CVEs published February 6, 2025
98 CVEs were published on February 6, 2025: 15 critical, 31 high. 1 is now in CISA KEV.
- Published
- 98
- Critical
- 15
- High
- 31
- Medium
- 48
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- Huawei HarmonyOS
- 6
- Humming Heads Defense Platform Home Edition
- 6
- Microsoft Edge
- 6
- Huawei HarmonyOS · Huawei EMUI
- 4
- IBM EntireX
- 3
- Mindskip xzs-mysql 学之思开源考试系统
- 3
- 2N Access Commander
- 2
- 2N OS
- 2
- Apache Software Foundation Apache James server · org.apache…
- 2
- ClearML
- 2
Critical 15
- CVE-2025-0674Elber Communications Equipment Authentication Bypass Using an Alternate Path or ChannelElber Signum DVB-S/S2 IRD · Elber Cleber/3 Broadcast Mul… +3
- CVE-2025-24786Path traversal opening Sqlite3 database in WhoDBclidey whodb · github.com/clidey/whodb/core
- CVE-2025-24981Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdcnuxt-modules mdc · @nuxtjs/mdc
- CVE-2024-39272A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533.ClearML
- CVE-2023-5878OneWireless command injection possible when updating firmwareHoneywell OneWireless Network Wireless Device Manager
- CVE-2025-0982Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)Google Cloud Application Integration
- CVE-2024-51547Credentials Disclosure - keysABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-51450IBM Security Verify Directory Command ExecutionIBM Security Verify Directory
- CVE-2022-40916Tiny File Manager v2.4.7 and below is vulnerable to session fixation.
- CVE-2024-36554Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0
- CVE-2024-36555Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch
- CVE-2024-36556Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.
- CVE-2024-57428A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fi
- CVE-2024-57430An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate datab
- CVE-2025-22992A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9.
High 31
- CVE-2025-0675Elber Communications Equipment Hidden FunctionalityElber Signum DVB-S/S2 IRD · Elber Cleber/3 Broadcast Mul… +3
- CVE-2025-21342Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-21408Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-21177Microsoft Dynamics 365 Sales Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 Sales
- CVE-2024-54171IBM EntireX XML external entity injectionIBM EntireX
- CVE-2024-472582N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of2N Access Commander
- CVE-2025-24787Parameter injection in DB connection URIs leading to local file inclusion in WhoDBclidey whodb · github.com/clidey/whodb/core
- CVE-2025-23217Mitmweb API Authentication Bypass Using Proxy Servermitmproxy
- CVE-2025-22867Arbitrary code execution during build on darwin in cmd/goGo toolchain cmd/go · toolchain
- CVE-2024-43779An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533.ClearML
- CVE-2025-0994Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vTrimble Cityworks
- CVE-2022-31764Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCApache Software Foundation Apache ShardingSphere ElasticJob…
- CVE-2024-57960Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect servHuawei HarmonyOS · Huawei EMUI
- CVE-2024-37358Apache James: denial of service through the use of IMAP literalsApache Software Foundation Apache James server · org.apache…
- CVE-2025-23236Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.Humming Heads Defense Platform Home Edition
- CVE-2025-20094Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.Humming Heads Defense Platform Home Edition
- CVE-2024-13487CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Functionvillatheme CURCY – Multi Currency for WooCommerce – Smoothl…
- CVE-2024-49814IBM Security Verify Access Appliance Privilege EscalationIBM Security Verify Access Appliance
- CVE-2024-36553Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack.
- CVE-2024-36558Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Informatio
- CVE-2024-39033In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration
- CVE-2024-54909A vulnerability has been identified in GoldPanKit eva-server v4.1.0.
- CVE-2024-55241An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py compone
- CVE-2024-56889Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to
- CVE-2024-57392Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Servic
- CVE-2024-57426NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a direc
- CVE-2024-57609An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via
- CVE-2024-57610A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly
- CVE-2024-57668In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.
- CVE-2025-23093The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authent
- CVE-2025-23094The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1,
Medium, low and unrated 52
- CVE-2025-1084Mindskip xzs-mysql 学之思开源考试系统 cross-site request forgeryMindskip xzs-mysql 学之思开源考试系统
- CVE-2025-1083Mindskip xzs-mysql 学之思开源考试系统 CORS cross-domain policyMindskip xzs-mysql 学之思开源考试系统
- CVE-2025-21283Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-21253Microsoft Edge for IOS and Android Spoofing VulnerabilityMicrosoft Edge for Android · Microsoft Edge for iOS
- CVE-2025-21279Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-21267Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2025-21404Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2025-1082Mindskip xzs-mysql 学之思开源考试系统 Exam Edit edit cross site scriptingMindskip xzs-mysql 学之思开源考试系统
- CVE-2025-1004Certain HP LaserJet Pro Printers – Potential Denial of ServiceCertain HP LaserJet Pro Printers
- CVE-2025-0158IBM EntireX denial of serviceIBM EntireX
- CVE-2025-1081Bharti Airtel Xstream Fiber WiFi Password weak credentialsBharti Airtel Xstream Fiber
- CVE-2024-56467IBM EntireX information disclosureIBM EntireX
- CVE-2024-52892IBM Jazz for Service Management Cross-Site ScriptingIBM Jazz for Service Management
- CVE-2024-47256Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES pass2N Access Commander
- CVE-2024-13417Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader.2N OS
- CVE-2024-13416Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log.2N OS
- CVE-2025-1078AppHouseKitchen AlDente Charge Limiter XPC Service com.apphousekitchen.aldente-pro.helper shouldAcceptNewConnection improper authorizationAppHouseKitchen AlDente Charge Limiter
- CVE-2025-22866Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecGo standard library crypto/internal/nistec · stdlib
- CVE-2024-13614Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky EKaspersky Anti-Virus SDK for Windows · Kaspersky Securit… +9
- CVE-2025-1074Webkul QloApps URL mylogout cross-site request forgeryWebkul QloApps
- CVE-2024-24911Out of Bounds read in the CPCA process on Check Point Management Servercheckpoint Multi-Domain Security Management, Quantum Securi…
- CVE-2025-1076Stored Cross-Site Scripting vulnerability in HoldedHolded
- CVE-2024-57962Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may affHuawei HarmonyOS
- CVE-2024-57961Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform abHuawei HarmonyOS · Huawei EMUI
- CVE-2024-57959Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to performHuawei HarmonyOS · Huawei EMUI
- CVE-2024-57958Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perforHuawei HarmonyOS · Huawei EMUI
- CVE-2024-12602Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confHuawei HarmonyOS
- CVE-2024-57957Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affecHuawei HarmonyOS
- CVE-2024-57956Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availabilHuawei HarmonyOS
- CVE-2024-57955Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentialitHuawei HarmonyOS
- CVE-2024-57954Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service cHuawei HarmonyOS
- CVE-2024-45626Apache James: denial of service through JMAP HTML to text conversionApache Software Foundation Apache James server · org.apache…
- CVE-2025-0859Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url FunctionPost and Page Builder by BoldGrid – Visual Drag and Drop Ed…
- CVE-2025-24845Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.Humming Heads Defense Platform Home Edition
- CVE-2025-24483NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.Humming Heads Defense Platform Home Edition
- CVE-2025-22894Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.Humming Heads Defense Platform Home Edition
- CVE-2025-22890Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.Humming Heads Defense Platform Home Edition
- CVE-2025-0522LikeBot – Decentralized like-system <= 0.85 - Admin+ Stored XSS via CSRFLikeBot
- CVE-2025-0799IBM App Connect Enterprise Arbitrary File WriteIBM App Connect Enterprise
- CVE-2020-36085Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers
- CVE-2022-40490Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability.
- CVE-2024-25883The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors.
- CVE-2024-36557The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call
- CVE-2024-48589Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter
- CVE-2024-53586An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request.
- CVE-2024-57427PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS).
- CVE-2024-57429A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote atta
- CVE-2024-57523Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unautho
- CVE-2024-57599Cross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injecte
- CVE-2024-57672An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, R
- CVE-2024-57673An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module
- CVE-2025-22936An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensi