Lista CVE - 2025 / Gennaio
Visualizzazione 2701 - 2800 di 4274 CVE per Gennaio 2025 (Pagina 28 di 43)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2025-0479 | 2025-01-20 | Security Misconfiguration Vulnerability in CP Plus Router |
| CVE-2024-13176 | 2025-01-20 | Timing side-channel in ECDSA signature computation |
| CVE-2025-21655 | 2025-01-20 | io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period |
| CVE-2024-45647 | 2025-01-20 | IBM Security Verify Access unverified password change |
| CVE-2024-51738 | 2025-01-20 | Sunshine improperly enforces pairing protocol request order |
| CVE-2025-22131 | 2025-01-20 | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function |
| CVE-2025-22620 | 2025-01-20 | gix-worktree-state nonexclusive checkout sets executable files world-writable |
| CVE-2025-23044 | 2025-01-20 | Cross-Site Request Forgery (CSRF) allows creating admin account with POST request |
| CVE-2025-23218 | 2025-01-20 | WeGIA has a SQL Injection endpoint 'adicionar_especie.php' parameter 'especie' |
| CVE-2025-23219 | 2025-01-20 | WeGIA has a SQL Injection endpoint 'adicionar_cor.php' parameter 'cor' |
| CVE-2025-23220 | 2025-01-20 | WeGIA has a SQL Injection endpoint 'adicionar_raca.php' parameter 'raca' |
| CVE-2025-24010 | 2025-01-20 | Vite allows any websites to send any requests to the development server and read the response |
| CVE-2025-24013 | 2025-01-20 | CodeIgniter validation of header name and value |
| CVE-2025-23221 | 2025-01-20 | Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism |
| CVE-2024-22348 | 2025-01-20 | IBM UrbanCode Velocity cross-origin resource sharing |
| CVE-2024-22347 | 2025-01-20 | IBM UrbanCode Velocity information disclosure |
| CVE-2024-22349 | 2025-01-20 | IBM UrbanCode Velocity information disclosure |
| CVE-2025-23214 | 2025-01-20 | Cosmos userbase checking vulnerability |
| CVE-2024-13454 | 2025-01-20 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3 |
| CVE-2025-24014 | 2025-01-20 | segmentation fault in win_line() in Vim < 9.1.1043 |
| CVE-2023-37035 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-45908 | 2025-01-21 | Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget. |
| CVE-2024-56997 | 2025-01-21 | PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter. |
| CVE-2024-56998 | 2025-01-21 | PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address. |
| CVE-2023-27112 | 2025-01-21 | pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php. |
| CVE-2023-27113 | 2025-01-21 | pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php. |
| CVE-2023-37024 | 2025-01-21 | A reachable assertion in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows remote attackers to crash the MME with an unauthenticated cellphone... |
| CVE-2023-37025 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37026 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37027 | 2025-01-21 | Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `E-RAB... |
| CVE-2023-37028 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37029 | 2025-01-21 | Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) are susceptible to an assertion-based crash when an oversized NAS packet is received. An attacker may leverage this behavior to repeatedly... |
| CVE-2023-37030 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37031 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37032 | 2025-01-21 | A Stack-based buffer overflow in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows remote attackers to crash the MME with an unauthenticated... |
| CVE-2023-37033 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37034 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37036 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37037 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37038 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2023-37039 | 2025-01-21 | A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allow network-adjacent attackers to crash the MME via an S1AP... |
| CVE-2024-24416 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_access_point_name_ie function at /3gpp/3gpp_24.008_sm_ies.c. This vulnerability allows attackers to cause... |
| CVE-2024-24417 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_protocol_configuration_options function at /3gpp/3gpp_24.008_sm_ies.c. This vulnerability allows attackers to cause... |
| CVE-2024-24418 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_pdn_address function at /nas/ies/PdnAddress.cpp. This vulnerability allows attackers to cause... |
| CVE-2024-24419 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_traffic_flow_template_packet_filter function at /3gpp/3gpp_24.008_sm_ies.c. This vulnerability allows attackers to cause... |
| CVE-2024-24420 | 2025-01-21 | A reachable assertion in the decode_linked_ti_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet. |
| CVE-2024-24421 | 2025-01-21 | A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via... |
| CVE-2024-24422 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a stack overflow in the decode_protocol_configuration_options function at /3gpp/3gpp_24.008_sm_ies.c. This vulnerability allows attackers to cause... |
| CVE-2024-24423 | 2025-01-21 | The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_esm_message_container function at /nas/ies/EsmMessageContainer.cpp. This vulnerability allows attackers to cause... |
| CVE-2024-24424 | 2025-01-21 | A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet. |
| CVE-2024-24427 | 2025-01-21 | A reachable assertion in the amf_ue_set_suci function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet. |
| CVE-2024-24428 | 2025-01-21 | A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet. |
| CVE-2024-24442 | 2025-01-21 | A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP message. |
| CVE-2024-24443 | 2025-01-21 | An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session... |
| CVE-2024-24444 | 2025-01-21 | Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) by repeatedly establishing SCTP connections with... |
| CVE-2024-24445 | 2025-01-21 | OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry... |
| CVE-2024-24451 | 2025-01-21 | A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) by repeatedly establishing SCTP connections with... |
| CVE-2024-42936 | 2025-01-21 | The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message. |
| CVE-2024-48392 | 2025-01-21 | OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account... |
| CVE-2024-51417 | 2025-01-21 | An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields. |
| CVE-2024-54792 | 2025-01-21 | A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the... |
| CVE-2024-54794 | 2025-01-21 | The script input feature of SpagoBI 3.5.1 allows arbitrary code execution. |
| CVE-2024-54795 | 2025-01-21 | SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function. |
| CVE-2024-55504 | 2025-01-21 | An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data... |
| CVE-2024-55958 | 2025-01-21 | Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6. |
| CVE-2024-55959 | 2025-01-21 | Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions. |
| CVE-2024-56990 | 2025-01-21 | PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php. |
| CVE-2024-57036 | 2025-01-21 | TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function. This vulnerability allows an attacker to execute arbitrary commands by sending HTTP request. |
| CVE-2024-57360 | 2025-01-21 | https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-symbol-version` function. |
| CVE-2024-57536 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via wizard_status. |
| CVE-2024-57537 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (page) is copied to the stack without length verification. |
| CVE-2024-57538 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (anonymous_protect_status) is copied to the stack without length verification. |
| CVE-2024-57539 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail. |
| CVE-2024-57540 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (action) is copied to the stack without length verification. |
| CVE-2024-57541 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (ipv6_protect_status) is copied to the stack without length verification. |
| CVE-2024-57542 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn. |
| CVE-2024-57543 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (dhcpstart_ip) is copied to the stack without length verification. |
| CVE-2024-57544 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (lan_ipaddr) is copied to the stack without length verification. |
| CVE-2024-57545 | 2025-01-21 | Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (hidden_dhcp_num) is copied to the stack without length verification. |
| CVE-2024-45091 | 2025-01-21 | IBM UrbanCode Deploy information disclosure |
| CVE-2024-13536 | 2025-01-21 | 1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure |
| CVE-2025-23086 | 2025-01-21 | On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload... |
| CVE-2024-10936 | 2025-01-21 | String Locator <= 2.6.6 - Unauthenticated PHP Object Injection |
| CVE-2025-0371 | 2025-01-21 | Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
| CVE-2024-12005 | 2025-01-21 | WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting |
| CVE-2024-12104 | 2025-01-21 | Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion |
| CVE-2024-13404 | 2025-01-21 | Link Library <= 7.7.2 - Reflected Cross-Site Scripting |
| CVE-2025-23184 | 2025-01-21 | Apache CXF: Denial of Service vulnerability with temporary files |
| CVE-2024-6466 | 2025-01-21 | NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified. |
| CVE-2024-37284 | 2025-01-21 | Elastic Defend Improper Handling of Alternate Encoding Leads to Crash |
| CVE-2024-43709 | 2025-01-21 | Elasticsearch allocation of resources without limits or throttling leads to crash |
| CVE-2024-52973 | 2025-01-21 | Kibana allocation of resources without limits or throttling leads to crash |
| CVE-2025-0450 | 2025-01-21 | Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS |
| CVE-2024-13230 | 2025-01-21 | Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey' |
| CVE-2024-11226 | 2025-01-21 | FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter |
| CVE-2024-13444 | 2025-01-21 | wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting |
| CVE-2025-0614 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune |
| CVE-2025-0615 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune |
| CVE-2024-57930 | 2025-01-21 | tracing: Have process_string() also allow arrays |
| CVE-2024-57931 | 2025-01-21 | selinux: ignore unknown extended permissions |