CVEs published February 10, 2025
73 CVEs were published on February 10, 2025: 3 critical, 24 high. 2 are now in CISA KEV.
- Published
- 73
- Critical
- 3
- High
- 24
- Medium
- 37
- Low
- 8
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 22
Most affected products
- Linux
- 8
- GNU Binutils
- 7
- Chimpstudio WP Foodbakery
- 2
- Devolutions Remote Desktop Manager
- 2
- KUNBUS Revolution Pi
- 2
- OpenSC pam_pkcs11
- 2
- ZOO-Project
- 2
- @perfood/couch-auth
- 1
- ABB System 800xA
- 1
- Allims lab.online
- 1
Critical 3
- CVE-2025-24016Remote code execution in Wazuh serverwazuh · github.com/wazuh/wazuh
- CVE-2024-13011WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File UploadChimpstudio WP Foodbakery
- CVE-2025-24032PAM-PKCS#11 vulnerable to authentication bypass with default value for `cert_policy` (`none`)OpenSC pam_pkcs11
High 24
- CVE-2025-24970SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEnginenetty · io.netty:netty-handler
- CVE-2024-13059Path Traversal in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-8550Local File Inclusion (LFI) in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-27859The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-21693mm: zswap: properly synchronize freeing resources during CPU hotunplugLinux
- CVE-2025-21692net: sched: fix ets qdisc OOB IndexingLinux
- CVE-2025-21687vfio/platform: check the bounds of read/write syscallsLinux
- CVE-2024-10334Camera passwords stored in clear textABB System 800xA
- CVE-2024-11621Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modifDevolutions Remote Desktop Manager
- CVE-2025-1193Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows aDevolutions Remote Desktop Manager
- CVE-2024-8684OS Command Injection vulnerability in Revolution PiKUNBUS Revolution Pi
- CVE-2025-1099Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi CameraTP-Link Tapo C500 V1 Wi-Fi Camera · TP-Link Tapo C500 V2 Wi…
- CVE-2024-42512Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenOPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2024-46429A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management po
- CVE-2024-46431Tenda W18E V16.01.0.8(1625) is vulnerable to Buffer Overflow.
- CVE-2024-46432Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control.
- CVE-2024-46433A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management port
- CVE-2024-46434Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain
- CVE-2024-46435A stack overflow vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an authenticated remote attacker to cause a d
- CVE-2024-46436Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the teln
- CVE-2024-54954OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.
- CVE-2024-57177A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2.@perfood/couch-auth
- CVE-2024-57407An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading
- CVE-2024-57408An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via
Medium, low and unrated 46
- CVE-2025-1163code-projects Vehicle Parking Management System Authentication login stack-based overflowcode-projects Vehicle Parking Management System
- CVE-2025-1162code-projects Job Recruitment load\_user-profile.php sql injectioncode-projects Job Recruitment
- CVE-2025-1160SourceCodester Employee Management System index.php default credentialsSourceCodester Employee Management System
- CVE-2025-25194Server-Side Request Forgery (SSRF) in activitypub_federationLemmyNet lemmy · activitypub_federation
- CVE-2025-25190[XBOW-025-033] Cross-Site Scripting (XSS) via EchoProcess Service in ZOO-Project WPS ServerZOO-Project
- CVE-2025-25189[XBOW-025-031] Reflected Cross-Site Scripting via jobid Parameter in ZOO-Project WPS publish.py CGI ScriptZOO-Project
- CVE-2025-25193Denial of Service attack on windows app using Nettynetty · io.netty:netty-common
- CVE-2025-1159CampCodes School Management Software academic-calendar cross site scriptingCampCodes School Management Software
- CVE-2025-1158ESAFENET CDG addPolicyToSafetyGroup.jsp sql injectionESAFENET CDG
- CVE-2025-1157Allims lab.online model_recuperar_senha.php sql injectionAllims lab.online
- CVE-2025-1002MicroDicom DICOM Viewer Improper Certificate ValidationMicroDicom DICOM Viewer
- CVE-2025-1156Pix Software Vivaz servlet sql injectionPix Software Vivaz
- CVE-2025-1155Webkul QloApps Your Location Search stores cross site scriptingWebkul QloApps
- CVE-2025-1154xxyopen Novel books sql injectionxxyopen Novel
- CVE-2025-24200An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-1153GNU Binutils format.c bfd_set_format memory corruptionGNU Binutils
- CVE-2024-10649Unauthenticated File Upload in wandb/openuiwandb/openui
- CVE-2024-13010WP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingChimpstudio WP Foodbakery
- CVE-2024-54658The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-1152GNU Binutils ld xstrdup.c xstrdup memory leakGNU Binutils
- CVE-2025-25188DNSSEC validation may accept broken authentication chainshickory-dns · hickory-proto
- CVE-2025-1151GNU Binutils ld xmemdup.c xmemdup memory leakGNU Binutils
- CVE-2025-1150GNU Binutils ld libbfd.c bfd_malloc memory leakGNU Binutils
- CVE-2025-21691cachestat: fix page cache statistics permission checkingLinux
- CVE-2025-21690scsi: storvsc: Ratelimit warning logs to prevent VM denial of serviceLinux
- CVE-2025-21689USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()Linux
- CVE-2025-21688drm/v3d: Assign job pointer to NULL before signaling the fenceLinux
- CVE-2024-57950drm/amd/display: Initialize denominator defaults to 1Linux
- CVE-2025-25186Net::IMAP vulnerable to possible DoS by memory exhaustionruby net-imap · net-imap
- CVE-2025-24892OpenProject stored HTML injection vulnerabilityopf openproject
- CVE-2025-24031PAM-PKCS#11 vulnerable to segmentation fault on ctrl-c/ctrl-d when asked for PINOpenSC pam_pkcs11
- CVE-2024-12243Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dosgnutls · Red Hat Enterprise Linux +2
- CVE-2024-12133Libtasn1: inefficient der decoding in libtasn1 leading to potential remote doslibtasn1 · Red Hat Enterprise Linux +2
- CVE-2024-11831Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptserialize-javascript · Red Hat Advanced Cluster Security +36
- CVE-2025-1149GNU Binutils ld xmalloc.c xstrdup memory leakGNU Binutils
- CVE-2025-1148GNU Binutils ld ldelfgen.c link_order_scan memory leakGNU Binutils
- CVE-2025-1147GNU Binutils nm nm.c internal_strlen buffer overflowGNU Binutils
- CVE-2024-8685Path-Traversal vulnerability in Revolution PiKUNBUS Revolution Pi
- CVE-2025-1175Cross-Site Scripting (XSS) vulnerability in Kelio VisioKelio Visio
- CVE-2025-25247Apache Felix Webconsole: XSS in services consoleApache Software Foundation Apache Felix Webconsole · org.ap…
- CVE-2024-42513Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenOPCFoundation.NetStandard.Opc.Ua.Bindings.Https
- CVE-2024-46430Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control.
- CVE-2024-46437A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote a
- CVE-2024-48170PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php.
- CVE-2024-57178An SQL injection vulnerability exists in Stock-Forecaster <=01-04-2020.
- CVE-2024-57409A stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java v1.0 allows attackers to execute arbitrary