2025 CVEs (page 413)
Page 413 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1182 | Medium | 5.0 | 2025-02-11 | A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elfl… |
CVE-2025-0589 | Medium | 5.3 | 2025-02-11 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API… |
CVE-2025-1181 | Medium | 5.0 | 2025-02-11 | A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c… |
CVE-2025-1180 | Low | 3.1 | 2025-02-11 | A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh… |
CVE-2025-1179 | Medium | 5.0 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of th… |
CVE-2025-1178 | Medium | 5.6 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libb… |
CVE-2025-0181 | Critical | 9.8 | 2025-02-11 | The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the… |
CVE-2025-0180 | Critical | 9.8 | 2025-02-11 | The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly… |
CVE-2025-1177 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Ad… |
CVE-2025-1176 | Medium | 5.0 | 2025-02-11 | A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the c… |
CVE-2025-1211 | Medium | 6.5 | 2025-02-11 | Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and h… |
CVE-2025-1174 | Low | 2.4 | 2025-02-11 | A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the f… |
CVE-2025-1173 | Medium | 4.7 | 2025-02-11 | A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file process… |
CVE-2025-1172 | Medium | 6.3 | 2025-02-11 | A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown func… |
CVE-2025-1171 | Low | 3.5 | 2025-02-11 | A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown f… |
CVE-2025-1145 | Medium | 6.1 | 2025-02-11 | NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript… |
CVE-2025-1144 | Critical | 9.8 | 2025-02-11 | School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database info… |
CVE-2025-1143 | High | 8.4 | 2025-02-11 | Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these cre… |
CVE-2025-1170 | Low | 3.5 | 2025-02-11 | A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the fi… |
CVE-2025-1169 | Low | 3.5 | 2025-02-11 | A vulnerability was found in SourceCodester Image Compressor Tool 1.0. It has been rated as problematic. This issue affects some unknown processing of the file… |
CVE-2025-1168 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code o… |
CVE-2025-1167 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is some unknown function… |
CVE-2025-1166 | Medium | 6.3 | 2025-02-11 | A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-25243 | High | 8.6 | 2025-02-11 | SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arb… |
CVE-2025-25241 | Medium | 5.4 | 2025-02-11 | Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to acc… |
CVE-2025-24876 | High | 8.1 | 2025-02-11 | The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal t… |
CVE-2025-24875 | Medium | 6.8 | 2025-02-11 | SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in… |
CVE-2025-24874 | Medium | 6.8 | 2025-02-11 | SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not b… |
CVE-2025-24872 | Medium | 4.3 | 2025-02-11 | The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on b… |
CVE-2025-24870 | Medium | 6.0 | 2025-02-11 | SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information wi… |
CVE-2025-24869 | Medium | 4.3 | 2025-02-11 | SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their… |
CVE-2025-24868 | High | 7.1 | 2025-02-11 | The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthentic… |
CVE-2025-24867 | Medium | 6.1 | 2025-02-11 | SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application all… |
CVE-2025-23193 | Medium | 5.3 | 2025-02-11 | SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of… |
CVE-2025-23191 | Low | 3.1 | 2025-02-11 | Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An atta… |
CVE-2025-23190 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would othe… |
CVE-2025-23189 | Medium | 4.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This l… |
CVE-2025-23187 | Medium | 5.3 | 2025-02-11 | Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This… |
CVE-2025-1165 | High | 7.3 | 2025-02-11 | A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ash… |
CVE-2025-0064 | High | 8.7 | 2025-02-11 | Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to gen… |
CVE-2025-0054 | Medium | 5.4 | 2025-02-11 | SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows… |
CVE-2025-1164 | Medium | 5.3 | 2025-02-11 | A vulnerability, which was classified as problematic, has been found in code-projects Police FIR Record Management System 1.0. This issue affects some unknown… |
CVE-2025-1163 | Medium | 5.3 | 2025-02-11 | A vulnerability classified as critical was found in code-projects Vehicle Parking Management System 1.0. This vulnerability affects the function login of the c… |
CVE-2025-25194 | Medium | 4.0 | 2025-02-10 | Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for… |
CVE-2025-1162 | Medium | 6.3 | 2025-02-10 | A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profil… |
CVE-2025-1160 | High | 7.3 | 2025-02-10 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-25193 | Medium | 5.5 | 2025-02-10 | Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of env… |
CVE-2025-25190 | | 2025-02-10 | The ZOO-Project is an open source processing platform. The ZOO-Project Web Processing Service (WPS) Server contains a Cross-Site Scripting (XSS) vulnerability… | |
CVE-2025-25189 | | 2025-02-10 | The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web Processing Service (WPS) pu… | |
CVE-2025-24970 | High | 7.5 | 2025-02-10 | Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. Wh… |
CVE-2025-1159 | Low | 3.5 | 2025-02-10 | A vulnerability was found in CampCodes School Management Software 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-1158 | Medium | 6.3 | 2025-02-10 | A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unknown function of the file addPolicyToSa… |
CVE-2025-1157 | Medium | 6.3 | 2025-02-10 | A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the file /model/model_r… |
CVE-2025-1156 | High | 7.3 | 2025-02-10 | A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login… |
CVE-2025-1002 | Medium | 5.7 | 2025-02-10 | MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged… |
CVE-2025-24016 | Critical | 9.9 | 2025-02-10 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe d… |
CVE-2025-1155 | Medium | 4.3 | 2025-02-10 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your… |
CVE-2025-1154 | Medium | 6.3 | 2025-02-10 | A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-24200 | Medium | 6.1 | 2025-02-10 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 1… |
CVE-2025-1153 | Low | 3.1 | 2025-02-10 | A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format… |
CVE-2025-25188 | | 2025-02-10 | Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5… | |
CVE-2025-1152 | Low | 3.1 | 2025-02-10 | A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The… |
CVE-2025-1151 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the componen… |
CVE-2025-1150 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of… |
CVE-2025-25186 | Medium | 6.5 | 2025-02-10 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0… |
CVE-2025-24892 | Low | 3.5 | 2025-02-10 | OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before di… |
CVE-2025-24032 | | 2025-02-10 | PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default v… | |
CVE-2025-24031 | | 2025-02-10 | PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 module segfaults when a… | |
CVE-2025-21693 | High | 7.8 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress(… |
CVE-2025-21692 | High | 7.8 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_… |
CVE-2025-21691 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system ca… |
CVE-2025-21690 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persis… |
CVE-2025-21689 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch addresses… |
CVE-2025-21688 | Medium | 4.7 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd392b9 ("d… |
CVE-2025-21687 | High | 7.8 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from u… |
CVE-2025-1149 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the… |
CVE-2025-1193 | High | 8.1 | 2025-02-10 | Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker t… |
CVE-2025-1148 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c… |
CVE-2025-1147 | Low | 3.1 | 2025-02-10 | A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen… |
CVE-2025-1175 | Medium | 6.1 | 2025-02-10 | Reflected Cross-Site Scripting (XSS) vulnerability in Kelio Visio 1, Kelio Visio X7 and Kelio Visio X4, in versions between 3.2C and 5.1K. This vulnerability c… |
CVE-2025-25247 | Medium | 6.1 | 2025-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix… |
CVE-2025-1099 | | 2025-02-10 | This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access cou… | |
CVE-2025-21685 | Medium | 4.7 | 2025-02-09 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race The yt2_1380_fc_serd… |
CVE-2025-21684 | Medium | 5.5 | 2025-02-09 | In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: Convert gpio_lock to raw spinlock irq_chip functions may be called in raw s… |
CVE-2025-0169 | Medium | 6.4 | 2025-02-08 | The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insuff… |
CVE-2025-0316 | Critical | 9.8 | 2025-02-08 | The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authent… |
CVE-2025-1117 | High | 7.3 | 2025-02-08 | A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the arg… |
CVE-2025-1116 | High | 7.3 | 2025-02-08 | A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the… |
CVE-2025-1115 | Low | 3.3 | 2025-02-08 | A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_contro… |
CVE-2025-25187 | High | 7.8 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is cause… |
CVE-2025-24028 | High | 7.8 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is cause… |
CVE-2025-1114 | Low | 3.5 | 2025-02-07 | A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component… |
CVE-2025-24366 | High | 7.5 | 2025-02-07 | SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default command… |
CVE-2025-1113 | Medium | 6.3 | 2025-02-07 | A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of… |
CVE-2025-25183 | Low | 2.6 | 2025-02-07 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting… |
CVE-2025-24980 | Medium | 5.3 | 2025-02-07 | pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumerat… |
CVE-2025-1106 | Medium | 5.4 | 2025-02-07 | A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/da… |
CVE-2025-1105 | Medium | 4.3 | 2025-02-07 | A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /app/sae/de… |
CVE-2025-1104 | High | 7.3 | 2025-02-07 | A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authent… |
CVE-2025-1103 | Medium | 6.5 | 2025-02-07 | A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /go… |