Skip to content
OpenAdvisories

Archive

8 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /8 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.0
    CVE-2025-0282 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.…

    ivanti Connect Secure Policy Secure Neurons for ZTA gateways Network devices
    KEV Jan 8, 2025
  • Critical 9.4
    CVE-2025-22141

    WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'

    WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificar_recursos_cargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, com…

    nilsonLazarin WeGIA
  • Critical 9.4
    CVE-2025-22140

    WeGIA SQL Injection (Blind Time-Based) endpoint 'dependente_listar_um.php' parameter 'id_dependente'

    WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar_um.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary …

    nilsonLazarin WeGIA
  • Critical 9.8
    CVE-2024-56779

    nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files rem…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-22137

    Arbitrary File Overwrite via HTTP POST in Pingvin Share

    Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anonymous shares are allowed) user to overwrite arbitrary files on the server, including sensitive system…

    stonith404 pingvin-share
  • Critical 9.8
    CVE-2024-54676 EPSS 69%

    Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

    Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to …

    Apache Software Foundation Apache OpenMeetings org.apache.openmeetings:openmeetings-parent Maven
  • Critical 9.8
    CVE-2024-11350

    AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover

    The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_…

    scriptsbundle AdForest Web / CMS
  • Critical 9.8
    CVE-2024-11635 Public exploit

    WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution

    The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server.

    Nickboss Iptanus File Upload Web / CMS
  • Critical 9.8
    CVE-2024-11613 Public exploit

    WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion

    The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitiz…

    Nickboss Iptanus File Upload Web / CMS
  • Critical 10.0
    CVE-2024-50603 Exploited Public exploit Scanner template EPSS 99%

    An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutraliz…

    Aviatrix Controller
    KEV Jan 16, 2025