2025 CVEs (page 417)
Page 417 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0146 | Low | 3.9 | 2025-01-30 | Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local acce… |
CVE-2025-0145 | Medium | 4.6 | 2025-01-30 | Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local ac… |
CVE-2025-0144 | Low | 3.1 | 2025-01-30 | Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access. |
CVE-2025-0143 | Medium | 4.3 | 2025-01-30 | Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access. |
CVE-2025-0142 | Medium | 4.3 | 2025-01-30 | Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of… |
CVE-2025-24507 | | 2025-01-30 | This vulnerability allows appliance compromise at boot time. | |
CVE-2025-24506 | | 2025-01-30 | A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. | |
CVE-2025-24505 | | 2025-01-30 | This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially craf… | |
CVE-2025-24504 | | 2025-01-30 | An improper input validation the CSRF filter results in unsanitized user input written to the application logs. | |
CVE-2025-24503 | | 2025-01-30 | A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. | |
CVE-2025-24502 | | 2025-01-30 | An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by… | |
CVE-2025-24501 | | 2025-01-30 | An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. | |
CVE-2025-24500 | | 2025-01-30 | The vulnerability allows an unauthenticated attacker to access information in PAM database. | |
CVE-2025-0683 | Medium | 5.9 | 2025-01-30 | In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hook… |
CVE-2025-0681 | Medium | 6.2 | 2025-01-30 | The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tappi… |
CVE-2025-0680 | Critical | 9.8 | 2025-01-30 | Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary dev… |
CVE-2025-0626 | High | 7.5 | 2025-01-30 | The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings… |
CVE-2025-0874 | Medium | 6.3 | 2025-01-30 | A vulnerability, which was classified as critical, has been found in code-projects Simple Plugins Car Rental Management 1.0. Affected by this issue is some unk… |
CVE-2025-0498 | Critical | 9.8 | 2025-01-30 | A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insec… |
CVE-2025-0497 | Critical | 9.8 | 2025-01-30 | A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to stori… |
CVE-2025-0477 | Critical | 9.8 | 2025-01-30 | An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak… |
CVE-2025-24099 | Medium | 5.1 | 2025-01-30 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local attacker may be abl… |
CVE-2025-0873 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0367 | Medium | 6.5 | 2025-01-30 | In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could le… |
CVE-2025-24883 | | 2025-01-30 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… | |
CVE-2025-24784 | Medium | 4.3 | 2025-01-30 | kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. The policy group feature, added to by t… |
CVE-2025-24376 | Medium | 6.5 | 2025-01-30 | kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and Admissio… |
CVE-2025-23216 | Medium | 6.8 | 2025-01-30 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error message… |
CVE-2025-22222 | High | 7.7 | 2025-01-30 | VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to… |
CVE-2025-22221 | Medium | 5.2 | 2025-01-30 | VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs… |
CVE-2025-22220 | Medium | 4.3 | 2025-01-30 | VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria… |
CVE-2025-22219 | Medium | 6.8 | 2025-01-30 | VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to injec… |
CVE-2025-0872 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /addpayment… |
CVE-2025-23367 | Medium | 6.5 | 2025-01-30 | A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role… |
CVE-2025-22218 | High | 8.5 | 2025-01-30 | VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the cr… |
CVE-2025-0871 | Low | 3.5 | 2025-01-30 | A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the co… |
CVE-2025-0870 | Medium | 5.6 | 2025-01-30 | A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in… |
CVE-2025-0869 | Medium | 4.3 | 2025-01-30 | A vulnerability was found in Cianet ONU GW24AC up to 20250127. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-0747 | High | 8.6 | 2025-01-30 | A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript cod… |
CVE-2025-0746 | Medium | 6.1 | 2025-01-30 | A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a maliciou… |
CVE-2025-0745 | High | 7.5 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of… |
CVE-2025-0744 | High | 7.5 | 2025-01-30 | an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription p… |
CVE-2025-0743 | Medium | 5.3 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint… |
CVE-2025-0742 | Medium | 5.8 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by… |
CVE-2025-0741 | Medium | 5.8 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into… |
CVE-2025-0740 | High | 8.6 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages… |
CVE-2025-0739 | High | 8.6 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's in… |
CVE-2025-23007 | Medium | 5.5 | 2025-01-30 | A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentially leading to priv… |
CVE-2025-21107 | High | 7.8 | 2025-01-30 | Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privil… |
CVE-2025-0861 | Medium | 4.9 | 2025-01-30 | The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 3.0.1 d… |
CVE-2025-0860 | Medium | 6.1 | 2025-01-30 | The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in all versions up to, and i… |
CVE-2025-0834 | High | 7.8 | 2025-01-30 | Privilege escalation vulnerability has been found in Wondershare Dr.Fone version 13.5.21. This vulnerability could allow an attacker to escalate privileges by… |
CVE-2025-23374 | High | 8.0 | 2025-01-30 | Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information into Log File vulne… |
CVE-2025-0662 | Medium | 4.9 | 2025-01-30 | In some cases, the ktrace facility will log the contents of kernel structures to userspace. In one such case, ktrace dumps a variable-sized sockaddr to usersp… |
CVE-2025-0374 | Medium | 6.5 | 2025-01-30 | When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not… |
CVE-2025-0373 | Medium | 6.0 | 2025-01-30 | On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buff… |
CVE-2025-0849 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of… |
CVE-2025-0848 | Medium | 6.5 | 2025-01-30 | A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetC… |
CVE-2025-0847 | High | 7.3 | 2025-01-30 | A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2025-0846 | High | 7.3 | 2025-01-30 | A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2025-0844 | Medium | 4.3 | 2025-01-30 | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-21415 | Critical | 9.9 | 2025-01-29 | Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. |
CVE-2025-21396 | High | 8.2 | 2025-01-29 | Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-0843 | High | 7.3 | 2025-01-29 | A vulnerability was found in needyamin Library Card System 1.0. It has been classified as critical. Affected is an unknown function of the file admindashboard… |
CVE-2025-0851 | Critical | 9.8 | 2025-01-29 | A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary location… |
CVE-2025-0842 | High | 7.3 | 2025-01-29 | A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of… |
CVE-2025-24884 | | 2025-01-29 | kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real c… | |
CVE-2025-24795 | Medium | 4.4 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24794 | Medium | 6.7 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24793 | High | 7.0 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24788 | Medium | 5.0 | 2025-01-29 | snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which f… |
CVE-2025-0841 | High | 7.3 | 2025-01-29 | A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the co… |
CVE-2025-20061 | Critical | 9.8 | 2025-01-29 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker t… |
CVE-2025-20014 | Critical | 9.8 | 2025-01-29 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker… |
CVE-2025-0840 | Medium | 5.0 | 2025-01-29 | A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/ob… |
CVE-2025-24882 | Medium | 5.2 | 2025-01-29 | regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnera… |
CVE-2025-24790 | Medium | 4.4 | 2025-01-29 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediat… |
CVE-2025-24789 | High | 7.8 | 2025-01-29 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediat… |
CVE-2025-24791 | Medium | 4.4 | 2025-01-29 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissio… |
CVE-2025-24527 | High | 8.0 | 2025-01-29 | An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can ex… |
CVE-2025-24792 | Medium | 4.4 | 2025-01-29 | Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a… |
CVE-2025-24374 | Medium | 4.3 | 2025-01-29 | Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerab… |
CVE-2025-0353 | Medium | 6.4 | 2025-01-29 | The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widg… |
CVE-2025-0762 | High | 8.8 | 2025-01-29 | Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exten… |
CVE-2025-0617 | Medium | 5.9 | 2025-01-29 | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger… |
CVE-2025-0804 | Medium | 6.4 | 2025-01-29 | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-0806 | Medium | 4.3 | 2025-01-29 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as problematic. This issue affects some unknown processing of the file _call_… |
CVE-2025-23362 | Medium | 6.1 | 2025-01-29 | The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered a… |
CVE-2025-0803 | High | 7.3 | 2025-01-29 | A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2025-0802 | High | 7.3 | 2025-01-29 | A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-0800 | Low | 2.4 | 2025-01-29 | A vulnerability classified as problematic has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file /pcci/admin/savee… |
CVE-2025-0798 | High | 8.1 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-0797 | Low | 3.3 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2025-0795 | Low | 3.5 | 2025-01-29 | A vulnerability was found in ESAFENET CDG V5. It has been classified as problematic. This affects an unknown part of the file /todolistjump.jsp. The manipulati… |
CVE-2025-0794 | Low | 3.5 | 2025-01-29 | A vulnerability was found in ESAFENET CDG V5 and classified as problematic. Affected by this issue is some unknown functionality of the file /todoDetail.jsp. T… |
CVE-2025-0793 | Medium | 6.3 | 2025-01-29 | A vulnerability has been found in ESAFENET CDG V5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /todoDetai… |
CVE-2025-0792 | Medium | 6.3 | 2025-01-29 | A vulnerability, which was classified as critical, was found in ESAFENET CDG V5. Affected is an unknown function of the file /sdTodoDetail.jsp. The manipulatio… |
CVE-2025-0791 | Medium | 6.3 | 2025-01-29 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG V5. This issue affects some unknown processing of the file /sdDoneDetail.jsp… |
CVE-2025-0790 | Low | 3.5 | 2025-01-29 | A vulnerability classified as problematic was found in ESAFENET CDG V5. This vulnerability affects unknown code of the file /doneDetail.jsp. The manipulation o… |
CVE-2025-0789 | Medium | 6.3 | 2025-01-28 | A vulnerability classified as critical has been found in ESAFENET CDG V5. This affects an unknown part of the file /doneDetail.jsp. The manipulation of the arg… |