Skip to content
OpenAdvisories

Archive

15 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /15 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.5
    CVE-2024-52005 Public exploit

    The sideband payload is passed unfiltered to the terminal in git

    Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "r…

    git git git git Debian Ubuntu Azure Linux Wolfi
  • Medium 6.6
    CVE-2025-23040 Public exploit

    Maliciously crafted remote URLs could lead to credential leak in GitHub Desktop

    GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously…

    desktop desktop
  • Critical 9.3
    CVE-2025-22785 Public exploit Scanner template

    WordPress Course Booking System plugin <= 6.0.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.

    ComMotion Course Booking System
  • Critical 9.8
    CVE-2024-12084 Public exploit EPSS 73%

    Rsync: heap buffer overflow in rsync due to improper checksum length handling

    A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of b…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2024-11848 Public exploit

    NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticate…

    NitroPack NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization Web / CMS
  • Low 3.3
    CVE-2024-55503 Public exploit

    An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_I…

    terminus Ubuntu
  • Low 3.3
    CVE-2024-53407 Public exploit

    In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially l…

  • Critical 9.1
    CVE-2024-57727 Exploited · Ransomware Public exploit Scanner template EPSS 97%

    SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enab…

    KEV Feb 13, 2025
  • Medium 4.8
    CVE-2024-41453 Public exploit

    A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbit…

  • Critical 9.0
    CVE-2025-23061 Public exploit Scanner template

    Mongoose search injection vulnerability

    Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

    mongoosejs Mongoose mongoose npm
  • High 8.1
    CVE-2025-22964 Public exploit

    DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability cause…

  • Critical 9.8
    CVE-2025-22968 Public exploit

    An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account with…