Skip to content
OpenAdvisories

Archive

9 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /9 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

66 results · Clear filters · Feed

  • High 8.8
    CVE-2025-21380

    Azure Marketplace SaaS Resources Information Disclosure Vulnerability

    Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.

    Microsoft Marketplace SaaS
  • High 8.8
    CVE-2025-21385 Public exploit EPSS 28%

    Microsoft Purview Information Disclosure Vulnerability

    A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.

    Microsoft Microsoft Purview
  • High 7.3
    CVE-2024-13311

    Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

    Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

    Drupal Allow All File Extensions for file fields drupal/all_extensions Packagist
  • High 7.3
    CVE-2024-13291

    Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057

    Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.

    Drupal Basic HTTP Authentication
  • High 8.8
    CVE-2024-13284

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    Drupal Gutenberg drupal/gutenberg Packagist
  • High 8.8
    CVE-2024-13282

    Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046

    Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.

    Drupal Block permissions drupal/block_permissions Packagist
  • High 7.5
    CVE-2024-13276

    File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.

    Drupal File Entity (fieldable files)
  • High 7.5
    CVE-2024-13267

    Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

    Drupal Opigno TinCan Question Type
  • High 7.5
    CVE-2024-13265

    Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.

    Drupal Opigno Learning path drupal/opigno_learning_path Packagist
  • High 8.8
    CVE-2024-13260

    Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.

    Drupal Migrate queue importer drupal/migrate_queue_importer Packagist
  • High 7.5
    CVE-2024-13259

    Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

    Drupal Image Sizes drupal/image_sizes Packagist
  • High 7.5
    CVE-2024-13256

    Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

    Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.

    Drupal Email Contact drupal/email_contact Packagist
  • High 7.5
    CVE-2024-13255

    RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.

    Drupal RESTful Web Services
  • High 7.5
    CVE-2024-13254

    REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.

    Drupal REST Views drupal/rest_views Packagist
  • High 8.8
    CVE-2024-13251

    Registration role - Critical - Access bypass - SA-CONTRIB-2024-015

    Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.

    Drupal Registration role drupal/registration_role Packagist
  • High 8.8
    CVE-2024-13250

    Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.

    Drupal Drupal Symfony Mailer Lite drupal/symfony_mailer_lite Web / CMS Packagist
  • High 8.8
    CVE-2024-13244

    Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.

    Drupal Migrate Tools drupal/migrate_tools Packagist
  • High 7.5
    CVE-2024-13240

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004

    Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05.

    Drupal Open Social
  • High 7.5
    CVE-2025-21598

    Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash

    An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enab…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • High 7.5
    CVE-2025-21599

    Junos OS Evolved: Receipt of specifically malformed IPv6 packets causes kernel memory exhaustion leading to Denial of Service

    A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Tunnel Driver (jtd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause Denial of Service.  Receipt of specifically malformed IPv6 pac…

    Juniper Networks Junos OS Evolved Network devices
  • High 7.1
    CVE-2025-22295

    WordPress Tripetto plugin <= 8.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder…

    Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Web / CMS
  • High 7.1
    CVE-2025-22307

    WordPress Product Table for WooCommerce plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam Product Table for WooCommerce woo-product-table allows Reflected XSS.This issue affects Product Table for WooCommerce: from n/a through <= 4.0.3.

    Saiful Islam Product Table for WooCommerce Web / CMS
  • High 7.1
    CVE-2025-22313

    WordPress Widgetize Pages Light plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.

    otwthemes Widgetize Pages Light
  • High 7.1
    CVE-2025-22331

    WordPress Cf7Save Extension plugin <= 1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in P3JX Cf7Save Extension cf7save-extension allows Reflected XSS.This issue affects Cf7Save Extension: from n/a through <= 1.

    P3JX Cf7Save Extension
  • High 7.1
    CVE-2025-22330

    WordPress MG Parallax Slider plugin <= 1.0. - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider mg-parallax-slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through <= 1.0..

    Mahesh Waghmare MG Parallax Slider
  • High 7.1
    CVE-2025-22345

    WordPress TS Comfort DB plugin <= 2.0.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tsinf TS Comfort DB ts-comfort-database allows Reflected XSS.This issue affects TS Comfort DB: from n/a through <= 2.0.7.

    tsinf TS Comfort DB
  • High 7.1
    CVE-2025-22361

    WordPress Opentracker Analytics Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics opentracker-analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through <= 1.3.

    Opentracker Opentracker Analytics
  • High 8.1
    CVE-2025-22508

    WordPress FAT Event Lite plugin <= 1.1 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Event Lite fat-event-lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through <= 1.1.

    roninwp FAT Event Lite
  • High 8.5
    CVE-2025-22505

    WordPress NC Wishlist for Woocommerce Plugin <= 1.0.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crispweb NC Wishlist for Woocommerce nc-wishlist-for-woocommerce allows SQL Injection.This issue affects NC Wishlist for Woocommerce: from n/a through <= 1.0…

    Crispweb NC Wishlist for Woocommerce Web / CMS
  • High 7.2
    CVE-2025-22510 Public exploit

    WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.

    kkarpieszuk WC Price History for Omnibus
  • High 7.1
    CVE-2025-22521

    WordPress wp Hosting Performance Check Plugin <= 2.18.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check wp-hosting-performance-check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a throug…

    Scott Farrell wp Hosting Performance Check
  • High 8.5
    CVE-2025-22535

    WordPress WPListCal Plugin <= 1.3.5 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jonkern WPListCal wplistcal allows SQL Injection.This issue affects WPListCal: from n/a through <= 1.3.5.

    jonkern WPListCal
  • High 7.6
    CVE-2025-22527

    WordPress Mailing Group Listserv Plugin <= 2.0.9 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.

    Yamna Khawaja Mailing Group Listserv
  • High 8.5
    CVE-2025-22537

    WordPress Google Maps Travel Route Plugin <= 1.3.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in traveller11 Google Maps Travel Route google-maps-travel-route allows SQL Injection.This issue affects Google Maps Travel Route: from n/a through <= 1.3.1.

    traveller11 Google Maps Travel Route
  • High 7.1
    CVE-2025-22539

    WordPress Custom DataBase Tables Plugin <= 2.1.34 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables custom-database-tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through <= 2.1.34.

    ka2 Custom DataBase Tables
  • High 7.1
    CVE-2025-22594

    WordPress Better User Shortcodes Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder Better User Shortcodes better-user-shortcodes allows Reflected XSS.This issue affects Better User Shortcodes: from n/a through <= 1.0.

    hccoder Better User Shortcodes
  • High 7.1
    CVE-2025-22595

    WordPress Mailing Group Listserv Plugin <= 2.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Reflected XSS.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.

    Yamna Khawaja Mailing Group Listserv
  • High 7.1
    CVE-2025-22814

    WordPress Zephyr Admin Theme Plugin <= 1.4.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.

    Dylan James Zephyr Admin Theme
  • High 8.2
    CVE-2023-24012 Public exploit

    Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS

    An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s…

    OpenDDS DDS
  • High 8.2
    CVE-2023-24011

    Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Cyclone DDS

    An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s…

    ZettaScale DDS