2025 CVEs (page 413)
Page 413 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1072 | Medium | 6.5 | 2025-02-07 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5… |
CVE-2025-22402 | Low | 2.6 | 2025-02-07 | Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnera… |
CVE-2025-1086 | Medium | 5.3 | 2025-02-07 | A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /s… |
CVE-2025-1061 | Critical | 9.8 | 2025-02-07 | The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient… |
CVE-2025-1085 | Medium | 4.3 | 2025-02-07 | A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manip… |
CVE-2025-1084 | Medium | 4.3 | 2025-02-07 | A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionalit… |
CVE-2025-0675 | High | 7.5 | 2025-02-07 | Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure. |
CVE-2025-0674 | Critical | 9.8 | 2025-02-07 | Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Att… |
CVE-2025-21408 | High | 8.8 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21404 | Medium | 4.3 | 2025-02-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-21342 | High | 8.8 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21283 | Medium | 6.5 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21279 | Medium | 6.5 | 2025-02-06 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-21267 | Medium | 4.4 | 2025-02-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-21253 | Medium | 5.3 | 2025-02-06 | Microsoft Edge for IOS and Android Spoofing Vulnerability |
CVE-2025-21177 | High | 8.7 | 2025-02-06 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network. |
CVE-2025-1083 | Low | 3.1 | 2025-02-06 | A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-1082 | Low | 3.5 | 2025-02-06 | A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question… |
CVE-2025-23094 | High | 7.3 | 2025-02-06 | The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and… |
CVE-2025-1081 | Low | 3.1 | 2025-02-06 | A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the co… |
CVE-2025-1004 | Medium | 5.3 | 2025-02-06 | Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Pro… |
CVE-2025-0158 | Medium | 5.5 | 2025-02-06 | IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation. |
CVE-2025-23093 | High | 8.8 | 2025-02-06 | The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to… |
CVE-2025-22936 | Medium | 5.7 | 2025-02-06 | An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information vi… |
CVE-2025-24787 | High | 8.6 | 2025-02-06 | WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, whi… |
CVE-2025-24786 | Critical | 10.0 | 2025-02-06 | WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traver… |
CVE-2025-22992 | Critical | 9.8 | 2025-02-06 | A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9. The vulnerability is caused by improper handling of us… |
CVE-2025-24981 | Critical | 9.3 | 2025-02-06 | MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logic of the URL from m… |
CVE-2025-23217 | | 2025-02-06 | mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmpro… | |
CVE-2025-22867 | High | 7.5 | 2025-02-06 | On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_pat… |
CVE-2025-22866 | Medium | 4.0 | 2025-02-06 | Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on… |
CVE-2025-1078 | Medium | 5.3 | 2025-02-06 | A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the functio… |
CVE-2025-0994 | High | 8.8 | 2025-02-06 | Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This… |
CVE-2025-1076 | Medium | 4.8 | 2025-02-06 | A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaSc… |
CVE-2025-1074 | Medium | 4.3 | 2025-02-06 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the compo… |
CVE-2025-0982 | Critical | 10.0 | 2025-02-06 | Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScr… |
CVE-2025-0859 | Medium | 6.5 | 2025-02-06 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including… |
CVE-2025-24845 | Medium | 5.5 | 2025-02-06 | Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If a… |
CVE-2025-24483 | Medium | 5.5 | 2025-02-06 | NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the… |
CVE-2025-23236 | High | 8.8 | 2025-02-06 | Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege… |
CVE-2025-22894 | High | 8.8 | 2025-02-06 | Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially craf… |
CVE-2025-20094 | High | 8.8 | 2025-02-06 | Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially craf… |
CVE-2025-22890 | High | 8.8 | 2025-02-06 | Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYS… |
CVE-2025-0522 | Medium | 4.7 | 2025-02-06 | The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2025-0799 | Medium | 6.5 | 2025-02-06 | IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the sys… |
CVE-2025-1066 | Critical | 9.8 | 2025-02-06 | OpenPLC_V3 contains an arbitrary file upload vulnerability, which could be leveraged for malvertising or phishing campaigns. |
CVE-2025-24805 | Medium | 5.5 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2025-24804 | Medium | 4.3 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2025-24803 | Medium | 5.4 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2025-24372 | High | 7.3 | 2025-02-05 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a… |
CVE-2025-24497 | High | 7.5 | 2025-02-05 | When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of… |
CVE-2025-24326 | High | 7.5 | 2025-02-05 | When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilizati… |
CVE-2025-24320 | High | 8.0 | 2025-02-05 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript i… |
CVE-2025-24319 | Medium | 6.5 | 2025-02-05 | When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kuber… |
CVE-2025-24312 | High | 7.5 | 2025-02-05 | When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclose… |
CVE-2025-23419 | Medium | 4.3 | 2025-02-05 | When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentic… |
CVE-2025-23415 | Low | 3.1 | 2025-02-05 | An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass end… |
CVE-2025-23413 | Medium | 4.4 | 2025-02-05 | When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. N… |
CVE-2025-23412 | High | 7.5 | 2025-02-05 | When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have rea… |
CVE-2025-23239 | High | 8.7 | 2025-02-05 | When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iCon… |
CVE-2025-22891 | High | 7.5 | 2025-02-05 | When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop pr… |
CVE-2025-22846 | High | 7.5 | 2025-02-05 | When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microker… |
CVE-2025-21091 | High | 7.5 | 2025-02-05 | When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which h… |
CVE-2025-21087 | High | 7.5 | 2025-02-05 | When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in me… |
CVE-2025-20058 | High | 7.5 | 2025-02-05 | When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Softwa… |
CVE-2025-20045 | High | 7.5 | 2025-02-05 | When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type vi… |
CVE-2025-20029 | High | 8.8 | 2025-02-05 | Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitra… |
CVE-2025-20207 | Medium | 4.3 | 2025-02-05 | A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web A… |
CVE-2025-20205 | Medium | 4.8 | 2025-02-05 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attac… |
CVE-2025-20204 | Medium | 4.8 | 2025-02-05 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attac… |
CVE-2025-20185 | Low | 3.4 | 2025-02-05 | A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email G… |
CVE-2025-20184 | Medium | 6.5 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an au… |
CVE-2025-20183 | Medium | 5.8 | 2025-02-05 | A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could… |
CVE-2025-20180 | Medium | 4.8 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an… |
CVE-2025-20179 | Medium | 6.1 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct a cross-site script… |
CVE-2025-20176 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20175 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20174 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20173 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20172 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to… |
CVE-2025-20171 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20170 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20169 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20125 | Critical | 9.1 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change n… |
CVE-2025-20124 | Critical | 9.9 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. T… |
CVE-2025-0858 | | 2025-02-05 | A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not properly prevent path traversal and… | |
CVE-2025-21117 | Medium | 6.6 | 2025-02-05 | Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vul… |
CVE-2025-0725 | High | 7.3 | 2025-02-05 | When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3… |
CVE-2025-0665 | High | 7.0 | 2025-02-05 | libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. |
CVE-2025-0167 | Low | 3.4 | 2025-02-05 | When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to hos… |
CVE-2025-25246 | High | 8.1 | 2025-02-05 | NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users. |
CVE-2025-1026 | High | 8.6 | 2025-02-05 | Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, w… |
CVE-2025-1025 | High | 7.5 | 2025-02-05 | Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upl… |
CVE-2025-1022 | High | 8.2 | 2025-02-05 | Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), wh… |
CVE-2025-1028 | High | 8.1 | 2025-02-05 | The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all… |
CVE-2025-23114 | Critical | 9.0 | 2025-02-05 | A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a fail… |
CVE-2025-0413 | High | 7.8 | 2025-02-05 | Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2025-23023 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to… |
CVE-2025-22602 | Medium | 6.5 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting… |
CVE-2025-22601 | Low | 3.1 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username v… |