVE-2025-0413Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation VulnerabilityParallels Desktop
- CVE-2024-11468Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process.Omnissa Horizon Client for MacOS
- CVE-2023-39943Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds WriteAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2023-40222Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Heap-based Buffer OverflowAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2024-11467Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw.Omnissa Horizon Client for MacOS
- CVE-2024-13723Checkmk NagVis Remote Code ExecutionCheckmk NagVis
- CVE-2024-55948Anonymous cache poisoning via XHR requests in Discoursediscourse
- CVE-2025-23023Anonymous cache poisoning via request headers in Discoursediscourse
- CVE-2025-0509Signing Checks Bypasssparkle-project Sparkle
- CVE-2025-24968Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgineyogeshojha rengine
- CVE-2025-24967Stored XSS on Admin Panel When Deleting a User in reNgineyogeshojha rengine
- CVE-2025-23058Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2024-23690EOL Netgear FVS336Gv2 and FVS336Gv3 Telnet Configuration Backup Command InjectionNetgear FVS336Gv3 · Netgear FVS336Gv2
- CVE-2025-22794WordPress World Cup Predictor Plugin <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerabilityianhaycox World Cup Predictor
- CVE-2025-24648WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2.1 - Privilege Escalation vulnerabilityBowo Admin and Site Enhancements
- CVE-2025-24602WordPress WP24 Domain Check plugin <= 1.10.14 - Reflected Cross Site Scripting (XSS) vulnerabilityWP24 Domain Check
- CVE-2025-24599WordPress Newsletters plugin <= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityTribulant Software Newsletters
- CVE-2025-24598WordPress WP Mailster plugin <= 1.8.17.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybrandtoss WP Mailster
- CVE-2025-23645WordPress Find Content IDs plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityOptimize Worldwide Find Content IDs
- CVE-2025-22700WordPress Traveler Code plugin < 3.1.3 - Subscriber+ Arbitrary SQL Execution vulnerabilityshinetheme Traveler Code
- CVE-2025-1014Certificate length was not properly checkedMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1018Fullscreen notification is not displayed when fullscreen is re-requestedMozilla Firefox · Mozilla Thunderbird
- CVE-2024-40891**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VZyxel VMG4325-B10A firmware
- CVE-2024-40890**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-BZyxel VMG4325-B10A firmware
- CVE-2025-23015Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actionsApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2024-10239fld->used_bytes without sanity check causes stack overflowSMCI MBD-X12DPG-OA6
- CVE-2024-10238fld->used_bytes without sanity check causes stack overflowSMCI MBD-X12DPG-OA6
- CVE-2024-10237SMC BMC Firmware Image Authentication Design IssueSMCI MBD-X12DPG-OA6
- CVE-2025-22205Extension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomlawww.admiror-design-studio.com Admiror Gallery component for…
- CVE-2025-20890Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary codSamsung Mobile Devices
- CVE-2025-20888Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to executeSamsung Mobile Devices
- CVE-2025-20882Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to eSamsung Mobile Devices
- CVE-2025-20881Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackSamsung Mobile Devices
- CVE-2024-13330Justrows Free <= 0.2 - Reflected XSSJustRows free
- CVE-2024-13329Solidres <= 0.9.4 - Reflected XSSSolidres
Medium, low and unrated 95
- CVE-2024-53962Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-53963Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-53966Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-53964Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-53965Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-13722Checkmk NagVis Reflected Cross-site ScriptingCheckmk NagVis
- CVE-2024-8125A remote code vulnerability has been discovered in OpenText™ Content Management.OpenText™ Content Management
- CVE-2024-53266Cross-site Scripting (XSS) via topic titles when CSP disabled in Discoursediscourse
- CVE-2024-53851Partial denial of service via inline oneboxes in Discoursediscourse
- CVE-2024-53994Potential bypass of chat permissions in Discoursediscourse
- CVE-2024-56197Users can see other user's tagged PMs in Discoursediscourse
- CVE-2024-56328HTMLi(XSS without CSP) via Onebox urls in Discoursediscourse
- CVE-2025-22601Client Side Path Traversal using activate account route in Discoursediscourse
- CVE-2025-22602Stored DOM-based XSS (without CSP) via video placeholders in Discoursediscourse
- CVE-2024-45657IBM Security Verify Access incorrect privilege assignmentIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-35138IBM Security Verify Access cross-site request forgeryIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-43187IBM Security Verify Access information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-45658IBM Security Verify Access information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-40700IBM Security Verify Access cross-site scriptingIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2025-0630Western Telematic Inc NPS Series, DSM Series, CPM Series External Control of File Name or PathWestern Telematic Network Power Switch · Western Telematic…
- CVE-2025-24963Browser mode serves arbitrary files in vitestvitest-dev vitest · @vitest/browser
- CVE-2025-24966HTML Injection in reNgineyogeshojha rengine
- CVE-2025-0451Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engGoogle Chrome
- CVE-2025-0445Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-0444Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2025-24373Unrestricted Access to PDF Documents via URL Manipulation in woocommerce-pdf-invoices-packing-slipswpovernight woocommerce-pdf-invoices-packing-slips
- CVE-2024-48019Apache Doris: allows admin users to read arbitrary files through the REST APIApache Software Foundation Apache Doris
- CVE-2025-25039Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2025-23060Sensitive Data Exposure Vulnerability in HPE Aruba Networking ClearPass Policy Manager (CPPM)Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2025-23059Sensitive Information Disclosure in HPE Aruba Networking ClearPass Policy ManagerHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2024-45659IBM Security Verify Access information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2025-22730WordPress Ksher plugin <= 1.1.2 - Broken Access Control vulnerabilityksher thailand Ksher
- CVE-2025-22675WordPress Alert Box Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins Alert Box Block – Display notice/alerts in the fro…
- CVE-2025-22674WordPress Product Blocks for WooCommerce plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityGet Bowtied Product Blocks for WooCommerce
- CVE-2025-22664WordPress Survey Maker Plugin <= 5.1.3.5 - Cross Site Scripting (XSS) vulnerabilityAys Pro Survey Maker
- CVE-2025-22662WordPress SendPulse Email Marketing Newsletter plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilitySendPulse Email Marketing Newsletter
- CVE-2025-22653WordPress Music Press Pro plugin <=1.4.6 - Stored Cross Site Scripting (XSS) vulnerabilitytuyennv Music Press Pro
- CVE-2025-22643WordPress OnePress theme <= 2.3.11 - Broken Access Control vulnerabilityfamethemes OnePress
- CVE-2025-22642WordPress Dynamic Conditions plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityrtowebsites Dynamic Conditions
- CVE-2025-22641WordPress FM Notification Bar plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityPrem Tiwari FM Notification Bar
- CVE-2025-22697WordPress Responsive Blocks plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerabilityCyberChimps Responsive Blocks
- CVE-2025-22696WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulnerabilityWPDeveloper Document Block – Upload & Embed Docs
- CVE-2025-22206Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomlajoomsky.com JS Jobs component for Joomla
- CVE-2025-0825CRLF injection in Cpp-httplibcpp-httplib
- CVE-2025-1015Unsanitized address book fieldsMozilla Thunderbird
- CVE-2025-0510Address of e-mail sender can be spoofed by malicious emailMozilla Thunderbird
- CVE-2025-1013Potential opening of private browsing tabs in normal browsing windowsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1019Fullscreen notification not properly displayedMozilla Firefox · Mozilla Thunderbird
- CVE-2024-11623Stored XSS in authentikgoauthentik authentik
- CVE-2024-13699Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingqodeinteractive Qi Addons For Elementor
- CVE-2024-27137Apache Cassandra: unrestricted deserialization of JMX authentication credentialsApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2025-24860Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regionsApache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2024-13529SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Downloadiqonicdesign SocialV - Social Network and Community BuddyPr…
- CVE-2024-13510ShopSite <= 1.5.10 - Cross-Site Request Forgery to Stored Cross-Site ScriptingShopSite
- CVE-2024-13733SKT Blocks – Gutenberg based Page Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingsonalsinha21 SKT Blocks – Gutenberg based Page Builder
- CVE-2024-13356DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletionmlfactory DSGVO All in one for WP
- CVE-2024-13403WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parametersmub WPForms – Easy Form Builder for WordPress – Contact Fo…
- CVE-2025-20907Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find.Samsung Mobile Devices
- CVE-2025-20906Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.Samsung Mobile Devices
- CVE-2025-20905Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-ofSamsung Mobile Devices
- CVE-2025-20904Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption.Samsung Mobile Devices
- CVE-2024-12046Medical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcodenicheaddons Medical Addon for Elementor
- CVE-2024-13514B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcodebplugins bSlider – Create Responsive Image, Post, Product,…
- CVE-2025-20902Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's priSamsung Mobile Media Controller
- CVE-2025-20901Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory.Samsung Mobile Blockchain Keystore
- CVE-2025-20900Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory.Samsung Mobile Blockchain Keystore
- CVE-2025-20899Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 Samsung Mobile PushNotification
- CVE-2025-20898Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profilSamsung Mobile Samsung Members
- CVE-2025-20897Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allowsSamsung Mobile Secure Folder
- CVE-2025-20896Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive informatSamsung Mobile EasySetup
- CVE-2025-20895Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary appliSamsung Mobile Galaxy Store
- CVE-2025-20894Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.Samsung Mobile Samsung Email
- CVE-2025-20893Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notificSamsung Mobile Devices
- CVE-2025-20892Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command.Samsung Mobile Devices
- CVE-2025-20891Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackerSamsung Mobile Devices
- CVE-2025-20889Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to reaSamsung Mobile Devices
- CVE-2025-20887Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrarSamsung Mobile Devices
- CVE-2025-20886Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to getSamsung Mobile Devices
- CVE-2025-20885Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption.Samsung Mobile Devices
- CVE-2025-20884Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user proSamsung Mobile Devices
- CVE-2025-20883Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profileSamsung Mobile Devices
- CVE-2024-13607JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Referencerabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2024-12597HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_cssdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2025-0466Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message DisclosureSensei LMS
- CVE-2025-0368Banner Garden Plugin for WordPress <= 0.1.3 - Reflected XSSBanner Garden Plugin for WordPress
- CVE-2024-13332TransFinanz <= 1.0.0 - Reflected XSSTransFinanz
- CVE-2024-13331WP Dream Carousel <= 1.0.1b - Reflected XSSWP Dream Carousel
- CVE-2024-13328Giga Messenger Bots <= 2.3.1 - Reflected XSSGiga Messenger
- CVE-2024-13327Musicbox <= 2.0.3 - Reflected XSSMusicbox
- CVE-2024-13326iBuildApp <= 0.2.0 - Reflected XSSiBuildApp
- CVE-2024-13325Glossy <= 2.3.5 - Reflected XSSGlossy
- CVE-2024-13115WP Projects Portfolio with Client Testimonials <= 3.0 - Stored XSS via CSRFWP Projects Portfolio with Client Testimonials
- CVE-2024-13114WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSSWP Projects Portfolio with Client Testimonials
- CVE-2025-24982Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5.SWIT Activity Log WinterLock
- CVE-2025-22475Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky ImplDell PowerProtect DD