CVEs published February 19, 2025
125 CVEs were published on February 19, 2025: 7 critical, 41 high. 1 is now in CISA KEV.
- Published
- 125
- Critical
- 7
- High
- 41
- Medium
- 74
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 35
Most affected products
- Hitachi Vantara Pentaho Data Integration & Analytics · Hita…
- 9
- IBM Cognos Controller · IBM Controller
- 7
- ChurchCRM
- 5
- Google Chrome
- 3
- grub2 · Red Hat Enterprise Linux +1
- 3
- Six Apart Movable Type
- 3
- binnyva Pollin
- 2
- labibahmed42 Team Builder For WPBakery Page Builder
- 2
- Pengutronix barebox
- 2
- Raptive Ads
- 2
Critical 7
- CVE-2024-37361Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted DataHitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2025-1135SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpChurchCRM
- CVE-2025-1134SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpChurchCRM
- CVE-2025-1133SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.phpChurchCRM
- CVE-2025-1132SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.phpChurchCRM
- CVE-2020-35546Lexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access control settings.
- CVE-2023-46271Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow.
High 41
- CVE-2024-12284Authenticated privilege escalationNetScaler Console · NetScaler Agent
- CVE-2024-37359Hitachi Vantara Pentaho Business Analytics Server – Server Side Request ForgeryHitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2024-5705Hitachi Vantara Pentaho Business Analytics Server - Incorrect AuthorizationHitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2024-5706Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')Hitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2025-24989Microsoft Power Pages Elevation of Privilege VulnerabilityMicrosoft Power Pages
- CVE-2025-21355Microsoft Bing Remote Code Execution VulnerabilityMicrosoft Bing
- CVE-2025-27092Path Traversal Vulnerability in GHOSTS Photo Retrieval Endpointcmu-sei GHOSTS
- CVE-2025-0624Grub2: net: out-of-bounds write in grub_net_search_config_file()grub2 · Red Hat Enterprise Linux 7 Extended Lifecycle Su… +2
- CVE-2025-0893Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability.Symantec Diagnostic Tool
- CVE-2025-1006Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2025-1426Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2025-0999Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2025-24965.krun_config.json symlink attack creates or overwrites file on the host in cruncontainers crun
- CVE-2024-52541Dell Client Platform BIOS contains a Weak Authentication vulnerability.Dell Client Platform BIOS
- CVE-2023-47160IBM Cognos Controller XML external entity injectionIBM Cognos Controller · IBM Controller
- CVE-2024-28777IBM Cognos Controller code executionIBM Cognos Controller · IBM Controller
- CVE-2024-45084IBM Cognos Controller CSV injectionIBM Cognos Controller · IBM Controller
- CVE-2024-52902IBM Cognos Controller information disclosureIBM Cognos Controller · IBM Controller
- CVE-2024-13534Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injectionenituretechnology Small Package Quotes – Worldwide Express…
- CVE-2024-13533Small Package Quotes – USPS Edition <= 1.3.5 - Unauthenticated SQL Injectionenituretechnology Small Package Quotes – USPS Edition
- CVE-2024-13483LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – SAIA Edition
- CVE-2024-13491Small Package Quotes – For Customers of FedEx <= 4.3.1 - Unauthenticated SQL Injectionenituretechnology Small Package Quotes – For Customers of F…
- CVE-2024-13481LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – R+L Carriers Edition
- CVE-2024-13485LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – ABF Freight Edition
- CVE-2024-13479LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – SEFL Edition
- CVE-2024-13478LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – TForce Edition
- CVE-2025-0916YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scriptingyaycommerce YaySMTP and Email Logs: Amazon SES, SendGrid, O…
- CVE-2024-13489LTL Freight Quotes – Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injectionenituretechnology LTL Freight Quotes – Old Dominion Edition
- CVE-2025-1024Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID ParameterChurchCRM
- CVE-2024-13592Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Local File Inclusionlabibahmed42 Team Builder For WPBakery Page Builder
- CVE-2024-13468Trash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletionsolwininfotech Trash Duplicate and 301 Redirect
- CVE-2024-11582Subscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameterwedevs Subscribe2 – Form, Email Subscribers & Newsletters
- CVE-2020-10095Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device.
- CVE-2023-46272Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute
- CVE-2023-51293A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to sen
- CVE-2023-51301A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an exc
- CVE-2023-51302PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2024-57261In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258.Pengutronix barebox
- CVE-2024-57262In barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 filePengutronix barebox
- CVE-2025-25943Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom com
- CVE-2025-25944Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically i
Medium, low and unrated 77
- CVE-2025-0112Cortex XDR Agent: Local Windows User Can Disable the AgentPalo Alto Networks Cortex XDR Agent
- CVE-2024-37363Hitachi Vantara Pentaho Business Analytics Server - Incorrect AuthorizationHitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2024-37362Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected CredentialsHitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2024-6697Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or PrivilegesHitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2024-6696Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access ControlHitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2024-37360Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Hitachi Vantara Pentaho Data Integration & Analytics · Hita…
- CVE-2025-27090Server-Side Request Forgery (SSRF) in sliver teamserverBishopFox sliver · github.com/bishopfox/sliver
- CVE-2025-25196OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2025-0677Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinksgrub2 · Red Hat Enterprise Linux +1
- CVE-2025-1118Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabledgrub2 · Red Hat Enterprise Linux +1
- CVE-2024-45777Grub2: grub-core/gettext: integer overflow leads to heap oob write.grub2 · Red Hat Enterprise Linux +1
- CVE-2024-53974Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-24806Regulation applies separately to Username-based logins to Email-based logins in autheliaauthelia · github.com/authelia/authelia +1
- CVE-2025-27089Overlapping policies allow update to non-allowed fields in directusdirectus · @directus/api
- CVE-2025-20211Cisco BroadWorks Application Delivery Platform Software Cross-Site Scripting VulnerabilityCisco BroadWorks
- CVE-2025-20153Cisco ESA mail BypassCisco Secure Email
- CVE-2025-20158Cisco Video Phone 8875 and Desk Phone 9800 Series Information Disclosure VulnerabilityCisco Session Initiation Protocol (SIP) Software
- CVE-2024-28776IBM Cognos Controller cross-site scriptingIBM Cognos Controller · IBM Controller
- CVE-2024-28780IBM Cognos Controller information disclosureIBM Cognos Controller · IBM Controller
- CVE-2024-45081IBM Cognos Controller incorrect authorizationIBM Cognos Controller · IBM Controller
- CVE-2025-1465lmxcms Maintenance db.inc.php code injectionlmxcms
- CVE-2025-1464Baiyi Cloud Asset Management System admin.house.collect.php sql injectionBaiyi Cloud Asset Management System
- CVE-2025-0968ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Functionroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2025-1075LDAP credentials logged to Apache error logCheckmk
- CVE-2025-1007Improper Authorization in /user/namespace/{namespace}/detailsEclipse Foundation OpenVSX
- CVE-2024-13363Raptive Ads <= 3.6.3 - Reflected Cross-Site ScriptingRaptive Ads
- CVE-2024-13339DeBounce Email Validator <= 5.8.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingDeBounce Email Validator
- CVE-2024-13364Raptive Ads <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings ResetRaptive Ads
- CVE-2024-13336Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disableexeebit Disable Auto Updates
- CVE-2024-13231WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Updateportfoliohub WordPress Portfolio Builder – Portfolio Gallery
- CVE-2024-13679Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingsimply4net Widget BUY.BOX
- CVE-2024-13405Apptivo Business Site CRM <= 5.3 - Cross-Site Request Forgery to IP Address BlockApptivo Business Site
- CVE-2024-13591Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinglabibahmed42 Team Builder For WPBakery Page Builder
- CVE-2024-13736Pure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameterpure-chat Pure Chat – Live Chat & More!
- CVE-2024-13657Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scriptingstore-locator-pro Store Locator Widget
- CVE-2024-13676Categorized Gallery Plugin <= 2.0 - Authenticated (Contributor+) SQL Injectionwamasoftware Categorized Gallery Plugin
- CVE-2024-11753UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingumichitswebhosting UMich OIDC Login
- CVE-2024-11778CanadaHelps Embedded Donation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingCanadaHelps Embedded Donation Form
- CVE-2024-11335UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingultradevs UltraEmbed – Advanced Iframe Plugin For WordPress…
- CVE-2024-13462WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingnida78 WP Wiki Tooltip
- CVE-2024-12339Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'Digihood HTML Sitemap
- CVE-2024-13660Responsive Flickr Slideshow <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingrobertmsiaorg Responsive Flickr Slideshow
- CVE-2024-12069Lexicata <= 1.0.16 - Reflected Cross-Site ScriptingLexicata
- CVE-2024-13674Cosmic Blocks (40+) Content Editor Blocks Collection <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingberginformatik Cosmic Blocks (40+) Content Editor Blocks Co…
- CVE-2024-13854Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcodenicheaddons Education Addon for Elementor
- CVE-2024-13711Pollin <= 1.01.1 - Reflected Cross-Site Scriptingbinnyva Pollin
- CVE-2024-12522Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingyayforms Yay! Forms
- CVE-2024-13719PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information ExposurePeproDev Ultimate Invoice
- CVE-2024-13390ADFO – Custom data in admin dashboard <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinggiuliopanda ADFO – Custom data in admin dashboard
- CVE-2024-13712Pollin <= 1.01.1 - Authenticated (Admin+) SQL Injectionbinnyva Pollin
- CVE-2024-13589YouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingjohnnya23 YouTube Playlists with Schema
- CVE-2025-0865WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Updatedebaat WP Media Category Management
- CVE-2024-13663Coaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingmarkodonnell Coaching Staffs
- CVE-2025-0633Heap Overflow in iniparser.ciniparser
- CVE-2024-12173Master Slider < 3.10.5 - Editor+ Stored XSSMaster Slider
- CVE-2025-24841Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor.Six Apart Movable Type
- CVE-2025-25054Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page.Six Apart Movable Type
- CVE-2025-22888Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor.Six Apart Movable Type
- CVE-2024-13799User Private Files – File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scriptingdeepakkite File Sharing & Download Manager – User Private F…
- CVE-2025-1065Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From Filethemeisle Visualizer: Tables and Charts Manager for WordPre…
- CVE-2025-1441Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2025-22622Age Verification - Reflected cross-site scripting (XSS)Age Checker Age Verification
- CVE-2024-13443Easypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeeasypromosapp Easypromos Plugin
- CVE-2025-1448Synway SMG Gateway Management Software 9-12ping.php command injectionSynway SMG Gateway Management Software
- CVE-2025-1447kasuganosoras Pigeon index.php server-side request forgerykasuganosoras Pigeon
- CVE-2020-13481Certain Lexmark products through 2020-05-25 allow XSS which allows an attacker to obtain session credentials and other sensitive information
- CVE-2023-51296PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code
- CVE-2023-51297A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount
- CVE-2023-51298PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
- CVE-2023-51299PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugi
- CVE-2023-51300PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities in the "name, plugin_sms_api_key, plugin_sm
- CVE-2023-51303PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name, plugin_sms_api_key, plugin_sms_country_co
- CVE-2023-51305PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin
- CVE-2025-25942An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files.
- CVE-2025-25945An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::C
- CVE-2025-25946An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIp
- CVE-2025-25947An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChil