CVEs published February 5, 2025
118 CVEs were published on February 5, 2025: 7 critical, 60 high.
- Published
- 118
- Critical
- 7
- High
- 60
- Medium
- 45
- Low
- 5
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- F5 BIG-IP
- 14
- IBM ApplinX
- 9
- Cisco IOS
- 8
- GitLab
- 7
- IBM Aspera Shares
- 7
- Progress LoadMaster
- 5
- Cisco Secure Email · Cisco Secure Web Appliance
- 3
- curl
- 3
- IBM Cloud Pak for Business Automation
- 3
- Mobile-Security-Framework-MobSF · mobsf
- 3
Critical 7
- CVE-2025-1066CVE-2025-1066OpenPLC
- CVE-2025-20125Cisco Identity Services Engine Insufficient Authorization Bypass VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2025-20124Cisco Identity Services Engine Java Deserialization VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2025-23114A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server.Veeam Backup for AWS · Veeam Backup for Microsoft Azure +4
- CVE-2020-36084SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/del
- CVE-2024-57077The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend.utils-extend
- CVE-2024-57520Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function.
High 60
- CVE-2025-24803Stored Cross-Site Scripting (XSS) in MobSFMobile-Security-Framework-MobSF · mobsf
- CVE-2025-24805Local Privilege Escalation in MobSFMobile-Security-Framework-MobSF · mobsf
- CVE-2025-24372XSS vector in user uploaded images in group/org and user profiles in ckanckan
- CVE-2024-56135Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.Progress LoadMaster
- CVE-2024-56134Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.Progress LoadMaster
- CVE-2024-56133Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.Progress LoadMaster
- CVE-2024-56132Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.Progress LoadMaster
- CVE-2024-56131Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.Progress LoadMaster
- CVE-2025-20029BIG-IP iControl REST and tmsh vulnerabilityF5 BIG-IP
- CVE-2025-24497BIG-IP PEM vulnerabilityF5 BIG-IP
- CVE-2025-24312BIG-IP AFM vulnerabilityF5 BIG-IP
- CVE-2025-22846BIG-IP SIP VulnerabilityF5 BIG-IP
- CVE-2025-23412BIG-IP APM access profile vulnerabilityF5 BIG-IP
- CVE-2025-23239BIG-IP iControl REST vulnerabilityF5 BIG-IP
- CVE-2025-24326BIG-IP Advanced WAF/ASM BADoS vulnerabilityF5 BIG-IP
- CVE-2025-20045BIG-IP SIP MRF VulnerabilityF5 BIG-IP
- CVE-2025-22891BIG-IP PEM VulnerabilityF5 BIG-IP
- CVE-2025-20058BIG-IP message routing vulnerabilityF5 BIG-IP
- CVE-2025-21091BIG-IP SNMP vulnerabilityF5 BIG-IP
- CVE-2025-21087TMM VulnerabilityF5 BIG-IP
- CVE-2025-20169A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeCisco IOS
- CVE-2025-20175A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeCisco IOS
- CVE-2025-20174A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeCisco IOS
- CVE-2025-20170A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeCisco IOS
- CVE-2025-20171A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeCisco IOS
- CVE-2025-20176A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeCisco IOS
- CVE-2025-20172A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, Cisco IOS
- CVE-2025-20173A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeCisco IOS
- CVE-2024-39564Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to RPD crashJuniper Networks Junos OS
- CVE-2024-2878Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-49352IBM Cognos Anaytics XML external entity injectionIBM Cognos Analytics
- CVE-2024-9631Inefficient Algorithmic Complexity in GitLabGitLab
- CVE-2025-0725gzip integer overflowcurl
- CVE-2025-0665eventfd double closecurl
- CVE-2025-1025Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extensiocockpit-hq/cockpit
- CVE-2025-1022Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browspatie/browsershot
- CVE-2025-1026Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through tspatie/browsershot
- CVE-2025-1028Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Uploadkleor Contact Manager
- CVE-2024-48394A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unpr
- CVE-2024-57063A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a c
- CVE-2024-57064A prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoS
- CVE-2024-57065A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a cra
- CVE-2024-57066A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying@ndhoule/defaults
- CVE-2024-57067A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted
- CVE-2024-57068A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS)@tanstack/form-core
- CVE-2024-57069A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafte
- CVE-2024-57071A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a c
- CVE-2024-57072A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS)module-from-string
- CVE-2024-57074A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a craf
- CVE-2024-57075A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a ceazy-logger
- CVE-2024-57076A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a cr
- CVE-2024-57078A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a craf
- CVE-2024-57079A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplyin@zag-js/core
- CVE-2024-57080A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a cvxe-table
- CVE-2024-57081A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via sup
- CVE-2024-57084A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a
- CVE-2024-57085A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via supp@stryker-mutator/util
- CVE-2024-57086A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoSnode-opcua-alarm-condition
- CVE-2024-57699A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1.net.minidev:json-smart
- CVE-2025-25246NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users.NETGEAR XR1000 · NETGEAR XR1000v2 +1
Medium, low and unrated 51
- CVE-2024-49800IBM ApplinX Information DisclosureIBM ApplinX
- CVE-2024-49798IBM ApplinX Information DisclosureIBM ApplinX
- CVE-2024-49797IBM ApplinX Information DisclosureIBM ApplinX
- CVE-2024-49796IBM ApplinX ClickjackingIBM ApplinX
- CVE-2024-49795IBM ApplinX Cross-Site Request ForgeryIBM ApplinX
- CVE-2024-49794IBM ApplinX Cross-Site Request ForgeryIBM ApplinX
- CVE-2024-49793IBM ApplinX Cross-Site ScriptingIBM ApplinX
- CVE-2024-49792IBM ApplinX Cross-Site ScriptingIBM ApplinX
- CVE-2024-49791IBM ApplinX Cross-Site ScriptingIBM ApplinX
- CVE-2024-56473IBM Aspera Shares Data ManipulationIBM Aspera Shares
- CVE-2024-56472IBM Aspera Shares Cross-Site ScriptingIBM Aspera Shares
- CVE-2024-56471IBM Aspera Shares Server-Side Request ForgeryIBM Aspera Shares
- CVE-2024-56470IBM Aspera Shares Server-Side Request ForgeryIBM Aspera Shares
- CVE-2024-38318IBM Aspera Shares HTML injectionIBM Aspera Shares
- CVE-2024-38317IBM Aspera Shares Cross-Site ScriptingIBM Aspera Shares
- CVE-2024-38316IBM Aspera Shares Denial of ServiceIBM Aspera Shares
- CVE-2025-24804Partial Denial of Service (DoS) in MobSFMobile-Security-Framework-MobSF · mobsf
- CVE-2024-7596Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packetdraft-ietf-intarea-gue-09
- CVE-2024-7595GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packetIETF RFC2784 - Generic Routing Encapsulation
- CVE-2025-23419TLS Session Resumption VulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2025-23413BIG-IP Next Central Manager vulnerabilityF5 BIG-IP Next Central Manager
- CVE-2025-24319BIG-IP Next Central Manager vulnerabilityF5 BIG-IP Next Central Manager
- CVE-2025-24320BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2025-23415BIG-IP APM Endpoint Inspection vulnerabilityF5 BIG-IP
- CVE-2025-20207Cisco Secure Email Gateway, Cisco Secure Email and Web Appliance and Cisco Secure Web Appliance SNMP Polling Information Disclosure VulnerabilityCisco Secure Email · Cisco Secure Web Appliance
- CVE-2025-20205Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authentiCisco Identity Services Engine Software
- CVE-2025-20204Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authentiCisco Identity Services Engine Software
- CVE-2025-20185Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Privilege Escalation VulnerabilityCisco Secure Email · Cisco Secure Web Appliance
- CVE-2025-20184Cisco Secure Email and Web Manager and Secure Web Appliance Command Injection VulnerabilityCisco Secure Email · Cisco Secure Web Appliance
- CVE-2025-20183Cisco Secure Web Appliance Range Request Bypass VulnerabilityCisco Secure Web Appliance
- CVE-2025-20180Cisco Secure Email and Web Manager and Secure Email Gateway Cross-Site Scripting VulnerabilityCisco Secure Email
- CVE-2025-20179Cisco Expressway Series Cross-Site Scripting VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2024-42207HCL iAutomate is affected by a session fixation vulnerabilityHCL Software iAutomate
- CVE-2025-0858Certain Poly Devices – Path Traversal Vulnerability - Arbitrary File Access by Unauthorized UserHP Certain Poly Devices
- CVE-2025-21117Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI.Dell Avamar
- CVE-2024-9097IDORManageEngine Endpoint Central
- CVE-2024-3976Missing Authorization in GitLabGitLab
- CVE-2024-49348IBM Cloud Pak for Business Automation incorrect privilege assignmentIBM Cloud Pak for Business Automation
- CVE-2024-52365IBM Cloud Pak for Business Automation cross-site scriptingIBM Cloud Pak for Business Automation
- CVE-2024-52364IBM Cloud Pak for Business Automation cross-site scriptingIBM Cloud Pak for Business Automation
- CVE-2024-5528Incomplete Comparison with Missing Factors in GitLabGitLab
- CVE-2024-6356Incorrect User Management in GitLabGitLab
- CVE-2024-1539Missing Authorization in GitLabGitLab
- CVE-2023-6386Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-0167netrc and default credential leakcurl
- CVE-2023-52925netfilter: nf_tables: don't fail inserts if duplicate has expiredLinux
- CVE-2023-52924netfilter: nf_tables: don't skip expired elements during walkLinux
- CVE-2024-13829WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.8 - Unauthenticated Sensitive Information ExposureWordPress form builder plugin for contact forms, surveys an…
- CVE-2024-54853A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows r
- CVE-2024-57082A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via s@rpldy/uploader
- CVE-2024-57598A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp w