Skip to content
OpenAdvisories

Archive

14 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /14 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Medium 5.4
    CVE-2024-47605 Public exploit

    Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin

    silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing t…

    silverstripe silverstripe-asset-admin silverstripe/framework Packagist
  • Critical 9.1
    CVE-2024-49375 Public exploit

    Remote Code Execution via Remote Model Loading in Rasa

    Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are…

    RasaHQ rasa-pro-security-advisories rasa-pro rasa PyPI
  • High 7.8
    CVE-2025-21333 Exploited Public exploit EPSS 10%

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

    Microsoft Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2025 Windows
    KEV Jan 14, 2025
  • Medium 5.5
    CVE-2025-21340 Public exploit

    Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

    Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Critical 9.8
    CVE-2025-21298 Public exploit EPSS 74%

    Windows OLE Remote Code Execution Vulnerability

    Windows OLE Remote Code Execution Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 8.8
    CVE-2025-21293 Public exploit EPSS 15%

    Active Directory Domain Services Elevation of Privilege Vulnerability

    Active Directory Domain Services Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.5
    CVE-2024-12085 Public exploit

    Rsync: info leak via uninitialized stack contents

    A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitializ…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2024-13159 Exploited Public exploit Scanner template EPSS 100%

    Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security U…

    ivanti Endpoint Manager Network devices
    KEV Mar 10, 2025
  • Critical 9.6
    CVE-2024-55591 Exploited · Ransomware Public exploit Scanner template EPSS 94%

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thr…

    Fortinet FortiOS FortiProxy Network devices
    KEV Jan 14, 2025
  • High 8.2
    CVE-2024-7344 Public exploit

    Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.

    Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.

    Howyar CES Taiwan Radix SignalComputer
  • Medium 5.3
    CVE-2024-12008 Public exploit Scanner template

    W3 Total Cache <= 2.8.1 Information Exposure via Log Files

    The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive informati…

    Bold Grid W3 Total Cache Web / CMS
  • High 8.5
    CVE-2024-12365 Public exploit

    W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

    The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Sub…

    Bold Grid W3 Total Cache Web / CMS
  • High 8.8
    CVE-2024-50858 Public exploit

    Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute acti…

  • Medium 6.1
    CVE-2024-50861 Public exploit

    The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious co…

  • Medium 4.8
    CVE-2024-50857 Public exploit Scanner template

    The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and e…

  • Medium 4.8
    CVE-2024-50859 Public exploit

    The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly form…

  • Critical 9.8
    CVE-2024-48760 Public exploit EPSS 46%

    An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attack…