2025 CVEs (page 419)
Page 419 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22220 | Medium | 4.3 | 2025-01-30 | VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria… |
CVE-2025-22219 | Medium | 6.8 | 2025-01-30 | VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to injec… |
CVE-2025-0872 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /addpayment… |
CVE-2025-23367 | Medium | 6.5 | 2025-01-30 | A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role… |
CVE-2025-22218 | High | 8.5 | 2025-01-30 | VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the cr… |
CVE-2025-0871 | Low | 3.5 | 2025-01-30 | A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the co… |
CVE-2025-0870 | Medium | 5.6 | 2025-01-30 | A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in… |
CVE-2025-0869 | Medium | 4.3 | 2025-01-30 | A vulnerability was found in Cianet ONU GW24AC up to 20250127. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-0747 | High | 8.6 | 2025-01-30 | A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript cod… |
CVE-2025-0746 | Medium | 6.1 | 2025-01-30 | A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a maliciou… |
CVE-2025-0745 | High | 7.5 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of… |
CVE-2025-0744 | High | 7.5 | 2025-01-30 | an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription p… |
CVE-2025-0743 | Medium | 5.3 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint… |
CVE-2025-0742 | Medium | 5.8 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by… |
CVE-2025-0741 | Medium | 5.8 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into… |
CVE-2025-0740 | High | 8.6 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages… |
CVE-2025-0739 | High | 8.6 | 2025-01-30 | An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's in… |
CVE-2025-23007 | Medium | 5.5 | 2025-01-30 | A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentially leading to priv… |
CVE-2025-21107 | High | 7.8 | 2025-01-30 | Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privil… |
CVE-2025-0861 | Medium | 4.9 | 2025-01-30 | The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 3.0.1 d… |
CVE-2025-0860 | Medium | 6.1 | 2025-01-30 | The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in all versions up to, and i… |
CVE-2025-0834 | High | 7.8 | 2025-01-30 | Privilege escalation vulnerability has been found in Wondershare Dr.Fone version 13.5.21. This vulnerability could allow an attacker to escalate privileges by… |
CVE-2025-23374 | High | 8.0 | 2025-01-30 | Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information into Log File vulne… |
CVE-2025-0662 | Medium | 4.9 | 2025-01-30 | In some cases, the ktrace facility will log the contents of kernel structures to userspace. In one such case, ktrace dumps a variable-sized sockaddr to usersp… |
CVE-2025-0374 | Medium | 6.5 | 2025-01-30 | When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not… |
CVE-2025-0373 | Medium | 6.0 | 2025-01-30 | On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buff… |
CVE-2025-0849 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of… |
CVE-2025-0848 | Medium | 6.5 | 2025-01-30 | A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetC… |
CVE-2025-0847 | High | 7.3 | 2025-01-30 | A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2025-0846 | High | 7.3 | 2025-01-30 | A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2025-0844 | Medium | 4.3 | 2025-01-30 | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-21415 | Critical | 9.9 | 2025-01-29 | Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. |
CVE-2025-21396 | High | 8.2 | 2025-01-29 | Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-0843 | High | 7.3 | 2025-01-29 | A vulnerability was found in needyamin Library Card System 1.0. It has been classified as critical. Affected is an unknown function of the file admindashboard… |
CVE-2025-0851 | Critical | 9.8 | 2025-01-29 | A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary location… |
CVE-2025-0842 | High | 7.3 | 2025-01-29 | A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of… |
CVE-2025-24884 | | 2025-01-29 | kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real c… | |
CVE-2025-24795 | Medium | 4.4 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24794 | Medium | 6.7 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24793 | High | 7.0 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24788 | Medium | 5.0 | 2025-01-29 | snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which f… |
CVE-2025-0841 | High | 7.3 | 2025-01-29 | A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the co… |
CVE-2025-20061 | Critical | 9.8 | 2025-01-29 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker t… |
CVE-2025-20014 | Critical | 9.8 | 2025-01-29 | mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker… |
CVE-2025-0840 | Medium | 5.0 | 2025-01-29 | A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/ob… |
CVE-2025-24882 | Medium | 5.2 | 2025-01-29 | regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnera… |
CVE-2025-24790 | Medium | 4.4 | 2025-01-29 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediat… |
CVE-2025-24789 | High | 7.8 | 2025-01-29 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediat… |
CVE-2025-24791 | Medium | 4.4 | 2025-01-29 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissio… |
CVE-2025-24527 | High | 8.0 | 2025-01-29 | An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can ex… |
CVE-2025-24792 | Medium | 4.4 | 2025-01-29 | Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a… |
CVE-2025-24374 | Medium | 4.3 | 2025-01-29 | Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerab… |
CVE-2025-0353 | Medium | 6.4 | 2025-01-29 | The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widg… |
CVE-2025-0762 | High | 8.8 | 2025-01-29 | Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exten… |
CVE-2025-0617 | Medium | 5.9 | 2025-01-29 | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger… |
CVE-2025-0804 | Medium | 6.4 | 2025-01-29 | The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-0806 | Medium | 4.3 | 2025-01-29 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as problematic. This issue affects some unknown processing of the file _call_… |
CVE-2025-23362 | Medium | 6.1 | 2025-01-29 | The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered a… |
CVE-2025-0803 | High | 7.3 | 2025-01-29 | A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2025-0802 | High | 7.3 | 2025-01-29 | A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-0800 | Low | 2.4 | 2025-01-29 | A vulnerability classified as problematic has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file /pcci/admin/savee… |
CVE-2025-0798 | High | 8.1 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-0797 | Low | 3.3 | 2025-01-29 | A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2025-0795 | Low | 3.5 | 2025-01-29 | A vulnerability was found in ESAFENET CDG V5. It has been classified as problematic. This affects an unknown part of the file /todolistjump.jsp. The manipulati… |
CVE-2025-0794 | Low | 3.5 | 2025-01-29 | A vulnerability was found in ESAFENET CDG V5 and classified as problematic. Affected by this issue is some unknown functionality of the file /todoDetail.jsp. T… |
CVE-2025-0793 | Medium | 6.3 | 2025-01-29 | A vulnerability has been found in ESAFENET CDG V5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /todoDetai… |
CVE-2025-0792 | Medium | 6.3 | 2025-01-29 | A vulnerability, which was classified as critical, was found in ESAFENET CDG V5. Affected is an unknown function of the file /sdTodoDetail.jsp. The manipulatio… |
CVE-2025-0791 | Medium | 6.3 | 2025-01-29 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG V5. This issue affects some unknown processing of the file /sdDoneDetail.jsp… |
CVE-2025-0790 | Low | 3.5 | 2025-01-29 | A vulnerability classified as problematic was found in ESAFENET CDG V5. This vulnerability affects unknown code of the file /doneDetail.jsp. The manipulation o… |
CVE-2025-0789 | Medium | 6.3 | 2025-01-28 | A vulnerability classified as critical has been found in ESAFENET CDG V5. This affects an unknown part of the file /doneDetail.jsp. The manipulation of the arg… |
CVE-2025-0788 | Medium | 6.3 | 2025-01-28 | A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /content_top.jsp… |
CVE-2025-22917 | Medium | 5.4 | 2025-01-28 | A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web brow… |
CVE-2025-0787 | Low | 3.5 | 2025-01-28 | A vulnerability was found in ESAFENET CDG V5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /appD… |
CVE-2025-0786 | Medium | 6.3 | 2025-01-28 | A vulnerability was found in ESAFENET CDG V5. It has been classified as critical. Affected is an unknown function of the file /appDetail.jsp. The manipulation… |
CVE-2025-0785 | Low | 3.5 | 2025-01-28 | A vulnerability was found in ESAFENET CDG V5 and classified as problematic. This issue affects some unknown processing of the file /SysConfig.jsp. The manipula… |
CVE-2025-24826 | Medium | 6.7 | 2025-01-28 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4625. |
CVE-2025-24482 | | 2025-01-28 | A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for D… | |
CVE-2025-24481 | | 2025-01-28 | An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assign… | |
CVE-2025-0784 | Low | 3.7 | 2025-01-28 | A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usua… |
CVE-2025-24480 | | 2025-01-28 | A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a re… | |
CVE-2025-24479 | | 2025-01-28 | A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access… | |
CVE-2025-24478 | | 2025-01-28 | A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malicious requests resul… | |
CVE-2025-22217 | High | 8.6 | 2025-01-28 | Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this… |
CVE-2025-0783 | Medium | 6.3 | 2025-01-28 | A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpo… |
CVE-2025-0631 | | 2025-01-28 | A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being se… | |
CVE-2025-23057 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23056 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23055 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23054 | Medium | 6.5 | 2025-01-28 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perfo… |
CVE-2025-23053 | Medium | 6.5 | 2025-01-28 | A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow… |
CVE-2025-0781 | High | 8.6 | 2025-01-28 | An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system le… |
CVE-2025-24800 | | 2025-01-28 | Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, th… | |
CVE-2025-23385 | High | 7.8 | 2025-01-28 | In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7… |
CVE-2025-23213 | High | 8.7 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files… |
CVE-2025-23212 | High | 7.7 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate… |
CVE-2025-23211 | Critical | 9.9 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute com… |
CVE-2025-23045 | Critical | 9.8 | 2025-01-28 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT i… |
CVE-2025-0659 | | 2025-01-28 | A path traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character sequence in the body o… | |
CVE-2025-0432 | Medium | 5.7 | 2025-01-28 | EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage. |
CVE-2025-0065 | High | 7.8 | 2025-01-28 | Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker… |