Skip to content
OpenAdvisories

Archive

January 2025

Vulnerabilities first published in this month (UTC), newest first.

← December 2024 2025 / January February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

2,209 results · Clear filters · Feed

  • Medium 6.3
    CVE-2024-57213

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd par…

  • Medium 4.0
    CVE-2024-57822

    In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquad…

    librdf Raptor RDF Syntax Library raptor2 raptor2 Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2024-57214

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname param…

  • Medium 5.1
    CVE-2024-57212

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parame…

  • Medium 5.4
    CVE-2024-54997

    MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field…

  • Medium 5.4
    CVE-2024-54998

    MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter…

  • Medium 6.5
    CVE-2024-54994

    MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_na…

  • Medium 5.9
    CVE-2024-54847

    An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access…

  • Medium 5.9
    CVE-2024-54849

    An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensiti…

  • Medium 5.9
    CVE-2024-54846

    An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data …

  • Medium 6.1
    CVE-2024-54687

    Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAnd…

  • Medium 4.7
    CVE-2024-54910 Public exploit

    Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.

  • Medium 6.1
    CVE-2025-23110

    An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject fie…

    Vanderbilt REDCap
  • Medium 6.1
    CVE-2025-23112

    An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users …

    Vanderbilt REDCap
  • Medium 4.7
    CVE-2025-23111

    An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redir…

    Vanderbilt REDCap
  • Medium 4.0
    CVE-2025-23022

    FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

    FreeType FreeType
  • Medium 5.3
    CVE-2024-13312

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.

    Drupal Open Social
  • Medium 6.5
    CVE-2024-13310

    Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

    Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

    Drupal Git Utilities for Drupal drupal/git_utils Web / CMS Packagist
  • Medium 5.4
    CVE-2024-13309

    Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

    Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 4.8
    CVE-2024-13305

    Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

    Drupal Entity Form Steps drupal/entity_form_steps Packagist
  • Medium 4.5
    CVE-2024-13304

    Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

    Drupal Minify JS drupal/minifyjs Packagist
  • Medium 5.3
    CVE-2024-13303

    Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

    Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.

    Drupal Download All Files drupal/download_all_files Packagist
  • Medium 5.3
    CVE-2024-13302

    Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

    Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

    Drupal Pages Restriction Access drupal/pages_restriction Packagist
  • Medium 6.1
    CVE-2024-13301

    OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sig…

    Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) drupal/miniorange_oauth_client Packagist
  • Medium 6.6
    CVE-2024-13300

    Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066

    Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.

    Drupal Print Anything
  • Medium 6.6
    CVE-2024-13299

    Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065

    Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

    Drupal Megamenu Framework
  • Medium 4.8
    CVE-2024-13298

    Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

    Drupal Tarte au Citron drupal/tarte_au_citron Packagist
  • Medium 6.6
    CVE-2024-13297

    Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063

    Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.

    Drupal Eloqua
  • Medium 6.6
    CVE-2024-13296

    Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

    Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

    Drupal Mailjet drupal/mailjet Packagist
  • Medium 6.6
    CVE-2024-13295

    Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

    Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.

    Drupal Node export
  • Medium 5.4
    CVE-2024-13294

    POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Medium 4.8
    CVE-2024-13292

    Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.

    Drupal Tooltip drupal/tooltip Packagist
  • Medium 5.3
    CVE-2024-13290

    OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056

    Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.

    Drupal OhDear Integration drupal/ohdear_integration Packagist
  • Medium 5.4
    CVE-2024-13289

    Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.

    Drupal Cookiebot + GTM drupal/cookiebot_gtm Packagist
  • Medium 4.3
    CVE-2024-13288

    Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

    Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 5.4
    CVE-2024-13287

    Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.

    Drupal Views SVG Animation drupal/views_svg_animation Packagist
  • Medium 5.4
    CVE-2024-13286

    SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.

    Drupal SVG Embed drupal/svg_embed Packagist
  • Medium 6.1
    CVE-2024-13283

    Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.

    Drupal Facets drupal/facets Packagist
  • Medium 5.3
    CVE-2024-13275

    Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

    Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.

    Drupal Security Kit drupal/seckit Packagist
  • Medium 5.3
    CVE-2024-13274

    Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

    Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.

    Drupal Open Social goalgorilla/open_social Packagist