2025 CVEs (page 411)
Page 411 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21124 | Medium | 5.5 | 2025-02-11 | InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. A… |
CVE-2025-21123 | High | 7.8 | 2025-02-11 | InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-21121 | High | 7.8 | 2025-02-11 | InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-1126 | Critical | 9.3 | 2025-02-11 | A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client. |
CVE-2025-24976 | | 2025-02-11 | Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token aut… | |
CVE-2025-24973 | Critical | 9.3 | 2025-02-11 | Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of… |
CVE-2025-24900 | High | 8.6 | 2025-02-11 | Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of co… |
CVE-2025-24897 | High | 8.2 | 2025-02-11 | Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protectio… |
CVE-2025-24896 | High | 8.1 | 2025-02-11 | Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is… |
CVE-2025-24807 | High | 7.1 | 2025-02-11 | eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10… |
CVE-2025-22467 | Critical | 9.9 | 2025-02-11 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution. |
CVE-2025-26493 | Medium | 4.6 | 2025-02-11 | In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab |
CVE-2025-26492 | High | 7.7 | 2025-02-11 | In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources |
CVE-2025-1231 | Medium | 5.4 | 2025-02-11 | Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-… |
CVE-2025-0588 | Medium | 4.9 | 2025-02-11 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifi… |
CVE-2025-24956 | Medium | 6.2 | 2025-02-11 | A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numb… |
CVE-2025-24812 | Medium | 6.5 | 2025-02-11 | A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7… |
CVE-2025-24811 | High | 7.5 | 2025-02-11 | A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0), SIMAT… |
CVE-2025-24532 | Medium | 4.3 | 2025-02-11 | A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V… |
CVE-2025-24499 | High | 7.2 | 2025-02-11 | A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V… |
CVE-2025-23403 | High | 7.0 | 2025-02-11 | A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restric… |
CVE-2025-23363 | High | 7.4 | 2025-02-11 | A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V14.3.0.14), Teamcent… |
CVE-2025-0862 | Medium | 4.9 | 2025-02-11 | The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to… |
CVE-2025-0526 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation w… |
CVE-2025-0513 | Medium | 5.4 | 2025-02-11 | In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they… |
CVE-2025-26411 | High | 8.8 | 2025-02-11 | An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device… |
CVE-2025-26410 | Critical | 9.8 | 2025-02-11 | The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password crac… |
CVE-2025-26409 | Medium | 6.8 | 2025-02-11 | A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is… |
CVE-2025-26408 | Medium | 6.1 | 2025-02-11 | The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is… |
CVE-2025-0525 | High | 7.5 | 2025-02-11 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversar… |
CVE-2025-1182 | Medium | 5.0 | 2025-02-11 | A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elfl… |
CVE-2025-0589 | Medium | 5.3 | 2025-02-11 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API… |
CVE-2025-1181 | Medium | 5.0 | 2025-02-11 | A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c… |
CVE-2025-1180 | Low | 3.1 | 2025-02-11 | A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh… |
CVE-2025-1179 | Medium | 5.0 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of th… |
CVE-2025-1178 | Medium | 5.6 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libb… |
CVE-2025-0181 | Critical | 9.8 | 2025-02-11 | The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the… |
CVE-2025-0180 | Critical | 9.8 | 2025-02-11 | The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly… |
CVE-2025-1177 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Ad… |
CVE-2025-1176 | Medium | 5.0 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the c… |
CVE-2025-1211 | Medium | 6.5 | 2025-02-11 | Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and h… |
CVE-2025-1174 | Low | 2.4 | 2025-02-11 | A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the f… |
CVE-2025-1173 | Medium | 4.7 | 2025-02-11 | A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file process… |
CVE-2025-1172 | Medium | 6.3 | 2025-02-11 | A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown func… |
CVE-2025-1171 | Low | 3.5 | 2025-02-11 | A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown f… |
CVE-2025-1145 | Medium | 6.1 | 2025-02-11 | NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript… |
CVE-2025-1144 | Critical | 9.8 | 2025-02-11 | School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database info… |
CVE-2025-1143 | High | 8.4 | 2025-02-11 | Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these cre… |
CVE-2025-1170 | Low | 3.5 | 2025-02-11 | A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the fi… |
CVE-2025-1169 | Low | 3.5 | 2025-02-11 | A vulnerability was found in SourceCodester Image Compressor Tool 1.0. It has been rated as problematic. This issue affects some unknown processing of the file… |
CVE-2025-1168 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code o… |
CVE-2025-1167 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is some unknown function… |
CVE-2025-1166 | Medium | 6.3 | 2025-02-11 | A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-25243 | High | 8.6 | 2025-02-11 | SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arb… |
CVE-2025-25241 | Medium | 5.4 | 2025-02-11 | Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to acc… |
CVE-2025-24876 | High | 8.1 | 2025-02-11 | The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal t… |
CVE-2025-24875 | Medium | 6.8 | 2025-02-11 | SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in… |
CVE-2025-24874 | Medium | 6.8 | 2025-02-11 | SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not b… |
CVE-2025-24872 | Medium | 4.3 | 2025-02-11 | The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on b… |
CVE-2025-24870 | Medium | 6.0 | 2025-02-11 | SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information wi… |
CVE-2025-24869 | Medium | 4.3 | 2025-02-11 | SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their… |
CVE-2025-24868 | High | 7.1 | 2025-02-11 | The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthentic… |
CVE-2025-24867 | Medium | 6.1 | 2025-02-11 | SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application all… |
CVE-2025-23193 | Medium | 5.3 | 2025-02-11 | SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of… |
CVE-2025-23191 | Low | 3.1 | 2025-02-11 | Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An atta… |
CVE-2025-23190 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would othe… |
CVE-2025-23189 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This l… |
CVE-2025-23187 | Medium | 5.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This… |
CVE-2025-1165 | High | 7.3 | 2025-02-11 | A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ash… |
CVE-2025-0064 | High | 8.7 | 2025-02-11 | Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to gen… |
CVE-2025-0054 | Medium | 5.4 | 2025-02-11 | SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows… |
CVE-2025-1164 | Medium | 5.3 | 2025-02-11 | A vulnerability, which was classified as problematic, has been found in code-projects Police FIR Record Management System 1.0. This issue affects some unknown… |
CVE-2025-1163 | Medium | 5.3 | 2025-02-11 | A vulnerability classified as critical was found in code-projects Vehicle Parking Management System 1.0. This vulnerability affects the function login of the c… |
CVE-2025-25194 | Medium | 4.0 | 2025-02-10 | Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for… |
CVE-2025-1162 | Medium | 6.3 | 2025-02-10 | A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profil… |
CVE-2025-1160 | High | 7.3 | 2025-02-10 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-25193 | Medium | 5.5 | 2025-02-10 | Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of env… |
CVE-2025-25190 | | 2025-02-10 | The ZOO-Project is an open source processing platform. The ZOO-Project Web Processing Service (WPS) Server contains a Cross-Site Scripting (XSS) vulnerability… | |
CVE-2025-25189 | | 2025-02-10 | The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web Processing Service (WPS) pu… | |
CVE-2025-24970 | High | 7.5 | 2025-02-10 | Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. Wh… |
CVE-2025-1159 | Low | 3.5 | 2025-02-10 | A vulnerability was found in CampCodes School Management Software 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-1158 | Medium | 6.3 | 2025-02-10 | A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unknown function of the file addPolicyToSa… |
CVE-2025-1157 | Medium | 6.3 | 2025-02-10 | A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the file /model/model_r… |
CVE-2025-1156 | High | 7.3 | 2025-02-10 | A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login… |
CVE-2025-1002 | Medium | 5.7 | 2025-02-10 | MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged… |
CVE-2025-24016 | Critical | 9.9 | 2025-02-10 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe d… |
CVE-2025-1155 | Medium | 4.3 | 2025-02-10 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your… |
CVE-2025-1154 | Medium | 6.3 | 2025-02-10 | A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-24200 | Medium | 6.1 | 2025-02-10 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 1… |
CVE-2025-1153 | Low | 3.1 | 2025-02-10 | A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format… |
CVE-2025-25188 | | 2025-02-10 | Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5… | |
CVE-2025-1152 | Low | 3.1 | 2025-02-10 | A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The… |
CVE-2025-1151 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the componen… |
CVE-2025-1150 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of… |
CVE-2025-25186 | Medium | 6.5 | 2025-02-10 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0… |
CVE-2025-24892 | Low | 3.5 | 2025-02-10 | OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before di… |
CVE-2025-24032 | | 2025-02-10 | PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default v… | |
CVE-2025-24031 | | 2025-02-10 | PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 module segfaults when a… | |
CVE-2025-21693 | High | 7.8 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress(… |
CVE-2025-21692 | High | 7.8 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_… |